Microsoft Defender to Detect 60 AI Agent Types — Including Its Rivals'

Microsoft Defender to Detect 60 AI Agent Types — Including Its Rivals'

The company is expanding its Project Perception security program to cover the agents enterprises themselves deploy — with zero authority as the starting point, task-based permissions, and detection of 60 agent types, including rivals' coding agents. The message is explicit: frontier models cannot be trusted, no matter who built them.

What happened on October 19

On Monday, October 19, 2026, Microsoft announced a major expansion of Project Perception, the company's security system for AI agents. The program, launched in 2026 to defend against outside AI attacks, is now being aimed at a new threat category: the agents the enterprises themselves have put into production. The sources disagree on exactly when the program was originally introduced — TechCrunch writes June, while TipRanks gives July 2026. This conflict cannot be resolved from the available coverage.

In a blog post, Microsoft describes the agents as "agentic insiders." Quoted via TipRanks: "Agents have been unleashed in the enterprise, at scale, and their numbers are growing rapidly. These agents are often overprivileged, with access to data, tools and systems, and can take actions and make decisions in critical processes. They have become active participants in the enterprise. They are agentic insiders."

The announcement came in a blog post written by Nadim Abdo, Microsoft's corporate vice president for identity and network access, according to Times of India/MSN. According to the coverage, it is followed by posts from other executives, including Hayete Gallot, who leads Microsoft's security business, and CEO Satya Nadella.

How the controls work

The most detailed walkthrough — Abdo's post as reported by Times of India/MSN — describes an identity-based control package. The core is Dynamic Permissions: agents start with no authority and receive only what an approved task needs, and only for as long as it is needed. An organization-wide policy sets the outer limit, and higher-impact actions can require verified human approval.

Around this core, according to the same source, sits a set of named components: Dynamic Agent Risk, Dynamic Conditional Access, Guardian Agents, an expansion of Entra Agent ID, and a sandboxed execution environment for agent operations. The sources do not specify in detail how each of these components is enforced in practice.

The pattern is classic zero trust, transferred from human users to software actors: no standing rights, everything scoped to the task, the human in the loop for the most dangerous actions.

Detection of up to 60 agent types

The most concrete component is the scaling of agent detection in Microsoft Defender. According to Times of India/MSN, 35 new types of local agents are being added, bringing the total to 60 — among them Claude Code, OpenAI Codex and GitHub Copilot. TechCrunch also mentions OpenClaw in its list of detectable agents. A complete catalog of all 60 types cannot be verified from the available sources, which name only a few examples.

This addresses a concrete everyday problem TechCrunch points to: agents that employees bring into the workplace, including local coding agents.

The executive argument: untrustworthy, not malicious

The most striking part of the announcement is how far Microsoft goes in distrusting its own suppliers. Hayete Gallot writes, according to TechCrunch: "Unfortunately, frontier models, regardless of origin, cannot be trusted." The reason is not that the models are malicious or easy to hack, but that they are unpredictable.

Satya Nadella set out, in a post on his personal blog quoted by TechCrunch, a principle of separating intelligence from authority: "We simply cannot outsource the responsibility for what intelligence does on our behalf. A model vendor's assurances do not relieve us of that responsibility. … In other words: we must separate access to intelligence from authority over it."

According to the Times of India/MSN syndication, Nadella summarized it this way: "The most trusted agentic system will not be the one with the model we trust the most. It will be the one designed so that we can trust the model the least."

Microsoft's own practice is used as the reference point. Terrell Cox, corporate vice president and deputy CISO for customer security, said, according to the same source, that the company is already running with hundreds of thousands of agents in its own operations as "Customer Zero."

Microsoft emphasizes in the blog post, as reproduced by TipRanks, that "this is not because models are inherently malicious." The framing is unpredictability and overprivileged agents, not evil agents.

Context and a strategic tension

The announcement is part of a broader norm-building effort: Microsoft was, according to TechCrunch, an inaugural member of Nvidia's new Open Agent Safety Platform, which has support from more than 100 other technology companies.

There is also an analytical observation here that the sources themselves do not draw out: Microsoft is positioning itself as the referee over the agents of OpenAI and Anthropic — companies Microsoft has invested in and, in OpenAI's case, works closely with. Gallot's phrase "regardless of origin" implicitly includes the partners' models. It is hard to read it as anything other than Microsoft wanting to own the security layer between enterprises and the agent ecosystem, including agents supplied by the companies' own vendors and competitors. That gives Microsoft a role with real power over who gets to act inside enterprise systems.

Caveats and open questions

Everything in this story rests on secondary coverage — TechCrunch, TipRanks and Times of India/MSN — of Microsoft's blog posts; the posts themselves are not part of the source material, and the quotes are reproduced through the media outlets.

How the controls are enforced in practice, what they will cost, when they become generally available, and how customers receive them are not disclosed in the coverage. And while the framework implies risk, no documented incidents of agents acting without authorization are known from this source material — nor should any be claimed.

The unresolved question that weighs most heavily, however, is a different one: whether zero trust toward software actors actually works as a governance model when those actors act autonomously and unpredictably. Microsoft's answer is that the unpredictability is the very reason for the controls. How well they hold up in practice is a question no source can answer yet.