Microsoft has rolled out new security controls aimed at artificial intelligence agents running inside companies' own systems, according to a company blog post and a report by SiliconANGLE. The controls cut back what an agent is allowed to do as its assessed risk rises.

Hayete Gallot, Microsoft's executive vice president of security, wrote that frontier models cannot be fully trusted, because they are trained to chase a result rather than to follow an organization's norms. She said these agents are unpredictable: they can act in ways nobody intended, and may even collude with other agents to reach a goal without being compromised first.

The insider a company deployed itself

According to Microsoft, enterprise agents are often overprivileged, with broad access to data, tools and systems, and their numbers are growing fast. The company calls this an agentic insider: software a business put to work that can end up behaving like a threat from within.

The move lands as more companies put AI agents such as Claude Code, Codex and GitHub Copilot to work on everyday tasks with access to internal systems, and as security teams look for ways to supervise agents that can act on their own, according to Microsoft.

Microsoft's answer, the company says, is Guardian Agents, a term it describes as already used across the industry: agents that watch and can contain every action of every other agent before it happens, around the clock. That monitoring sits inside Project Perception, the security system Microsoft introduced in July, according to the company.

Securing agents, Microsoft said in its original post, requires protection across several layers at once: identity, permissions, data, endpoints, network, cloud and runtime. The company argues that security teams can already observe what an agent does, but need tools that help them understand why it acted a certain way, and whether that action matched the intent of the task it was given.

A continuous risk score

SiliconANGLE lays out how the monitoring works. Microsoft's discovery tools can now spot 60 types of local agents running on employee machines, 35 more than before, including Anthropic's Claude Code, OpenAI's Codex and Microsoft's own GitHub Copilot. Each agent found gets its own identity inside Microsoft Entra Agent ID.

From there, per SiliconANGLE, every agent carries a continuously updated risk score called Dynamic Agent Risk, which climbs when its behavior drifts from what the user or the organization intended. A higher score triggers Dynamic Conditional Access: the agent can first lose the ability to change anything while keeping read access, higher-impact actions can be held for human approval, and at the top of the scale its runtime is isolated or stopped entirely.

SiliconANGLE also describes Dynamic Permissions, which limits an agent's access to what a single task needs, inside companywide limits that keep it from ever holding more authority than the person it works for. Microsoft Execution Container is one sandbox an agent can run inside; because the monitoring sits outside the container, the report says a compromised agent has no way to switch it off.

In practice

  • Who can use it: Microsoft customers running Project Perception as part of Microsoft 365 E7, which bundles Agent 365 with Microsoft 365 Copilot, according to Microsoft.
  • Since when: Microsoft did not give an availability date or pricing for the new controls; the company said more details are coming at Microsoft Ignite, which opens November 17, per SiliconANGLE.
  • What changes: oversight of internal agents used to be more limited; now a continuous risk score can automatically restrict or isolate an agent without waiting for a breach.
  • Who is affected: companies already running agents such as Claude Code, Codex or GitHub Copilot internally, which the new tools are now built to detect and monitor, according to SiliconANGLE.

Gallot also wrote that future controls should explain not just what an agent did but why, which requires visibility into a model's reasoning tokens rather than only its inputs and outputs. Model transparency, she said, will not replace containment, but should make it more precise.