Microsoft now treats AI agents as insiders risks that could go rogue

Microsoft has announced new security tools that treat artificial agents (AI) agents as possible insider risks, assigning them updated risk scores and restricting the agent’s access when that score goes up.

“An agent should not automatically inherit all the standing access of its user,” Nadim Abdo, corporate vice president, identity and network access, Microsoft, wrote in a blog post. “It should begin with no authority and receive only what it needs for the approved task, for only as long as the task requires.”

The features are part of Microsoft 365 E7, the company’s top-tier workplace bundle, and Project Perception, its security system. The risk score draws on signals from identity, data, devices, cloud, network and the agent’s own activity, including whether the agent drifts from the task it was given.


Microsoft said it can now also detect 60 types of agents running on employees’ computers such as Anthropic’s Claude Code, OpenAI’s Codex and GitHub Copilot.

Why the tighter checks?

Abdo said agents are not malicious. However, they are useful only when they are given access to company systems, and that access is where the risk lies. “They can make mistakes, be manipulated, or be compromised,” he wrote.

As per him, the speed at which agents work changes how quickly a company must respond when something goes wrong.

“For human users, a delay between detection and response may be manageable. For an agent operating at machine speed, it can be the difference between containment and impact,” Abdo said.

Microsoft said it wants every agent to have its own identity, separate from the employee who uses it, so a company can differentiate between what a person did and what an agent did on their behalf. The agents would also start with no access at all. Access would expire when the task ends, and higher-impact actions would need a person’s approval.

However, limiting access at the outset does not remove the need to monitor an agent as it works. Abdo said that an agent can turn risky without any change to its settings, for example after reading a prompt injection, which is a hidden text written to trick an AI system into following someone else’s instructions. “Least privilege reduces exposure, but it does not eliminate risk,” he added.

Restrict before shutting it down

Abdo explained the system using an agent that reviews employee expenses and approves routine ones within company policy. If the agent comes across untrusted content and then tries to do something unrelated to its task, its risk score rises.

It keeps its ability to read data, but it loses the right to approve or change anything and is blocked from sensitive information, while any high-impact step needs a person’s approval. “The agent is constrained without treating every risk change as a kill-switch event.”

The announcement follows an essay from Microsoft chairman and chief executive Satya Nadella on October 10, titled “Models as Insider Risks in the Super Intelligence Era.”

Nadella wrote that companies “must assume a model is compromised and contain it from the start”, and that “the most trustworthy Super Intelligence system will not be the one with the model we trust most. It will be the one that enables us to trust the model the least”.

For large organisations, this means decisions on what an agent can access, who approves its actions and when it should be stopped are expected to look much like the checks companies already apply to employees who handle sensitive systems.

“People define policy, approval boundaries, and delegation rules. People retain control over objectives and consequential decisions,” Abdo added.