Microsoft’s new agent security assumes your AI agents may turn on you

Microsoft says AI agents inside a company should be handled like insiders who might fail or be compromised. In a security blog post dated October 19, the company extends its Project Perception system with Guardian Agents and a continuously updated risk score for each agent. The announcement was picked up by Techmeme from GeekWire.

The post, written by Nadim Abdo, corporate vice president for identity and network access, gives no release dates, regions or prices for any of the new pieces.

Agents start with zero access and earn it per task

Microsoft describes several linked controls. Dynamic Permissions sets an organization-wide outer boundary, then grants each agent permissions that are scoped to a task and limited in time. Higher-impact actions can require verified human approval.

Dynamic Agent Risk merges signals from identity, data, endpoints, cloud, network, runtime and agent activity into one assessment. The post stresses that it is not a score assigned once at onboarding. The diagram shows inputs from Microsoft Sentinel, Entra, Intune, Purview, Global Secure Access and Defender.

Dynamic Conditional Access carries Entra Conditional Access over to agents. Responses are graduated: reduce permissions, isolate the runtime, or stop execution. The post also says model-level evidence, including chain-of-thought signals, will feed the risk assessment to detect intent drift and untrusted influence on an agent’s reasoning.

Other pieces include:

• New Playbooks, which define the security outcome a team wants, while Guardian Agents carry out protective work inside limits set by people.
• The Microsoft Execution Container (MXC), a sandbox that applies policy-controlled resource access and an enforcement boundary the agent cannot reach.
• New Entra Agent ID identity types for local agents and previously unknown agents found by security sensors.
• Agent discovery for 35 more local agent types, bringing the total to 60, including Claude Code, OpenAI Codex and GitHub Copilot.

Project Perception and Microsoft Agent 365 share signals, context and a registry of agents, so IT and security teams see one view. Perception was first introduced in July 2026 with teams of red, blue and green agents aimed at outside AI-driven attacks, according to Unite.AI. The October update points the same approach at agents running inside the enterprise.

A design built on distrust of the model

The post leans on a remark from CEO Satya Nadella: the most trustworthy agentic system will be the one designed so people can “trust the model least.” Microsoft’s stated principle is to wrap unpredictable AI in fixed controls, independent evidence and containment. In practice, an agent’s own claims about what it is doing are not enough; the controls watch the surrounding systems.

Terrell Cox, Microsoft’s deputy CISO, is quoted saying agents will be adopted at scale only if they can be trusted at scale. Unite.AI reports he also said Microsoft runs “hundreds of thousands of agents” internally as its own first customer.

What it could cost, and what is still unclear

The Microsoft post never mentions Microsoft 365 E7, although Techmeme’s headline links the tools to it. E7, the Frontier Suite, has been generally available since May 1, 2026 at $99 per user per month, and bundles Microsoft 365 Copilot, Agent 365, Entra Suite and Microsoft 365 E5, according to Unite.AI. The same report puts Agent 365, which became generally available the same day, at $15 per user per month on its own.

That matters for budgeting. If the new Perception features are tied to E7 or Agent 365, as the Techmeme headline suggests, customers already paying for the bundle may get them without a new line item. Those buying components separately could face a larger bill. Microsoft’s post says nothing on this, so any such conclusion is unconfirmed.

Several things remain open:

• Which features are generally available, in preview or only planned. The company points readers to Microsoft Ignite, running November 17 to 20, 2026, but does not say the details will arrive there.
• How well the risk scoring performs. The claims come from Microsoft itself, and the sources read here include no independent testing or false-positive rates.
• How much of the coverage reaches third-party agents. Discovery of 60 local agent types is a start, but the post does not say what controls apply beyond discovery for tools such as Claude Code or Codex.

For security teams, the practical change is a shift from reviewing an agent once at deployment to tracking it continuously and cutting its access when behavior drifts. Whether that works at scale will depend on details Microsoft has yet to publish.