Microsoft launches security tools that treat AI agents as insider threats
The company is launching Guardian Agents and expanded agent security in Microsoft 365 E7, based on a doctrine Satya Nadella laid out in a blog post nine days earlier. But everything is in private preview, and experts warn that monitoring agents with agents may compound the risk.
The news
On Monday, October 19, 2026, Microsoft announced new security tools that treat AI agents as potential insider threats. The features are part of Microsoft 365 E7 — the company's top-tier bundle of office software and AI tools — and of the Project Perception security system. That is according to GeekWire's Todd Bishop, in the most detailed coverage of the announcement (GeekWire).
The announcement comes nine days after chief executive Satya Nadella published a blog post on October 10 arguing that controls over AI models must come from outside — outside the models themselves. What GeekWire describes as a philosophical intervention has thus already become a product — with a price, a launch window and a sales pitch aimed squarely at the enterprise market.
The doctrine: trust the model as little as possible
The core of Nadella's argument, as quoted in the coverage, is that reliability should not reside in the model but in the system around it. "The most trustworthy superintelligent system will not be the one with the model we trust the most," Nadella wrote, according to GeekWire. "It will be the one that makes it possible to trust the model the least."
TechCrunch quotes a longer passage from the same post: "We simply cannot outsource accountability for what intelligence does on our behalf. A model provider's assurances do not release us from that responsibility. … In other words, we must separate the supply of intelligence from the authority over it" (TechCrunch).
The argument builds on a playbook security teams already know from human employees: give every actor a clear identity, restrict access, and log everything. Nadella believes, according to a rundown at TheStreet carried via MSN, that exactly the same approach should apply to the "digital workforce" — with independent audit logs and a kill switch that is easy to reach (MSN/TheStreet).
One caveat: none of the quotations have been verified in this material against the blog post itself. They all come via secondary reporting from GeekWire, TechCrunch and MSN/TheStreet.
How it works
Microsoft's mechanisms follow the insider-threat logic concretely:
Detection. The company is expanding its ability to find AI agents running on employees' machines, from 25 to 60 agent types. The list includes popular tools such as Anthropic's Claude Code, OpenAI's Codex and GitHub Copilot, GeekWire reports.
Continuous risk assessment. The system scores each agent's risk on an ongoing basis. When the risk level rises, the system can respond gradually: it can remove the agent's ability to make changes while it can still read data, require that a human approve a high-risk step, or shut the agent down entirely.
Identity with zero permissions. Each agent gets its own identity, separate from the user's. Nadim Abdo, Microsoft's vice president for identity and network access, explains to Dark Reading that the system "will ensure that the agent starts with no permissions at all, and only expands to the permissions it needs to complete the task the user asks of it" (Dark Reading).
The framework thus comprises three layers: identity, monitoring and intervention. Guardian Agents — the monitors — are part of Project Perception, which the three outlets place differently in time. GeekWire writes that the system launched in July, TechCrunch says June, and Dark Reading states that the first version reached public preview in August. The date is unsettled across the sources and is therefore kept separate, not smoothed over.
The company's framing — and the price
Hayete Gallot, Microsoft's corporate vice president for the security business, has put the premise bluntly. "Unfortunately, frontier models, regardless of their origin, cannot be trusted," she wrote, according to TechCrunch — not because they are malicious or easy to hack, but because they are unpredictable. In a short video tied to the announcement, she said, according to Dark Reading: "We're extending Perception so that we can secure the AI insider."
For enterprise customers, this becomes a paid product. Microsoft 365 E7 costs $99 per user per month, according to GeekWire. The features are currently in private preview, with broader availability planned for Microsoft's Ignite conference on November 17–19 in San Francisco. For security buyers, that provides a concrete decision path before this year's budget wrap-up.
The competition: Nvidia wants to go deeper into the stack
Microsoft is not alone. The company was one of the founding members of Nvidia's new Open Agent Safety Platform, which has support from more than 100 technology companies. The platform isolates agents in secure environments and can monitor and stop behavior through the hardware — which works roughly like a kill switch, TechCrunch reports. Where Microsoft operates at the identity and software level, Nvidia's approach goes deeper into the stack.
TechCrunch's Julie Bort also points to a duality in Microsoft's position: the move is both surprising and self-serving. Surprising because Microsoft is closely tied to both OpenAI and Anthropic through investments — and is publicly saying that models from exactly this kind of company cannot be trusted. Self-serving because the conclusion opens the way for selling security tools that are needed no matter which models customers use.
The criticism: the agent guarding the agent
The most obvious objection to the arrangement is that it solves an agent problem with more agents. Dark Reading writes, citing experts it does not name, that Guardian Agents are meant to monitor and fence in abnormal AI agents — but that policing unpredictable agents with other agents may amplify rather than contain the risk. The criticism thus stands on an anonymous basis in the public material, and it is worth keeping it at that level.
A larger and more fundamental caveat: none of this has been independently tested. All the features are in private preview, and every claim about how the system behaves — the risk scores, the downgrades, the shutdowns — is Microsoft's own statement, not documented results. How precise the detection of 60 agent types is in practice, how often the system wrongly locks out healthy agents, and how effectively the zero-permission setup works in large organizations, nobody outside Microsoft yet knows.
What to watch
Three things will determine whether this becomes a lasting category or a marketing wave. First, Ignite on November 17–19, where broader availability is planned. Second, whether independent security researchers get the chance to test the claims. Third, whether Microsoft clears up the confusion around Project Perception's launch timeline, which currently varies between June, July and August depending on which outlet you read.