Microsoft warns organizations to treat AI agents as potential insider risks not because they are automatically malicious, but because they can access company data, apps, and tools and act on that access at high speed.
The warning, published on October 19, 2026, comes as businesses use agents to handle tasks such as writing code, reviewing documents, and processing expenses.
An agent’s actions can change as its instructions, data, or working context change. It may make a mistake, follow harmful directions hidden in a document, or be compromised.
Because agents can act across connected systems, an unsafe action could expose sensitive information or change business records before a person notices. Microsoft’s point is not that every agent is dangerous. It is that organizations should not assume an agent will always behave as intended.
The risk grows when an agent receives more access than its task requires. An agent used to review expense claims, for example, may need to read submissions and check company rules. It should not automatically inherit all the permissions of the employee who set it up. If it encounters hidden instructions in a file or tries to take an unrelated action, security controls should be able to limit what it can do.
AI Models as Insider Threats
Microsoft says those controls should operate outside the AI model. The model can provide answers or plans, but separate security systems should decide what data it can access and which actions it can take.
This matters because a model should not be able to change or bypass the safeguards that govern it. Microsoft CEO Satya Nadella has described this approach as separating the supply of intelligence from the authority to act.
To support this approach, Microsoft announced plans to expand agent discovery and controls through Project Perception and Microsoft Agent 365. The company says it is adding support for 35 more types of local agents, bringing its total to 60, and expanding Microsoft Entra Agent ID so agents can have identities separate from their human sponsors. That separation can help security teams track who owns an agent and distinguish its actions from a person’s.
Microsoft also described Dynamic Permissions, Dynamic Agent Risk and Dynamic Conditional Access for agents. The proposed controls would give agents only the access needed for a task and adjust that access as risk changes.
For example, an organization might let an agent continue reading information while blocking it from making changes, restrict the systems it can reach, or require human approval before a sensitive action. At higher risk, the agent could be isolated or stopped.
The company also introduced Guardian Agents, intended to help security teams monitor agent activity and respond to changes at machine speed. Microsoft says people would still set the rules and retain control of important decisions, while Guardian Agents could investigate alerts and apply permitted safeguards. The announcements describe Microsoft’s planned security approach, not a guarantee that every agent-related threat can be prevented.
For security teams, the message is to build agent oversight into deployment from the start. That means tracking which agents exist, assigning clear identities, limiting permissions, monitoring activity, and keeping an independent way to stop unsafe actions.
Related coverage from Cybersecurity News examines Microsoft’s prompt-injection protection for Office 365 and execution containers for securing AI workflows. When agents can act across company systems, visibility and limits are essential to using them safely.
An EDR alert reveals an attack. But can it tell the full story? Discover how to reconstruct the attack timeline.
