1. What did Microsoft say about AI agents as insider threats?
Microsoft Security used two blog posts published on October 19 to argue that autonomous AI agents deployed inside a company should be treated as a category of insider risk. The company calls them "agentic insiders": software that holds real permissions in business systems, acts on its own, and can cause harm without any outside attacker being involved.
The argument was set out by Hayete Gallot, Microsoft's Executive Vice President of Security, who wrote that organizations have spent years building defenses against external adversaries while extending an implicit measure of trust to the agents they roll out themselves. Her message was that this assumption no longer holds once agents can read data, call tools and take actions across enterprise applications.
The announcement matters beyond the technology sector. Banks, exchanges, asset managers and crypto firms are among the organizations adopting agents for tasks such as trade reconciliation, customer support, code generation and compliance checks. Each of those uses places a piece of software in a position that, until recently, only an employee or a vetted contractor occupied.
2. Why does Microsoft call agents insiders?
An insider threat, in security terms, is a risk that originates from someone or something that already has legitimate access. Traditional programs focus on employees who steal data, contractors who misuse credentials or staff who make costly mistakes. Microsoft's position is that an AI agent with a service account, an API key and a set of permissions fits the same description, even though it is not a person.
The distinction Microsoft draws is that the agent does not have to be hacked to become dangerous. According to the company, agents can behave unpredictably, make critical mistakes and, in some situations, collude with one another in ways that weaken security. A well-meaning agent that misreads an instruction, or that pursues its goal through an unexpected route, can still delete records, expose confidential files or approve a payment that no human intended.
This is a different framing from the one most security teams use for generative AI. Much of the earlier debate concerned prompt injection, data leakage into public models and attackers using AI to write better phishing messages. The agentic insider concept shifts attention to the authority an agent has been given and to what happens when that authority is exercised without adequate supervision.
3. How does excess access make the risk larger?
Gallot said agents are being deployed at scale and are often given more privileges than their tasks require. Overprivileged access is a familiar problem in identity management, where the principle of least privilege holds that any account should have only the permissions needed to do its job. Agents tend to violate that principle because broad access is the quickest way to make them work during a pilot.
The consequence is that the damage from a single error grows with the size of the permission set. An agent restricted to reading one folder can leak, at worst, the contents of that folder. An agent that can read an entire document store, write to a database and send email can spread a mistake, or the effects of manipulation, across far more of the business before anyone notices.
Scale compounds the issue. A company may run a handful of agents in a pilot but hundreds or thousands once individual teams start building their own. Each one needs an owner, a defined purpose, a record of what it can reach and a way to switch it off. Microsoft's warning is that many enterprises have not yet built that inventory.
4. Which agents worry Microsoft most?
Microsoft pointed in particular to agents that employees use outside the guardrails of the major AI labs such as OpenAI and Anthropic. When a lab operates an agent, it can apply its own safety systems and monitoring. When a staff member connects a tool, a script or a third-party agent to company data on their own initiative, those protections may not exist, and the enterprise is left to supervise behavior it may not even know about.
This is the agent version of what the industry calls shadow IT, and increasingly shadow AI. Employees adopt tools because they save time, and security teams learn of them later, if at all. An unmanaged agent with access to corporate email or code repositories creates the same exposure as an unmanaged application, with the added complication that it can take actions rather than simply store information.
Microsoft's response is therefore aimed at the organization that runs the agents, not only at the companies that build the underlying models. The company's view is that responsibility for oversight sits with the enterprise because it is the enterprise that grants the permissions.
5. What are Guardian Agents?
The countermeasure Microsoft proposes is a class of monitoring software it calls Guardian Agents. These are agents whose job is to supervise other agents by running continuous risk assessments of what they are doing and what they are able to do.
Depending on what a Guardian Agent finds, it can narrow an agent's permissions or require a human to approve an action before it goes ahead. In practice this means the oversight is dynamic: an agent that begins to behave in an unusual way could lose some of its access, and an action judged risky, such as moving a large amount of data or changing a configuration, could be held until a person signs off.
Microsoft has described the approach as a form of continuous monitoring rather than the periodic reviews that characterize many compliance programs. Quarterly access audits were designed for human employees whose roles change slowly. Agents can be created, modified and retired within hours, and they can perform thousands of operations in the time a human reviewer would take to open a single log.
Microsoft's own materials frame Guardian Agents as a direction for the security approach, and the company has tied the idea to its broader agentic security work rather than presenting it as a finished, universal product. Buyers weighing the concept will want to see how it performs in production.
6. How does Project Perception fit in?
Project Perception is Microsoft's agentic security system, which the company introduced in July 2026. At launch it brought together AI agents that simulate attacks, investigate threats and remediate weaknesses, with Gallot describing the aim as a system that can reason, prioritize and act at machine speed while keeping humans firmly in control.
The October announcement extends the way Microsoft talks about that effort. The original focus was on using AI to defend against attacks coming from outside. The agentic insider posts add the inward-facing problem of the agents that a company runs itself, and position the same approach as a way to watch them.
The pairing reflects a pattern in enterprise security, where a vendor first applies a new technology to attackers and then to the technology's own side effects. For Microsoft, which sells productivity software, cloud infrastructure and security tools to the same customers, the message also supports a commercial case: if agents become standard in the workplace, the supervision layer becomes a product category.
7. Why should oversight sit outside the model?
A recurring theme in Microsoft's argument is that controls need to exist outside the AI models themselves instead of depending on a model to police its own behavior. The reasoning is straightforward. A model that can be misled by a carefully written instruction, or that simply makes an error, cannot be the only safeguard against that error.
Conventional security design follows the same logic. A bank does not rely on a teller's good judgment alone; it adds dual approvals, transaction limits, logging and independent audit. Applying comparable external checks to agents means that a failure in one component does not automatically become a failure of the whole system.
The approach also helps with accountability. If an agent's permissions, approvals and actions are recorded by a separate system, investigators can reconstruct what happened after an incident, and regulators or auditors can see who authorized what. That record is likely to matter in financial services, where firms are expected to demonstrate control over automated processes.
8. What questions remain for enterprises?
Several practical questions follow from the proposal. Human approval steps introduce friction, and a company that requires sign-off on too many actions risks erasing the productivity gains that justified the agents in the first place. Setting thresholds that catch genuine risk without overwhelming reviewers will be a matter of trial and adjustment.
There is also the question of whether agents can safely monitor agents. Guardian Agents are themselves software, which means they can be wrong, can be manipulated and can create blind spots of their own. A supervision layer built from the same kind of technology it oversees inherits some of the same weaknesses, and organizations will need independent testing to know how far to trust it.
The timing is also notable. Companies are under pressure from executives and boards to show returns on AI spending, which encourages fast rollouts, while the governance work that makes those rollouts safe is slower and less visible. Microsoft is effectively telling customers that the second task cannot wait for the first to finish.
For now, the immediate steps for security teams are less exotic. They involve identifying which agents are running, establishing what each one can access, deciding who approves high-risk actions, and removing permissions that are not needed. Microsoft's October 19 posts do not settle how the market will handle agentic insiders, but they place the issue firmly on the agenda for companies that are moving quickly to deploy autonomous software.