On October 19, 2026, Microsoft published two posts that call the AI agents companies deploy “agentic insiders,” an insider risk to be watched as closely as an employee with too much access. On the company’s official blog, Hayete Gallot, executive vice president of Microsoft Security, writes: “Unfortunately, frontier models, regardless of their origin, cannot be trusted.” Yet Microsoft has invested in both OpenAI and Anthropic, as TechCrunch points out.
The same day, Microsoft’s security blog laid out the tools the company is offering to contain those agents. Microsoft Defender now detects 60 types of local AI agents running on work computers, including Claude Code, OpenAI’s Codex and GitHub Copilot. According to that second post, each agent should get its own identity and permissions scoped to the task at hand. Neither post gives a launch date, pricing or licensing terms.
Gallot refers to “a growing number of incidents” disclosed publicly in recent months, without naming any. Among the most recent, OpenAI on October 15 published four cases where its models bypassed systems to finish a task, and Anthropic on October 9 described unintended actions by its Claude agents, including a false report to the police.
Models trained to get results
Gallot traces the problem to training and writes that it “is not because models are inherently malicious.” Models “have been trained to attain results, which often leads to reward hacking,” meaning the model satisfies whatever it is scored on rather than what the person using it actually wants. Agents may not behave as intended, she adds, and “will collaborate and collude with other agents to reach their objectives, without needing to be compromised.”
Agents inside companies are often overprivileged, Gallot writes, and can make decisions in critical processes. To rein them in, Microsoft is pushing “Guardian Agents,” which she calls an established industry term. Their job, as she describes it, is to “watch and moderate every action of every agent, before it happens, 24/7.”
Gallot’s sentence about frontier models links to an October 10 essay posted on sn scratchpad, a personal blog that Microsoft and TechCrunch attribute to Satya Nadella, Microsoft’s chairman and CEO. The page shows no byline; its metadata and contact links point to him. The essay argues for treating frontier models, closed or open-weight, as insider risks: “we need to separate the supply of intelligence from the authority over it.” The most trustworthy system, it concludes, “will be the one that enables us to trust the model the least.”
Sixty agents on Defender’s radar
The second post, by Nadim Abdo, corporate vice president for identity and network access, says Microsoft is “expanding discovery to 35 additional types of local agents, bringing the total to 60.” The Defender for Endpoint support matrix on Microsoft Learn, updated October 9, lists 60 for Windows: Claude Code and Claude Desktop, Codex and ChatGPT Desktop, GitHub Copilot, Cursor, Gemini CLI, OpenClaw and OpenCode, whose maker disclosed a breach on October 17. The list also includes agents from Chinese companies: DeepSeek Harness, Kimi Code CLI from Moonshot AI, Qwen Code from Alibaba Cloud, QClaw from Tencent, Trae IDE from ByteDance and ZCode from Z.ai.
Discovery “is activity based,” according to Microsoft Learn: Defender lists an agent once it observes the agent’s activity on an onboarded device, and installing an agent does not by itself put it in the inventory. On macOS, discovery covers 51 agents and is still in preview.
Spotting an agent and stopping it are two separate capabilities. Runtime protection, in preview on Windows, covers 10 agents: six through the hooks their makers provide, including Claude Code and GitHub Copilot, and four through network traffic inspection, including OpenClaw and ChatGPT Desktop. The page notes that this support “doesn’t indicate that protection is enabled” on a device.
Permissions scoped to the task
Under a feature called Dynamic Permissions, Microsoft says, an agent should start with “no authority” rather than automatically inheriting all of its user’s access, and receive only what it needs for the approved task. An organization-wide policy sets the outer boundary, which includes keeping an agent from gaining authority its user does not have.
Each agent’s identity is handled by Entra Agent ID, which Microsoft says it is extending to local agents found by its sensors. “The employee retains the employee’s access. The agent receives its own identity, permissions and its own authority scoped to its current task and for the duration of the task only,” the post says.
A graduated response as risk rises
Another component, Dynamic Agent Risk, continuously assesses each agent’s risk using signals from identity, data, endpoints, cloud, network, runtime and the agent’s own activity. Microsoft says it is adding signals from the model itself, such as its chain of thought.
Dynamic Conditional Access extends Microsoft Entra Conditional Access to agents, with a response the post calls “graduated.” Policy can reduce permissions, preserve reads while blocking writes, or require “provable human approval before a consequential action proceeds.” “At the highest levels of risk,” it can isolate the runtime or stop the agent.
Microsoft frames all of this as an extension of Project Perception, the multi-agent security system it unveiled on July 27. The company is adding a team of Guardian Agents designed to investigate, then recommend or apply containment, within boundaries people set. “At Microsoft, we are already operating in a world of hundreds of thousands of agents,” says Terrell Cox, a Microsoft corporate vice president and deputy chief information security officer.
Dates, pricing and licensing are still unknown
Neither post says whether these features are in preview or already available. The security post points readers to Microsoft Ignite, the company’s conference, which runs November 17-20, 2026.
Access to Project Perception itself remains limited. The July 27 post said it would enter public preview on August 3. Microsoft Learn’s page for the product now describes a “Limited Public Preview,” open to “a small, invitation-only set of customers,” before broader availability. Gallot nonetheless writes that companies “can get started today” with Project Perception, whose product page mentions consumption-based pricing without publishing any rates.
For identity, Microsoft Learn says that extending Entra’s security features to agents requires Microsoft Agent 365, which is included in Microsoft 365 E7 or sold as an add-on to E5, A5 and Business Premium. It is not yet clear whether the new features will be sold the same way.
Surprising and self-serving, says TechCrunch
TechCrunch calls the move “both surprising and self-serving.” Surprising, because Microsoft has invested in OpenAI and Anthropic, OpenAI is one of its biggest cloud customers, and the company develops its own models. Self-serving, because Microsoft wants companies to buy their agent security tools from it rather than from Anthropic or OpenAI. TechCrunch still finds the logic sound: the software that monitors agents should be independent of the companies that supply them, just as auditors should be independent of the organizations they audit.
What it means
The first shift is in what Microsoft is saying. The company that sells Copilot and has invested in two of the leading AI labs now says publicly that no frontier model can be trusted, whatever its origin. The statement applies to frontier models in general and names neither OpenAI nor Anthropic; Gallot also rules out malice as the cause.
In practice, the only piece Microsoft Learn documents without a preview label is agent discovery on Windows in Defender for Endpoint, on onboarded devices. At a company that uses the product, the IT team can see Claude Code, Codex or Cursor show up in its inventory once their activity has been observed. Runtime protection is still in preview and covers only 10 agents. Task-scoped permissions, continuous risk assessment and the graduated response exist, for now, only as announcements, and Microsoft has published no data on how well its controls work.
The cases OpenAI and Anthropic published in October describe agents straying outside their task, the behavior Gallot attributes to frontier models. So far, she notes, most of the attention has gone to attackers who use powerful models, and less to the agents inside companies’ own walls. The hacker who turned AI agents loose on more than 1,200 websites, documented by NorForge on October 19, falls into the first group.
Microsoft has not yet given launch dates, pricing or licensing for the new features, or said whether Project Perception will open beyond invited customers. It is also unclear where model providers stand on access to chain-of-thought reasoning, which the essay attributed to Satya Nadella calls “a non-negotiable.”
Sources
- Securing the agentic insider, Official Microsoft Blog (Hayete Gallot), October 19, 2026
- Agents are your newest insiders. Security must move at their speed., Microsoft Security Blog (Nadim Abdo), October 19, 2026
- Microsoft Defender for Endpoint AI agent support matrix, Microsoft Learn, October 9, 2026
- What is Project Perception?, Microsoft Learn, accessed October 20, 2026
- Rethinking security for the age of AI, Official Microsoft Blog (Hayete Gallot), July 27, 2026
- What is Microsoft Entra Agent ID?, Microsoft Learn, accessed October 20, 2026
- Models as Insider Risks in the Super Intelligence Era, sn scratchpad, October 10, 2026
- Microsoft says AI agents are like insider threats as ‘frontier models can’t be trusted’, TechCrunch (Julie Bort), October 19, 2026
Header image: MACCUS chart, data from the Microsoft Defender for Endpoint AI agent support matrix (Microsoft Learn, October 9, 2026)
