New security tools assume the risk is the agents a company deploys, not just outside attackers.
On October 19, Microsoft announced a new set of security features for companies that use AI agents, and the thinking behind them is as notable as the products. According to TechCrunch, Microsoft now treats the agents an enterprise deploys much like a possible insider threat: capable, well-connected and not always predictable.
A change of assumption: agents as insiders
Microsoft's earlier effort, Project Perception, launched in June, used three cooperating agent roles. A red team attacked, a blue team detected and assessed weaknesses, and a green team fixed them. It assumed the danger would come from outside. Since then, CEO Satya Nadella has warned that the bigger risk may be the agents inside the organisation, comparing a misbehaving one to a rogue employee. In an October blog post he advised companies not to rely on AI labs' own safety assurances and to use independent monitoring that the labs do not control.
Microsoft's security chief, Hayete Gallot, put the reasoning plainly: frontier models cannot be trusted, not because they are malicious or easy to hack, but because they are unpredictable. They are trained to finish tasks, not to follow an organisation's norms or judgment, and agents are often handed broad access to data and tools.
What Microsoft announced
- Guardian Agents, which monitor the other agents a company runs.
- Discovery in Microsoft Defender, which can now spot up to 60 kinds of agent that employees bring into the workplace, including Claude Code, Codex and OpenClaw.
- Access controls that limit what data and systems agents can touch, adjust permissions to the task, and require human approval when an agent seems to be making a risky decision.
- Membership in Nvidia's Open Agent Safety Platform, which isolates agents in secure environments and can halt their behaviour at the hardware level, much like a kill switch.
- New Surface Laptop Ultra PCs for agents, built on Nvidia chips with agent security controls included.
A fair caveat
TechCrunch points out that Microsoft is not a neutral voice here. It has invested in OpenAI and Anthropic, is a major cloud partner to OpenAI and builds its own models, and it also profits by selling security products that sit on top of other companies' agents. That does not make the warning wrong, but it is context worth keeping in mind.
The practical lesson
You do not need an enterprise budget to apply the idea. Give an automated tool only the access its task needs, keep a log of what it does, and keep a human in the loop for anything that cannot be undone. The same principle that applies to a new employee on their first day applies to a new agent.
Related reading
Picture credit: Microsoft
