Microsoft announced on 2026-10-19 that it is extending Project Perception to govern AI agents as potential insiders: discovering local agents such as Claude Code, OpenAI Codex and GitHub Copilot, letting discovered agents receive their own Entra identity, scoping permissions to a task and its duration, and pairing a continuously updated agent risk assessment with conditional access that can narrow access, require human approval, or isolate and stop an agent. Microsoft frames the design around keeping security controls outside the model, so that a manipulated or compromised agent cannot bypass them. The post is a product announcement and gives no availability dates or measurements of effectiveness.
A major security vendor builds its agent-security products on the premise that the model cannot be its own security boundary; the post offers no evidence of how well these controls work in deployment.
Key facts
As stated in the sources, with where to find them.
- Microsoft says agents can bring insider risk because of the access they are granted: they are not inherently malicious, but can make mistakes, be manipulated or be compromised, and can operate continuously at machine speed. It cites Satya Nadella’s principle that the controls over what a model can access, what it can do and whether it keeps running must sit outside the model, where it cannot bypass or tamper with them.Introduction
- Microsoft says it is extending Project Perception, which it had introduced for defending with agents, to secure agents themselves, sharing signals and a unified agent registry with Microsoft Agent 365. It describes four continuous responsibilities: know which agents exist and who owns them, contain what each can do before it acts, protect what is in its path, and adapt protection as risk changes.Project Perception—Securing your agentic insider
- Microsoft says it is expanding discovery by 35 local agent types to 60 in total, naming Claude Code, OpenAI Codex and GitHub Copilot, and extending Microsoft Entra Agent ID so local and previously unknown agents found by its sensors can receive an identity separate from the person using them.Know every agent and give it an accountable identity
- For containment, Microsoft describes running the model and harness in a sandbox such as Microsoft Execution Container (MXC), mediating the agent’s calls to tools, APIs, MCP servers and other agents, and inspecting the provenance and sensitivity of content flowing in and out. It introduces Dynamic Permissions: organization-wide policy prevents an agent gaining authority its user lacks, permissions are scoped to the task and time-bound, and higher-impact actions can require verified human approval.Contain what the agent can do before it acts
- Microsoft introduces Dynamic Agent Risk, a continuously updated assessment drawing on identity, data, endpoint, cloud, network, runtime and agent-activity signals, and Dynamic Conditional Access, which can respond in steps: preserving reads while blocking writes, narrowing reachable resources and network paths, revoking time-bound access, requiring provable human approval, or isolating and stopping the agent. Its worked example is an expense-approval agent that meets a prompt injection in an external document.Adapt protection as agent risk changes
- Microsoft introduces Playbooks and Guardian Agents in Project Perception to investigate risk changes and recommend or apply containment, with people setting policy and approval boundaries. Terrell Cox, a Microsoft deputy CISO, says Microsoft is already operating in a world of hundreds of thousands of agents.Secure agentic systems at scale with Guardian Agents
- Microsoft says it will bring chain-of-thought and other model-level signals into Dynamic Agent Risk to detect intent drift and the influence of untrusted information, while keeping enforcement independent of the model.Extending containment to the model
- The post is a product announcement. It gives no availability dates, pricing, or measurements of detection or containment effectiveness; all capability statements are Microsoft’s own.Whole post
Findings that cite this record
Key questions this bears on
- Can prompt injection against AI agents be reliably defended?Not reliably. Bounding what untrusted input can trigger helps, but trust boundaries must survive delegation and tool execution.
- Can AI agents defend and oversee systems on their own?Not reliably. Some designs improve benchmark triage, but autonomous defense and oversight lack broad operational validation.