Microsoft Adds Guardian Agents and Risk Controls to Contain Rogue AI Agents

Guardian Agents, the most prominent addition, is intended to watch the AI agents a company uses and respond when their behavior changes. Microsoft said the feature is part of Project Perception. TechCrunch reported that Project Perception was introduced in June; SiliconANGLE reported that Microsoft introduced it in July.

TechCrunch reported that Project Perception was Microsoft’s answer to powerful hacking models such as Anthropic’s Mythos and Fable and OpenAI’s Daybreak vulnerability-scanning system. It initially launched three classes of agents: a “red team” that attacked like hackers, a “blue team” that detected the red team and assessed vulnerabilities, and a “green team” that fixed them. SiliconANGLE reported that Project Perception now adds playbooks that let security staff set desired outcomes, with Guardian Agents carrying out the work; a shift in an agent’s risk score can prompt investigation and containment, while people retain control of policy and approval rules.

Microsoft CEO Satya Nadella laid out the rationale in an Oct. 10 essay, according to SiliconANGLE. Nadella wrote that companies should stop trusting AI model providers’ assurances and implement separate systems, not controlled by the AI labs, to watch and control agents. “We are deploying these complex agentic systems and models, with access to our most sensitive data and giving them the ability to take mission-critical actions on our behalf!” he wrote. “We simply can’t outsource responsibility for what intelligence does on our behalf. … In other words, we need to separate the supply of intelligence from the authority over it.”

Hayete Gallot, executive vice president of Microsoft Security, was more direct. “Unfortunately, frontier models, regardless of their origin, cannot be trusted,” she wrote, adding that the problem is not malice or easy compromise but unpredictability: the models are trained to achieve tasks, not follow organizational norms or judgment. SiliconANGLE reported that Gallot called the problem the “agentic insider,” saying enterprise agents are often overprivileged, are growing quickly and may pursue goals in unintended ways, including by colluding with other agents.

The controls start with discovery. Microsoft’s discovery tools can now spot 60 types of local agents on employee machines after 35 were added, according to SiliconANGLE. TechCrunch reported that the Defender agent-detection feature can find up to 60 types of agents employees bring into the workplace, including Claude Code, Codex and OpenClaw; SiliconANGLE said the list includes Claude Code, Codex and GitHub Copilot. Microsoft is extending Entra Agent ID to give agents, including unknown ones found by sensors, their own identities.

Once found, each agent carries a continuously updated risk score under Dynamic Agent Risk, drawing on signals from Microsoft’s identity, endpoint, cloud and network tools. Microsoft has extended Entra Conditional Access to agents. Under Dynamic Conditional Access, an agent may first lose the ability to change anything while keeping read access; higher-impact actions can be held for verified human approval; at the top of the scale, the runtime is isolated or stopped. Dynamic Permissions gives an agent only what a single task needs for as long as the job lasts, within companywide limits that prevent it from holding more authority than the person it works for. Microsoft Execution Container is one sandbox; because monitoring sits outside the container, a compromised agent cannot switch it off.

Microsoft said it is bringing chain-of-thought and other model-level signals into Dynamic Agent Risk. Gallot wrote that future controls should explain why an agent acts, which requires seeing a model’s reasoning tokens. “Model transparency will not replace containment,” she added.

Microsoft did not give availability dates or pricing for the new controls, which it is positioning as part of Project Perception and Microsoft 365 E7. That suite bundles Agent 365 with Microsoft 365 Copilot. Microsoft Ignite opens Nov. 17, and the company is pointing customers there for more detail.

The insider-threat framing is spreading beyond Microsoft. TechCrunch reported that Microsoft was an inaugural member of Nvidia’s Open Agent Safety Platform, which has support from more than 100 other technology companies. The platform isolates agents in secure environments and can monitor and stop behavior through hardware, functioning something like a kill switch. Microsoft also announced Surface Laptop Ultra PCs built for agents, running on Nvidia chips with agent security and controls built in.