Microsoft extends Project Perception to treat AI agents as insiders
Microsoft’s security head says frontier models from any lab cannot be trusted, and the company is building identities, sandboxes and time-limited permissions for the agents they power
- Microsoft Agent 365 costs $15 (£11.25) per user a month, paid yearly, and is included in Microsoft 365 E7 at $99 (£74.27) per user a month
- Project Perception was first announced in July 2026
- Agent discovery on macOS and runtime protection on Windows are in preview, according to Microsoft documentation updated on 9 October 2026
For firms already running Microsoft Defender for Endpoint, agent discovery arrives in a console they already use, which puts standalone agent-security vendors up against an incumbent for the same budget. Coding assistants and desktop AI apps chosen by individual staff become visible to the security team, not only to the people running them. The controls beyond discovery carry no published price, license tier or release status, so the cost of governing agents at that depth is still unknown.
“Agents will only be adopted at scale if they can be trusted at scale.”Terrell Cox, corporate vice-president and deputy CISO, customer security, Microsoft
Microsoft said on 19 October that it is extending Project Perception, its security program built on teams of AI agents, to the AI agents running inside customer organizations. Discovery now covers 35 more types of local agent, bringing the total to 60, among them OpenAI Codex, GitHub Copilot and Claude Code.
Discovery runs through Microsoft Defender for Endpoint on onboarded devices and lists each agent and, for many of them, the Model Context Protocol (MCP) servers it is configured to use. It is activity based: according to Microsoft’s support matrix for AI agents, an agent appears only after Defender observes it working, so installing one does not guarantee it shows up.
In the announcement, Nadim Abdo, corporate vice-president for identity and network access, set out the controls around it. Microsoft is extending Entra Agent ID with identity types for local and previously unknown agents. Microsoft Execution Container (MXC) is a sandbox that gives agents policy-controlled access to resources. Dynamic Permissions scope an agent’s rights to a single task inside an organization-wide limit and remove them when the task ends, and higher-impact actions can require verified human approval. Dynamic Agent Risk keeps a continuously updated score from identity, data, endpoint, cloud, network and runtime signals, while Dynamic Conditional Access extends Entra’s access policies to agents with graduated responses. Guardian Agents and Playbooks are agents that carry out security work within policies people set.
Perception shares signals, context and a single agent registry with Microsoft Agent 365, the agent management product Microsoft lists as generally available. Hayete Gallot, executive vice-president of Microsoft Security, made the wider case in a separate post, calling agents unpredictable and describing them as insiders. As reported by TechCrunch, Microsoft is closely tied to OpenAI and Anthropic while also selling security products for agents.
Sources
- Microsoft, “Agents are your newest insiders: Security must move at their speed”, blog post by Nadim Abdo, 19 October 2026. https://www.microsoft.com/en-us/security/blog/2026/10/19/agents-are-your-newest-insiders-security-must-move-at-their-speed/
- Microsoft, “Securing the agentic insider”, blog post by Hayete Gallot, 19 October 2026. https://blogs.microsoft.com/blog/2026/10/19/securing-the-agentic-insider/
- Microsoft Learn, “Microsoft Defender for Endpoint AI agent support matrix”, updated 9 October 2026. https://learn.microsoft.com/en-us/defender-endpoint/ai-agent-support-matrix
- Microsoft, “Microsoft Agent 365”, product and pricing page, accessed 20 October 2026. https://www.microsoft.com/en-us/microsoft-agent-365
- European Central Bank, euro reference exchange rates, 19 October 2026. https://data-api.ecb.europa.eu/service/data/EXR/D.USD+GBP.EUR.SP00.A?startPeriod=2026-10-19&endPeriod=2026-10-19&format=csvdata
- TechCrunch, “Microsoft says AI agents are like insider threats as ‘frontier models can’t be trusted’”, 19 October 2026. https://techcrunch.com/2026/10/19/microsoft-says-ai-agents-are-like-insider-threats-as-frontier-models-cant-be-trusted/
