Microsoft Project Perception Treats AI Agents as Insider Threats

Microsoft's security team has a new warning for enterprises deploying AI agents: the risk may already be inside the network, operating under an employee's name. On October 19, the company published "Agents are your newest insiders," an extension of Microsoft Project Perception that shifts the security spotlight from outside attackers to the agents companies deploy themselves, according to reports on the announcement.

The move reframes how agent security works. Instead of asking whether an agent is malicious, Microsoft Project Perception starts from the premise that any agent with broad access is an insider risk — it can be manipulated by hidden instructions, make mistakes, or get compromised, all while running at machine speed. The answer offered by Microsoft Project Perception is supervision that adapts as the agent behaves.

What Microsoft Project Perception Now Does

The October update layers several new controls onto the Project Perception architecture, which Microsoft introduced in July 2026 with red, blue, and green agent teams defending against AI-driven attacks from outside the enterprise, as reported by Nerova. Now Microsoft Project Perception turns the same machinery inward, watching internal agents through four continuous responsibilities: knowing which agents exist, containing what each one can access before it acts, protecting the data and tools in its path, and adapting protection as behavior and risk change.

The headline controls, as summarized by Unite.AI and AI Weekly citing GeekWire, are:

• Dynamic Permissions: an agent starts with no permissions and receives only what its approved task requires, for the duration of that task. The employee keeps their own access; the agent gets its own identity and a narrower authority.
• Dynamic Agent Risk: a continuously updated score built from identity, data, endpoint, cloud, network, and runtime signals plus the agent's own activity. If an agent reads untrusted content and then attempts an unrelated action, its risk score rises.
• Dynamic Conditional Access: protection that responds in steps. An agent might keep read access but lose write access, need human approval for high-impact actions, or be isolated or shut down entirely at higher risk.
• Guardian Agents: supervising security agents that investigate why another agent's risk shifted and recommend containment, with humans setting the policies and approval boundaries.

Microsoft is also expanding Entra Agent ID so agents carry identities separate from their human sponsors, making it easier to track who owns an agent and distinguish its actions from a person's. On the discovery side, Defender now detects around 60 types of local agents — up from 25 — including Claude Code, OpenAI Codex, and GitHub Copilot, according to Cyber Security News.

IT teams using Microsoft Project Perception can now see agents nobody formally deployed. The capabilities land in Microsoft 365 E7 and share signals with Microsoft Agent 365 through a unified registry, per the company's posts by security EVP Hayete Gallot and corporate VP Nadim Abdo.

Why the Insider-Threat Framing Matters

The announcement's core argument is that the same access that makes agents useful creates the risk. AI agents are taking on a growing share of everyday work and often need access to company data, applications, tools, and other agents to be useful, Abdo wrote — but they can be manipulated, make mistakes, or be compromised, and they run continuously at machine speed.

Microsoft CEO Satya Nadella echoed the principle in an October 19 post, describing the approach as separating the supply of intelligence from the authority to act: the model can supply answers or plans, but separate security systems decide what data it can access and which actions it can take. That way, as reported by Cyber Security News, the model cannot change or bypass the safeguards that govern it.

The timing fits a broader pattern this month. Agent incidents keep making the insider problem concrete: recent research found dormant AI agents retain credentials and trigger paths that stay open long after their tasks end, as covered in this earlier report on abandoned agent credentials. Microsoft Project Perception is essentially a standing answer to that class of problem — identity, discovery, and adaptive containment instead of hoping the agent behaves.

What Agent Teams Should Watch Next

Analysts quoted in coverage note the announcement leaves the practical questions open. Neither official post gives prices, dates, or preview labels, according to a breakdown on LinkedIn — so availability and which features land in which Microsoft 365 plans are expected at Microsoft Ignite, November 17 to 20, 2026.

The bigger question for buyers is enforcement independence: whether the controls watching an agent truly operate outside the agent being watched. A risk score is only as good as what it catches, and the first public case of a Guardian Agent stopping a hijacked agent — or failing to — will say more than any launch post.

If enterprise buyers start demanding this kind of identity and containment control, expect other vendors to follow: Google, AWS, and the AI labs all ship agents of their own. And the enterprise demand for governed agent access is growing fast — OpenAI's models landing on Google Cloud shows how quickly multi-vendor agent deployments are becoming normal, which is exactly the sprawl Microsoft Project Perception was built to govern.