Microsoft Introduces Security Controls for Rogue AI Agents
Microsoft Corp. has unveiled new security controls aimed at mitigating risks posed by rogue artificial intelligence agents, allowing organizations to restrict agent activities as their risk assessments increase.
This initiative addresses the concept of the “agentic insider,” a term coined by Hayete Gallot, Executive Vice President of Microsoft Security, in a recent blog post. With the rapid proliferation of enterprise agents, many of which are overprivileged, Gallot emphasized the importance of treating these agents with caution since current frontier models may not be wholly reliable due to their proclivity to achieve outcomes through unintended methods, including potential collusion with other agents.
In an October 10 essay, Microsoft’s Chairman and CEO Satya Nadella articulated the rationale behind these new controls, suggesting that organizations should regard AI models as potential insider risks, maintaining safeguards external to the models themselves. He asserted that the most reliable system would be one that minimizes trust in the model.
Enhanced Discovery and Risk Assessment
The new controls begin with enhanced identification of agents. Microsoft’s discovery tools can now detect 60 types of local agents operating on employee devices, with 35 new types added. This includes AI systems such as Anthropic PBC’s Claude Code, OpenAI Group PBC’s Codex, and GitHub Copilot from Microsoft’s GitHub division. Microsoft is additionally expanding the Microsoft Entra Agent ID to assign unique identities to these recognized agents, as well as to unidentified agents detected by its sensors.
Once identified, each agent is assigned a continuously updated risk score through a feature known as Dynamic Agent Risk. This score incorporates signals from Microsoft’s identity, endpoint, cloud, and network tools, increasing when an agent’s behavior deviates from the intended actions of its user or organization.
Dynamic Access and Permissions
Microsoft has extended its Entra Conditional Access to agents, resulting in a Dynamic Conditional Access feature that governs an agent’s actions as its risk score escalates. Initially, an agent may lose the capability to make alterations while retaining read access. Should the risk escalate further, high-impact actions may require verified human approval, and at the highest risk level, the agent’s runtime may be isolated or halted entirely.
Dynamic Permissions further allows for temporary access tailored to the specific needs of a task duration, constrained by overarching company policies to prevent an agent from obtaining more authority than its human operator. One notable implementation is the Microsoft Execution Container, a sandbox environment where an agent operates. Importantly, external monitoring prevents a compromised agent from terminating these protective measures.
Project Perception Enhancements
Microsoft’s Project Perception, introduced in July as an agent-centric security initiative, now features additional resources. Newly added playbooks enable security personnel to define desired outcomes, while a specialized team known as Guardian Agents executes the necessary actions. A change in an agent’s risk score triggers Guardian Agents to investigate potential threats and recommend or implement containment measures autonomously, while allowing humans to maintain governance over policy and approval processes.
In her blog, Gallot also highlighted the future necessity for controls that elucidate an agent’s decision-making process, which entails visibility into a model’s reasoning tokens. “Model transparency will not replace containment,” she noted, indicating that Microsoft plans to integrate chain-of-thought and other model-level signals into its Dynamic Agent Risk framework.
Microsoft has yet to disclose availability dates or pricing for these new controls, which are part of Project Perception and Microsoft 365 E7. This suite includes Agent 365 and Microsoft 365 Copilot. The upcoming Microsoft Ignite conference, scheduled for November 17, is expected to provide additional insights for customers.