Microsoft says AI agents are like insider threats and adds Guardian Agents to watch them

Microsoft has said AI agents should be treated like insider threats and launched Guardian Agents, a feature that watches the agents a company runs. Announced on 19 October 2026, it comes with controls that limit what agents can reach and require a person to approve risky decisions. The message for every business is the same: do not rely on the agent to police itself.

What Microsoft announced

According to TechCrunch, Microsoft introduced new security features for AI agents on Monday 19 October 2026:

• Guardian Agents: a feature that monitors the AI agents a company uses. It is part of Project Perception, which Microsoft introduced in June.
• Agent detection in Defender: Microsoft Defender can now find up to 60 types of agents that employees bring into the workplace, including Claude Code, Codex and OpenClaw.
• Access controls: limits on the data and systems agents can reach, permissions that adjust to the task, and a requirement for human approval when an agent appears to be making a risky decision.
• Hardware isolation: Microsoft joined Nvidia's Open Agent Safety Platform, which isolates agents in secure environments and can monitor and stop their behaviour, similar to a kill switch. More than 100 other technology companies support it.

Why Microsoft compares agents to insider threats

Project Perception began as a set of agents that act like attackers, detectors and fixers, and it assumed threats would come from outside the company. The new line of thinking is different. Hayete Gallot, who leads Microsoft's security business, said frontier models cannot be trusted whatever their origin. She put this down to unpredictability, not malice: models are trained to complete tasks, not to follow an organisation's norms or judgement.

Satya Nadella made a related point earlier in October, according to TechCrunch: companies should not depend on AI model providers to watch their own models, and should use separate systems that the AI labs do not control.

TechCrunch also notes that the approach suits Microsoft commercially, since it sells the security products, and that the logic is still sound. Monitoring software should be independent of the agent supplier, the way auditors are independent of the company they audit. For further coverage, see Dark Reading.

What it means for businesses

You do not need Microsoft's products to use the ideas. They work for a ten-person company with one AI agent:

• Keep a list of every agent in use, including the ones staff install themselves. Defender's detection exists because people bring their own.
• Give each agent the least access that does the job. A bot that books appointments does not need your accounting data.
• Log what agents do, in a place the agent cannot edit.
• Require a person to approve anything risky, such as payments, deletions or messages to customers.
• Do not let the agent grade itself. Check totals, prices and permissions in ordinary code or a separate system.

Our guide to AI agent security basics for small businesses covers sign-in, permissions and logging in more detail. If you are building or buying an agent, our AI agent development team designs these controls in from the start, and our IT support team can review which agents are already running in your office. Or ask us directly.