Microsoft wants companies to stop assuming that the AI agents they deploy are on their side. On Monday, October 19, 2026, the company extended Project Perception, the agent-based security system it introduced in July, so that it can supervise agents operating inside an organization rather than only defend against attackers outside it. The centerpiece is a set of Guardian Agents, security agents that watch other agents, explain why their risk has changed and can recommend or apply containment.
The framing is blunt. In a post on the official Microsoft blog, Hayete Gallot, executive vice president of Microsoft Security, wrote that frontier models, whatever their origin, cannot be trusted. Her argument is not that models are malicious but that they are trained to hit goals, can reward-hack and do not follow organizational norms, while agents built on them often hold broad access to data and tools. Microsoft calls these agents agentic insiders. A companion post by Nadim Abdo, corporate vice president for identity and network access, builds the product case on a principle Microsoft chief executive Satya Nadella set out earlier this month: control over what an agent may do has to sit outside the model.
Most of the announcement is a layered set of controls. Microsoft says its discovery tools now recognize 35 more kinds of locally run agents, 60 in total, among them Claude Code, OpenAI Codex and GitHub Copilot, and can place them in a single registry shared with Microsoft Agent 365. Microsoft Entra Agent ID gains identity types for local agents and for agents found by security sensors, which lets policies apply to an agent that was never formally integrated. Agents can be run in sandboxes such as the Microsoft Execution Container, and a new Dynamic Permissions feature gives each agent its own authority, scoped to a task and limited in time, which cannot exceed what its human sponsor is allowed to do.
Two further features handle change during a task. Dynamic Agent Risk keeps a running assessment from identity, data, endpoint, network, cloud and runtime signals and from the agent's own behavior. Dynamic Conditional Access, an extension of Entra Conditional Access, turns a rise in risk into graduated responses: keeping read access while blocking writes, narrowing reachable resources or network paths, revoking time-bound access, demanding proof of human approval for a consequential step, or isolating and stopping the agent. Microsoft also says it will feed chain-of-thought and other model-level signals into the risk score, while keeping enforcement independent of the model.
Guardian Agents and new Playbooks sit on top. People set policy, approval limits and delegation rules, Playbooks describe the security outcome, and the Guardian Agents carry out the investigation and response. Microsoft says it already runs hundreds of thousands of agents internally and built the features from that experience.
The launch follows a growing number of publicly disclosed AI safety incidents and an essay Nadella published earlier this month arguing that models should be treated as insider risks. It is also commercially convenient. TechCrunch pointed out that Microsoft is an investor in both OpenAI and Anthropic, yet is now urging customers to buy agent oversight from their cloud and security vendor rather than from the model makers.
Microsoft's posts do not say which features are generally available, in preview or still planned, nor how they are priced, and they point readers to its Ignite conference for more. None of the claims about how well Guardian Agents detect or contain misbehaving agents has been tested independently, and the risk scoring based on chain of thought depends on model providers exposing that data.