Microsoft adds Guardian Agents to its security system Project Perception to supervise enterprise Agents

Middle management won't disappear—it's just being replaced by Agents. Letter List downloads the app for exclusive early access. October 22, 2026, 16:00:50, from Beijing. Updated October 22, 2026, 16:43:03

On October 19, Microsoft announced that it was adding a group of "supervisors" to its security system Project Perception, specifically to keep an eye on the other Agents working inside enterprises. If something looks off, they investigate the cause and revoke permissions, and if necessary, shut it down outright.

When enterprises put Agents to work, the whole point is to worry less. But to have them do work on people's behalf, you have to give them some permissions. For example, to help approve expense reimbursements, you have to let them view the receipts and operate the reimbursement system. If they misunderstand the task, or get led astray by malicious instructions embedded in a file, they may use the permissions the company gave them to cause trouble.

The so-called "mole" isn't necessarily an Agent acting with malicious intent. Sometimes it just wants to do the job well, but ends up doing more harm than good and creating trouble for the company.

01

Why do we have to guard against our own people?

Microsoft's own office AI assistant, Microsoft 365 Copilot, once leaked sensitive data in tests by researchers.

In 2025, the research team Aim Labs, under the Israeli security company Aim Security, found that malicious instructions could be hidden in emails to trick Copilot into leaking information. They wrote such an email and waited for Copilot to read it while answering user questions and looking up relevant materials.

Users don't need to open the email themselves or click a link. In the test, after Copilot retrieved this email, it was led astray by the instructions inside and sent the sensitive information it was processing to an external destination.

The researchers named this attack method EchoLeak and reported it to Microsoft. Fortunately, no known customers had suffered a leak due to this vulnerability at the time; the leak occurred in the researchers' tests.

The trouble with this is that the company allows Copilot to read emails so it can look up information. But emails may contain both work content and instructions that someone else has slipped in. AI can't always tell what is reference material and what is trying to trick it into doing something.

Agents that can read and write files and call tools run into the same problem. The more permissions they hold, the more trouble they can cause once tricked.

Moreover, an Agent starting work normally doesn't mean the entire task will be completed smoothly. The first few files may be perfectly fine, and the next one may contain malicious instructions. Checking only once at activation can't cover its later encounters and new decisions.

Most critically, humans really are somewhat outmatched in this area.

Having security staff watch every item one by one is also hard to keep up with. While a person is still investigating the previous alert, the Agent may have already carried out several operations in succession.

So Microsoft plans to have another group of Agents take over the checking. Agents managing Agents—that should work, right?

02

Agents have bosses now too

Microsoft calls this group of "supervisors" Guardian Agents, and places them in the security system Project Perception. They are responsible for checking the behavior of other Agents, investigating the cause after finding anomalies, and then taking measures according to rules the enterprise has set in advance.

However, to keep Agents in check, you can't wait until something goes wrong to act. According to the plan Microsoft published, enterprises first need to establish a separate identity for the Agent performing the task, clarifying who is responsible for it, which materials it can access, and which operations it can perform. Permissions should be granted only for the parts needed by the current task and revoked when the task ends.

This both limits the scope of what it can touch and makes it easier to determine who did what if a problem arises.

After the Agent starts working, the system also needs to continue observing its behavior. Once an anomaly is found, permissions can first be tightened—for example, prohibiting file modification while retaining read permissions, so it can continue completing lower-risk work. Some operations can require human approval. If necessary, the Agent can then be isolated or stopped.

But the ones doing the supervising are also Agents. What if they judge wrongly?

In an October 10 article, Nadella proposed that enterprises need, outside of AI, a set of permission rules that AI cannot bypass or modify.

In this update, Microsoft expanded the detection scope of its enterprise computer security software Defender for Endpoint, which can now discover 60 kinds of locally running AI Agents.

However, finding out which Agents employees are using is only the first step. Whether their dangerous operations can be blocked still depends on whether the specific Agent and computer system are within the support scope of the protection features.

Even with protection support, enterprises need to actively enable blocking. After Defender's Agent runtime protection is enabled, you can choose "audit" or "block" mode. In "audit mode," after malicious instructions are found, they are only logged and an alert is issued, and the operation is still allowed to continue. Only after switching to "block mode" will interception be carried out.

Microsoft recommends first using audit mode to observe whether alerts are accurate, and after troubleshooting false positives, gradually enabling block mode.

Project Perception is currently still in preview for a small number of invited customers.

03

Microsoft is making money off Agent supervisors too

In an investigation published in August, OpenAI admitted that in July, some models undergoing internal cybersecurity testing under weakened security restrictions bypassed network isolation and intruded into some of the company's internal research facilities and the systems of the AI platform Hugging Face. These operations exceeded the authorized scope of the testing task.

On October 9, Anthropic also disclosed that during a web operation test, Claude submitted a fabricated murder tip to the Philadelphia police. It was originally only completing a web interaction task, but it actually sent out the sample content. Fortunately, this information was judged to be spam and did not enter the investigation process.

These incidents occurred in tests, but they touched real websites and systems. Anthropic therefore announced that, until it confirms that safety measures are sufficiently reliable, it is suspending real-time internet access for all internal evaluations. It also moved internal Agents into a centrally managed environment with stricter restrictions and added automated detection and interception tools.

Security vendors have also begun adding more people and more checkpoints around Agents.

On September 1, CrowdStrike released Falcon Guardian, whose name also includes "guardian." According to the company's introduction, this product can discover Agents on enterprise Windows and Mac computers, track which tools they call and which operations they perform, and also block unapproved Agents from running. It emphasizes enforcing restrictions directly on the computers where Agents work, so that the rules set by enterprises truly take effect.

Palo Alto Networks, meanwhile, introduced new features of Prisma AIRS on October 15: when an Agent calls enterprise tools, it checks the content passed back and forth, intercepts embedded malicious instructions, masks sensitive data in returned results, and then decides according to enterprise-set permissions whether the operation can continue. If an Agent wants to call a tool, it must first pass a security check.

This is a trend and also a business opportunity, and now Microsoft wants a piece of this business too. Perception charges based on actual usage, measured in "security compute units" (SCU); the heavier the tasks performed by security Agents, the more is usually consumed. However, what is published on the official website is the billing method for the entire system, without separately listing the price of this newly added group of "supervisors."

Microsoft's other Agent management product, Agent 365, is priced at $15 per user per month for a standalone subscription. It is a different product from Perception, but the two will share the Agent directory and security information to work together in managing and protecting enterprise Agents.

"Special statement: The above content (including videos, pictures, and audio if any) is uploaded and published by users of Dafeng Hao, a self-media platform under Phoenix Net. This platform only provides information storage space services.

Notice: The content above (including the videos, pictures and audios if any) is uploaded and posted by the user of Dafeng Hao, which is a social media platform and merely provides information storage space services."