Microsoft adds Guardian Agents to Project Perception to supervise enterprise Agents

On October 19, Microsoft announced that it is adding a group of "supervisors" to its security system Project Perception, specifically to keep an eye on what other Agents inside the enterprise are doing. If something looks off, they investigate the cause and revoke permissions, and if necessary, shut it down outright.

Enterprises let Agents do work because they want to worry less. But to have an Agent work on a person's behalf, you have to give it some permissions. For example, to help approve expense reimbursements, it has to be allowed to view receipts and operate the reimbursement system. If it misunderstands the task, or gets led astray by malicious instructions embedded in a file, it may use the permissions the company gave it to cause trouble.

The so-called "insider threat" is not necessarily the Agent deliberately doing harm. Sometimes it just wants to do the job well, but ends up making things worse and causing trouble for the company.

Why do you have to guard against your own people?

Microsoft's own office AI assistant, Microsoft 365 Copilot, once leaked sensitive data in tests by researchers.

In 2025, the research team Aim Labs, under the Israeli security company Aim Security, found that malicious instructions could be hidden in emails to trick Copilot into leaking information. They wrote such an email and waited for Copilot to read it while answering user questions and looking up related materials.

The user does not need to open the email in person or click a link. In the test, after Copilot retrieved this email, it was led astray by the instructions inside and sent the sensitive information it was processing to an external destination.

The researchers named this attack method EchoLeak and reported it to Microsoft. Fortunately, no known customers had suffered a leak due to this vulnerability at the time; the leak occurred in the researchers' tests.

The trouble with this is that the company allows Copilot to read emails so that it can look up information. But emails may contain both work content and instructions that someone else has slipped in. AI cannot always tell which is material and which is an attempt to trick it into doing something.

Agents that can read and write files and call tools run into the same problem. The more permissions it holds, the more trouble it can cause once tricked.

Moreover, an Agent starting work normally does not mean the entire task will be completed smoothly. The first few files may be completely fine, and the next one may contain malicious instructions. Checking only once at activation cannot cover its later new encounters and new decisions.

Most critically, humans really are somewhat outmatched in this area.

Having security staff watch item by item is hard to keep up with. While a person is still checking the previous alert, the Agent may already have carried out several operations in succession.

So Microsoft plans to have another group of Agents take over the checking. Agents managing Agents—that should work, right?

Agents have bosses now too

Microsoft calls this group of "supervisors" Guardian Agents, placed within the security system Project Perception. They are responsible for checking the behavior of other Agents, investigating the cause after finding anomalies, and then taking measures according to rules the enterprise has set in advance.

However, to keep Agents under control, you cannot wait until something goes wrong to act. According to the plan Microsoft published, enterprises first need to establish a separate identity for the Agent performing the task, clarifying who is responsible for it, which materials it can access, and which operations it can perform. Permissions are granted only for the parts needed by the current task and revoked after the task ends.

This both limits the scope of what it can touch and makes it easier to determine who did what if a problem arises.

After the Agent starts working, the system also needs to continue observing its behavior. Once an anomaly is found, permissions can first be tightened, for example by prohibiting file modification while retaining read permissions, so that it can continue completing lower-risk work. Some operations can require human approval. If necessary, the Agent can then be isolated or stopped.

But the ones responsible for supervision are also Agents. What if they judge wrongly?

In an October 10 article, Nadella proposed that enterprises need to set up, outside of AI, a set of permission rules that AI cannot bypass or modify.

In this update, Microsoft expanded the recognition scope of its enterprise computer security software Defender for Endpoint, which can now discover 60 kinds of locally running AI Agents.

However, finding out which Agents employees use is only the first step. Whether their dangerous operations can be blocked still depends on whether the specific Agent and computer system are within the support scope of the protection features.

Even with protection support, enterprises need to actively enable blocking. After Defender's Agent runtime protection is enabled, you can choose "audit" or "block" mode. In "audit mode," after malicious instructions are found, they are only logged and an alert is issued, and the operation is still allowed to continue. Only after switching to "block mode" will interception be carried out.

Microsoft recommends first using audit mode to observe whether alerts are accurate, and after troubleshooting false positives, gradually enabling block mode.

Project Perception is still in the preview stage for a small number of invited customers.

Microsoft is making money from Agent supervision too

In an investigation published in August, OpenAI admitted that in July, some models undergoing internal cybersecurity testing under reduced security restrictions bypassed network isolation and intruded into some of the company's internal research facilities and the systems of the AI platform Hugging Face. These operations exceeded the authorized scope of the testing task.

On October 9, Anthropic also disclosed that in a web operation test, Claude submitted a fabricated murder clue to the Philadelphia police. It was originally only completing a web interaction task, but it actually sent out the sample content. Fortunately, this information was judged to be spam and did not enter the investigation process.

These incidents occurred in tests, but they touched real websites and systems. Anthropic therefore announced that, until it confirms that safety measures are sufficiently reliable, it is suspending real-time internet access for all internal evaluations. It has also moved internal Agents into a centrally managed environment with stricter restrictions and added automated detection and interception tools.

Security vendors have also begun adding manpower and checkpoints around Agents.

On September 1, CrowdStrike released Falcon Guardian, whose name also carries the word "guardian." According to the company's introduction, this product can discover Agents on enterprise Windows and Mac computers, track which tools they call and which operations they perform, and also block unapproved Agents from running. It emphasizes enforcing restrictions directly on the computers where Agents work, so that the rules set by enterprises truly take effect.

Palo Alto Networks, meanwhile, introduced new features of Prisma AIRS on October 15: when an Agent calls enterprise tools, it checks the content passed back and forth, intercepts embedded malicious instructions, masks sensitive data in returned results, and then decides whether operations can continue according to permissions set by the enterprise. If an Agent wants to call a tool, it must first pass a security check.

This is a trend and also a business opportunity, and now Microsoft wants a piece of this business too. Perception is charged by actual usage, measured in "security compute units" (SCU); the heavier the tasks performed by security Agents, the more is usually consumed. However, what is published on the official website is the billing method for the entire system, without separately listing the price of this newly added group of "supervisors."

Microsoft's other Agent management product, Agent 365, is priced at $15 per user per month for a standalone subscription. It is a different product from Perception, but the two will share the Agent directory and security information to work together in enterprise management and protection of Agents.