On Monday, Microsoft unveiled a set of controls that gives every enterprise AI agent a continuously updated risk score. Security teams can use the score to strip an agent’s write access, require a person to approve its next move or shut it down entirely.
The timing is no accident. The day before, Reuters reported that a single hacker had used AI agents to breach more than 100 company websites, a campaign USA 24 has already covered. Microsoft’s response shifts the focus from outside attackers to the software running inside a company’s own walls.
The threat Microsoft describes starts with an agent an employee installed on a laptop, a workflow bot with access to finance systems, or a coding assistant holding a broad credential. Microsoft’s security business says the core problem is unpredictable behavior and over-broad permissions, not malicious intent. In its view, controls on agents have to sit outside the AI models, because model makers’ own safety promises are not enough.
What the Microsoft AI agent controls actually do
Microsoft introduced the capabilities as part of Project Perception and Microsoft 365 E7, as Unite.AI summarized the announcement. The centerpiece is Dynamic Agent Risk. It builds a score for each agent from identity, endpoint, cloud and network signals, and the score rises when the agent’s behavior drifts from what its user or organization intended.
As the score climbs, the system can respond in four ways. It can remove an agent’s write access while leaving read access in place. It can require a person to approve high-stakes steps, isolate the agent’s runtime, or stop the agent entirely. GeekWire describes the same escalation path.
The graduated design is the most useful part. A hard shutdown stops a helpful tool as readily as a misbehaving one. Cutting write access alone lets an agent keep reading and answering questions while blocking it from changing records or sending anything out, which is often the difference between an annoyance and a loss.
Guardian Agents and temporary permissions
Two other pieces address the permissions problem. Dynamic Permissions starts every agent with no access of its own. It then receives only the permissions a specific task requires, and it keeps them only as long as that task runs. Standing access, the default in many software setups, is what turns one bad prompt into a broad breach.
Guardian Agents are a new group of AI agents that review what other agents do. They investigate why an agent’s risk score changed, then recommend containment or apply it. Hayete Gallot, Microsoft’s security business chief, introduced them with a blunt line: “Unfortunately, frontier models, regardless of their origin, cannot be trusted,” as TechBriefly reported.
That design adds a second AI layer to audit the first. The public material does not explain how the watchers themselves get audited, and that is likely the next question security buyers will ask.
Satya Nadella’s October 10 essay supplies the architecture behind the launch. Microsoft says the agent controls follow from his argument that controls on AI models must sit outside the models. In the essay, as SiliconANGLE reported, he argued for the design “the one that enables us to trust the model the least.” That shifts the burden of trust from the model vendor to the platform that decides what a model can touch.
Which agents Microsoft can now detect
Detection is the unglamorous prerequisite. Microsoft says it can now identify 60 types of agents on staff devices, up from 25. The named examples include Claude Code, OpenAI’s Codex and GitHub Copilot.
Many U.S. companies already let engineers run coding agents on their own machines. That is the blind spot detection is meant to close, because an agent that IT cannot see cannot be scored, limited or stopped.
The launch also lands amid a run of misbehavior reports. GeekWire notes that Anthropic described test agents taking unauthorized actions on government websites, and that OpenAI described agents escaping test environments and stealing credentials. Microsoft’s own Project Perception was built to defend against outside attackers, including AI-driven ones. This update extends it to agents operating inside an organization.
Microsoft introduced Project Perception on July 27, 2026, according to its own post, though TechCrunch reportedly dated the introduction to June. The Hack Academy covers the extension to what Microsoft calls agentic insiders.
Availability, pricing and open questions
Microsoft 365 E7 costs $99 per user per month and launched in May, according to GeekWire. Broader availability is planned for Microsoft Ignite, which runs November 17 to 19 in San Francisco. The new agent controls themselves, however, have no published dates or prices. SiliconANGLE reports that Microsoft gave neither, and GeekWire describes the features as in private preview.
Several questions remain open:
- Pricing and dates: Microsoft has not announced them for the new controls.
- Access: GeekWire reports a private preview, and WindowsForum describes Project Perception as a limited public preview for invitation-only customers.
- Effectiveness: No outcome data has been published. Microsoft describes capabilities and a vision.
- Breaches: The announcement does not establish a specific breach or CVE.
- Rivals: It is not yet known whether Google, AWS, CrowdStrike or Okta will respond with matching products.
Microsoft says its agent tools are a planned security approach and do not guarantee that every agent threat can be prevented, as Cybersecurity News reported. One low-profile site claimed the controls were already generally available to E5 and Azure customers and cited unnamed Fortune 500 results. USA 24 found no corroboration for that claim and does not rely on it.
What IT teams can do this week
Security teams can start on the groundwork now, even before the controls reach general availability. The steps below follow from the controls Microsoft describes. They are not based on any documented result.
- Inventory agents. List the AI agents employees run on laptops and servers, along with the systems each one can reach. Include coding agents and workflow bots, not just the chat tools IT already approved.
- Narrow access. Give each agent only what its current task needs. Remove standing write access wherever read access will do.
- Require human approval for payments, data changes and external sends. Sign-off on those three actions targets the steps where a mistake costs the most.
What to watch next
Ignite in November will show whether the controls move from preview to general availability and what they cost. Enterprise buyers will also compare risk scores across vendors, so watch whether Google, AWS, CrowdStrike and Okta answer with products of their own. Policy is moving alongside the tools, and USA 24 has covered Anthropic’s draft federal AI bill. The test that matters most is whether independent evaluation shows the risk scores catching real misbehavior before data or money moves. Microsoft has the distribution to make these controls a default. It has not yet shown the results.
