Microsoft targets the ‘agentic insider’ with new controls for rogue AI agents

Microsoft Corp. on Oct. 19 introduced security controls aimed at what Microsoft Security executive vice president Hayete Gallot called the "agentic insider," cutting back what an AI agent may do as its assessed risk climbs. The controls include discovery tools that now spot 60 types of local agents on employee machines (up from 25, with Anthropic's Claude Code, OpenAI's Codex and GitHub Copilot among the additions), a continuously updated Dynamic Agent Risk score, Dynamic Conditional Access that can strip write access, hold high-impact actions for human approval or isolate and stop the runtime, and Dynamic Permissions that grant an agent only what a single task needs. Microsoft did not give availability dates or pricing for the controls, which it positions as part of Project Perception and Microsoft 365 E7, ahead of Microsoft Ignite opening Nov. 17.

Microsoft targets the ‘agentic insider’ with new controls for rogue AI agents Microsoft Corp. today introduced https://www.microsoft.com/en-us/security/blog/2026/10/19/agents-are-your-newest-insiders-security-must-move-at-their-speed/ security controls for rogue artificial intelligence agents that cut back what an agent may do as its assessed risk climbs. The release takes on what Hayete Gallot, executive vice president of Microsoft Security, called the “agentic insider” in a blog post https://blogs.microsoft.com/blog/2026/10/19/securing-the-agentic-insider/ . Enterprise agents are often overprivileged, and their numbers are growing fast. Gallot argued that frontier models cannot be fully trusted because they are built to chase results. Some will reach a goal in ways nobody intended, she wrote, including by colluding with other agents. Microsoft Chairman and Chief Executive Satya Nadella laid out the thinking behind the controls in an Oct. 10 essay https://snscratchpad.com/posts/models-as-insider-risks/ that urged companies to treat models as insider risks, with safeguards kept outside the model itself. The most trustworthy system, he wrote, will be “the one that enables us to trust the model the least.” The controls start with finding agents. Microsoft’s discovery tools can now spot 60 types of local agents on employee machines after 35 were added. The list includes Anthropic PBC’s Claude Code and OpenAI Group PBC’s Codex, as well as GitHub Copilot from Microsoft’s own GitHub unit. The company is also extending Microsoft Entra Agent ID to give those agents, and unknown ones its sensors find, identities of their own. Once found, each agent carries a continuously updated risk score under a feature Microsoft calls Dynamic Agent Risk. The score draws on signals from Microsoft’s identity, endpoint, cloud and network tools, and it climbs when an agent’s behavior drifts from what its user or organization intended. Microsoft has extended Microsoft Entra Conditional Access to agents, and the resulting Dynamic Conditional Access feature decides what happens as the score rises. An agent might first lose the ability to change anything while keeping read access. Higher-impact actions can be held for verified human approval, and at the top of the scale the runtime is isolated or stopped entirely. Access itself becomes temporary under Dynamic Permissions. An agent gets what a single task needs for as long as the job lasts, inside companywide limits that stop it from ever holding more authority than the person it works for. Microsoft Execution Container is one sandbox an agent can run inside. Because the monitoring sits outside the container, a compromised agent has no way to switch it off. Project Perception, which Microsoft introduced in July https://siliconangle.com/2026/07/27/microsofts-first-cybersecurity-model-powers-new-project-perception-agents/ as an agentic security system, gets new tools of its own. Playbooks added today let security staff set the outcome they want, and a new team of Guardian Agents carries out the work. A shift in an agent’s risk score sets the Guardian Agents investigating, and they can recommend containment or apply it on their own. People keep control of policy and approval rules. In her post, Gallot also wrote that future controls should explain why an agent acts, and getting there means seeing a model’s reasoning tokens. “Model transparency will not replace containment,” she added. Microsoft said it is bringing chain-of-thought and other model-level signals into Dynamic Agent Risk. Microsoft did not give availability dates or pricing for the new controls, which it is positioning as part of Project Perception and Microsoft 365 E7 https://siliconangle.com/2026/03/22/microsoft-outlines-agentic-ai-security-strategy-new-defender-entra-purview-capabilities/ . That suite bundles Agent 365 with Microsoft 365 Copilot. Microsoft Ignite opens Nov. 17, and the company is pointing customers there for more detail. Image: Microsoft A message from John Furrier, co-founder of SiliconANGLE: Support our mission to keep content open and free by engaging with theCUBE community. Join theCUBE’s Alumni Trust Network , where technology leaders connect, share intelligence and create opportunities. - 15M+ viewers of theCUBE videos , powering conversations across AI, cloud, cybersecurity and more - 11.4k+ theCUBE alumni — Connect with more than 11,400 tech and business leaders shaping the future through a unique trusted-based network Are you an AWS customer? Support SiliconANGLE financially by buying your AWS services from our Marketplace portal page and links: https://siliconangle.com/aws-marketplace/ https://siliconangle.com/aws-marketplace/ About SiliconANGLE Media SiliconANGLE https://cts.businesswire.com/ct/CT?id=smartlink&url=https%3A%2F%2Fsiliconangle.com%2F&esheet=54119777&newsitemid=20240910506833&lan=en-US&anchor=SiliconANGLE&index=9&md5=646b1b564e2259100a2b8638aab0a552 , theCUBE Network https://cts.businesswire.com/ct/CT?id=smartlink&url=https%3A%2F%2Fwww.thecube.net%2F&esheet=54119777&newsitemid=20240910506833&lan=en-US&anchor=theCUBE+Network&index=10&md5=7de2a85f95ab4a4a495cede20b8cb1da , theCUBE Research https://cts.businesswire.com/ct/CT?id=smartlink&url=https%3A%2F%2Fthecuberesearch.com%2F&esheet=54119777&newsitemid=20240910506833&lan=en-US&anchor=theCUBE+Research&index=11&md5=7bb33676722925eb57d588ec343e4f6f , CUBE365 https://cts.businesswire.com/ct/CT?id=smartlink&url=https%3A%2F%2Fwww.cube365.net%2F&esheet=54119777&newsitemid=20240910506833&lan=en-US&anchor=CUBE365&index=12&md5=d310fb35919714e66ad8d42c9c0c1bc6 , theCUBE AI https://cts.businesswire.com/ct/CT?id=smartlink&url=https%3A%2F%2Fwww.thecubeai.com%2F&esheet=54119777&newsitemid=20240910506833&lan=en-US&anchor=theCUBE+AI&index=13&md5=b8b98472f8071b23ebb10ab9a8dd0683 and theCUBE SuperStudios — with flagship locations in Silicon Valley and the New York Stock Exchange — SiliconANGLE Media operates at the intersection of media, technology and AI. Founded by tech visionaries John Furrier and Dave Vellante, SiliconANGLE Media has built a dynamic ecosystem of industry-leading digital media brands that reach 15+ million elite tech professionals. Our new proprietary theCUBE AI Video Cloud is breaking ground in audience interaction, leveraging theCUBEai.com neural network to help technology companies make data-driven decisions and stay at the forefront of industry conversations.