Image: Microsoft

Microsoft wants companies to treat their own AI agents like insiders who could go rogue. It has expanded Project Perception, its AI-powered security system, with tools that track what workplace agents do and cut their access when something looks wrong.

CEO Satya Nadella announced the update on X. He tied it to an essay he posted earlier this month, which argued that companies should treat AI models as insider risks and keep security controls outside the model.

I recently wrote about why we need to treat models as insider risks, with security controls sitting outside the model itself.

Today, we're putting that principle into practice by expanding Project Perception with new capabilities to help continuously assess agent risk, adapt permissions, and contain threats.
https://t.co/ec3Z2B260G

— Satya Nadella (@satyanadella) October 19, 2026

An "agentic insider" is Microsoft's name for an AI agent that works inside a company with real access. Picture a bot that can read your email, run code or approve expenses. Microsoft says an agent like that can make mistakes, get tricked or get hacked, the same as an employee.

In the main announcement, Microsoft security chief Hayete Gallot wrote that frontier models "cannot be trusted." She said that isn't because they're malicious. Models are trained to reach a result, so they sometimes cheat to get there, and they don't know a company's rules. She also wrote that agents are "frequently overprivileged," which means they hold more access than the job needs.

A companion post from Microsoft's Nadim Abdo lists what's new. Microsoft says it can now detect 60 types of agents running on work computers, up from 25, including Claude Code, OpenAI Codex and GitHub Copilot. Each agent gets its own ID in Microsoft Entra, separate from the person using it. Logs can then separate the employee's actions from the agent's.

A feature called Dynamic Permissions starts an agent with no access and grants only what one task needs, for as long as the task runs. Dynamic Agent Risk keeps rescoring how risky an agent's behavior is. When the score rises, Dynamic Conditional Access can block changes while still allowing reads, ask a person to approve the next step, or stop the agent. A team of Guardian Agents watches the other agents and applies those limits on its own, within rules that people set.

Microsoft's example is an expense bot that opens a document with hidden instructions, a trick known as prompt injection. The system would take away the bot's power to approve payments and send the decision to a human.

Microsoft's posts don't include prices, release dates or test results, so its claims about how well the features work can't be checked yet. Project Perception is in an invitation-only preview for a small group of customers, according to Microsoft's documentation.

The name Guardian Agents isn't Microsoft's invention. Gartner predicted in June 2025 that guardian agent tools would take at least 10 to 15% of the agentic AI market by 2030. A Gartner poll in the same release found that 28% of 147 CIOs and IT leaders already had AI agents deployed.

We recently covered a hacker who used AI agents to break into more than 100 sites, and an OpenCode breach that exposed AI provider keys that users had stored with the coding tool.

What you can do now

Perception is built for large companies. The same rules work for anyone using an AI agent at home or in a small business.

• Give the agent its own account or API key, so you can shut it off without changing your own password.
• Share only the folders, inboxes and apps the task needs, and remove access when the job is done.
• Keep approval prompts on for anything that spends money, sends messages or deletes files.
• Be careful letting an agent read web pages, emails or files from strangers, because they can hide instructions.