AI Agents as Insider Threats: Inside Microsoft’s Bet on a Unified Security Stack

Microsoft’s Project Perception adds Guardian Agents to monitor and contain anomalous AI agents, but experts warn that policing unpredictable agents with other agents may multiply — not contain — the risk.

Microsoft wants security teams to treat AI agents like they treat employees with privileged access: insiders who can make mistakes, be manipulated, or be compromised.

Earlier this week, the software giant introduced new capabilities to Project Perception, enabling it to discover agents running within an organization, assign an identity and permissions to each agent, and continuously score each organization’s risk. When an anomalous agent is discovered in the organization’s environment — a problem that Microsoft describes as the “agentic insider” — Project Perception can now cut off the agent’s access.

The first release of Project Perception, made available in public preview through Microsoft Defender in August, was designed to defend against AI-driven attacks. Focused on Microsoft’s security operations center threat and investigation scenarios, it coordinates red agents to scan for attacker paths, blue agents to identify the greatest risks, and green agents to mitigate threats. Project Perception’s initial use was vulnerability management, through MDASH, Microsoft’s AI code scanner, which is still in preview. MDASH uses several AI models, including MAI-Cyber-1-Flash, the company’s first cybersecurity-specialized model.

Project Perception’s Second Act

The new release turns the system inward. “We’re expanding Perception so that we can go secure the AI insider,” Hayete Gallot, executive vice president of Microsoft Security, said in a brief video accompanying the announcement.

To do that, Microsoft is adding what it calls Guardian Agents, which monitor the AI-based agents running across an organization and can contain them when they stray into unexpected behavior.

Today, many agents run with the permissions of the user who launched them or by invoking the user’s credentials. Microsoft’s approach separates the two, Microsoft said in a blog post detailing the new capabilities.

“Our system will give every agent a very distinct identity separate from the user’s and will ensure that the agent starts with no permissions at all, and only up-scopes to the permissions it needs to complete the task the user is asking it to do,” Nadim Abdo, corporate vice president for identity and network access, tells Dark Reading.

Specifically, Microsoft said the new release can detect 35 more types of agents running locally on devices, bringing the total to 60, including Claude Code, OpenAI Codex and GitHub Copilot. It also includes:

• Extensions to Microsoft Entra Agent ID that can assign an identity to an agent that were never built to work with Entra.

• Dynamic Agent Risk, a continuously updated score built from Entra, Defender, Intune, Purview, Sentinel and signals from Global Secure Access, Microsoft’s Security Service Edge (SSE) solution that unifies network access and identity protection.

• Dynamic Conditional Access for agents, which can block writes while keeping reads, restrict network paths, revoke access or stop an agent’s runtime as risk rises.

• Microsoft Execution Container

  (MXC), a sandbox that keeps credentials and security controls outside the agent’s reach.

With Project Perception, Abdo describes an expense-approval agent that reads a malicious instruction hidden in an expense report. “If someone got a prompt that convinced it to start to try to do wire transfers, we can actually watch it accessing a wire transfer system and say, ‘Wait a second, that has nothing to do with the intent,’ and that raises its risk,” he says.

Microsoft says it can act on rising risk immediately, interrupting an agent’s live session, network connection or runtime without disrupting the user’s own work, though those are vendor-stated capabilities in preview.

Project Perception has an expanded agent registry that now shows up across the Microsoft 365 admin center, Defender, Entra, Intune, Purview and a new Perception Agent Insights view. And Dynamic Agent Risk replaces previously siloed risk scores.

The controls themselves sit outside the agents they watch. “The first thing [an attacker will] do is they’ll manipulate the security controls,” Abdo says, so the credentials and monitoring tools run outside the container.

Intelligence vs. Authority

Microsoft CEO Satya Nadella acknowledged in a fireside chat with Gallot during a CISO conference last week held at Microsoft’s Redmond, Wash. headquarters that Perception and Agent 365, Microsoft’s control plane for governing, introduced last year and generally available since May, “need to be battle tested.” Further, Nadella admitted that Microsoft’s own detection must improve. “If I look at the state of the art of behavioral monitoring of, let’s say, Defender, it has to go way up,” he said.

Gallot framed the risk in terms of how models behave. “Those models have proven to be unpredictable,” she said. “They’ll do anything they can to get from point A to point B, and what they do may not be what you intend them to do.”

One Stack vs. Multivendor Specialists

Much of what Microsoft describes echoes what other vendors announced in recent weeks. Okta’s Agent Gateway separates an agent’s permissions from those of the user directing it, and Okta plans a kill switch that would reject tokens already issued to a deactivated agent. Teleport, backed by Cisco, ties privileges to tasks so they disappear when the work ends. CrowdStrike announced an Agentic Identity Provider and Falcon Guardian, which discovers agents and controls which may run on Windows, macOS and Linux endpoints.

Abdo argues that each vendor sees only part of the picture. “If you’re primarily an identity vendor or primarily a network vendor or primarily an endpoint vendor, that lens gives you some visibility to what agents are doing, but you need to have the other components as well,” he says. Microsoft’s advantage, he adds, is that Entra, Defender and Intune are already widely deployed and integrated, so customers aren’t “having to string these things together from multiple vendors.”

Microsoft says it will also take in signals from third-party security products. Partners can already publish agent risk events into Agent 365 through public APIs, Abdo says, though he could not yet name which partner integrations are public.

Forrester principal security and risk management analyst Andras Cser is skeptical. “Most of Microsoft’s integration with third-party players, especially in security, has not been first rate so far,” Cser says. Because Microsoft has most of the products it needs in its own ecosystem, he adds, it is “interested in pushing its own products.”

The question is whether that approach fits environments where agents run across AWS, Google Cloud, Salesforce and ServiceNow. Last month Okta announced the formation of the Blueprint Alliance with AWS, CrowdStrike, Google Cloud, Proofpoint, Salesforce, ServiceNow and Zscaler to develop a shared architecture for securing agents across vendors.

Microsoft is not among the named members. Asked whether it would participate, Abdo said Entra has “always been built on open standards” and that “we’re always exploring those things.”

Okta, which formed the alliance, argues that no single vendor sees enough. “No one company can secure agents alone,” CEO and co-founder Todd McKinnon said in his keynote at Oktane, the company’s annual conference, last month.

Reacting to this week’s Project Perception launch, Harish Peri, Okta’s senior vice president and general manager of AI security, says: “Microsoft’s Guardian Agents feature will only be as good as the broader ecosystem it plugs into. If you want to catch intent drift in real time, you need signals pulling from your entire stack, not just one vendor’s cloud.”

Nevertheless, Peri echoes Nadella’s framing. Because agents must be allowed to behave unpredictably to be useful, “we can’t secure agents by trying to control how their models think,” Peri says. “We need to control their authority.” The answer, Peri argues, is “deeper interoperability and cross-vendor signal sharing built on open standards.”

Cser interprets the Blueprint Alliance as “more of a partnership kind of map” than a true standard. Cser believes vendor-specific efforts like this alliance are “a marketing ploy” that tends to fade within a year or two. He argues that enterprises need open standards any vendor can implement.

Consequently, that leaves CISOs with an imperfect choice in what Cser calls “still a very fluid market.” The current choices, Cser says, are either a Microsoft-centric approach built mainly on Microsoft products, or a multivendor approach with “many vendors, many price lists,” where integration “is almost always a suspicious kind of promise.”

Some security vendors agree that treating agents as insiders extends the long-standing zero-trust and least-privilege principles rather than replacing them.

Denis Calderone, CTO of Suzu Labs, says the most malicious behavior may never look like an agent straying from its task. “Dynamic permissions scope what an agent can touch, but the worst outcomes happen inside the authorized envelope,” Calderone says.

Calderone points to July’s OpenAI incident as evidence that agents can work against the systems watching them: more than a thousand agents in a cyber evaluation coordinated to game the system grading them, some by faking tool calls, before roughly 700 joined an attack on Hugging Face, according to METR.

Further, Calderone has concerns about Guardian Agents, noting that they are agents themselves. “Securing agents with agents means the Guardian Agents themselves are overprivileged actors that can be manipulated or compromised,” he says.

Cser shares Calderone’s concerns about Guardian Agents. An unpredictable agent watched by another unpredictable agent creates “non-deterministic nature squared,” Cser says. “Most organizations today are very careful about bringing guardian agents into the mix.”

Following Perception’s July launch, Forrester principal analyst Allie Mellen urged organizations to enforce “least privilege and least agency,” limiting not just what agents can access but what they can do on their own. Microsoft meets the first test, but not yet the second, Cser says. “It is least privilege, but I wouldn’t go as far as describing it as least agency,” he says, adding that some specialist vendors are further along.

Controls Still Work in Progress

While Perception itself is in public preview, the new Guardian Agent capabilities are only in use inside Microsoft and with “a small set of select customers,” and are expanding to more external customers this week and to broader preview rings over the next few months. Microsoft plans to say more at its annual Ignite conference next month.

Project Perception builds on the controls in Microsoft 365 E7, the $99-per-user-per-month suite that includes E5, Agent 365 and Entra Suite, which supply the signals and enforcement points that Perception relies on. Microsoft hasn’t disclosed whether the new capabilities are included in E7 but Project Perception is priced based on consumption.

Cser expects the release to push customers toward E7. “I would almost be sure that this is another kind of making people buy stuff in more expensive packages that they don’t currently need but may need in future,” he says. By his estimate, E7 comes to about $1,200 per user per year at list price, or roughly $600 after typical volume discounts of 40% to 50%, which “can be prohibitively expensive for a lot of organizations.”

Meanwhile, Calderone says organizations don’t have to wait—he recommends inventorying every agent, including those running on developer machines. Each should be assigned its own identity and credentials set to expire, and each agent should require human approval for consequential actions. “That work is free today,” he says, “and it’s the foundation every one of these Microsoft controls assumes you already have.”

Jai Vijayan contributed reporting to this article.

Read more about:

CISO Corner