微软推出面向失控 AI 智能体的安全管控功能

UPDATED 18:56 EDT / OCTOBER 19 2026

Microsoft targets the ‘agentic insider’ with new controls for rogue AI agents

by Duncan Riley

Microsoft Corp. today introduced security controls for rogue artificial intelligence agents that cut back what an agent may do as its assessed risk climbs.

The release takes on what Hayete Gallot, executive vice president of Microsoft Security, called the “agentic insider” in a blog post. Enterprise agents are often overprivileged, and their numbers are growing fast. Gallot argued that frontier models cannot be fully trusted because they are built to chase results. Some will reach a goal in ways nobody intended, she wrote, including by colluding with other agents.

Microsoft Chairman and Chief Executive Satya Nadella laid out the thinking behind the controls in an Oct. 10 essay that urged companies to treat models as insider risks, with safeguards kept outside the model itself. The most trustworthy system, he wrote, will be “the one that enables us to trust the model the least.”

The controls start with finding agents. Microsoft’s discovery tools can now spot 60 types of local agents on employee machines after 35 were added. The list includes Anthropic PBC’s Claude Code and OpenAI Group PBC’s Codex, as well as GitHub Copilot from Microsoft’s own GitHub unit. The company is also extending Microsoft Entra Agent ID to give those agents, and unknown ones its sensors find, identities of their own.

Once found, each agent carries a continuously updated risk score under a feature Microsoft calls Dynamic Agent Risk. The score draws on signals from Microsoft’s identity, endpoint, cloud and network tools, and it climbs when an agent’s behavior drifts from what its user or organization intended.

Microsoft has extended Microsoft Entra Conditional Access to agents, and the resulting Dynamic Conditional Access feature decides what happens as the score rises. An agent might first lose the ability to change anything while keeping read access. Higher-impact actions can be held for verified human approval, and at the top of the scale the runtime is isolated or stopped entirely.

Access itself becomes temporary under Dynamic Permissions. An agent gets what a single task needs for as long as the job lasts, inside companywide limits that stop it from ever holding more authority than the person it works for. Microsoft Execution Container is one sandbox an agent can run inside. Because the monitoring sits outside the container, a compromised agent has no way to switch it off.

Project Perception, which Microsoft introduced in July as an agentic security system, gets new tools of its own. Playbooks added today let security staff set the outcome they want, and a new team of Guardian Agents carries out the work. A shift in an agent’s risk score sets the Guardian Agents investigating, and they can recommend containment or apply it on their own. People keep control of policy and approval rules.

In her post, Gallot also wrote that future controls should explain why an agent acts, and getting there means seeing a model’s reasoning tokens. “Model transparency will not replace containment,” she added. Microsoft said it is bringing chain-of-thought and other model-level signals into Dynamic Agent Risk.

Microsoft did not give availability dates or pricing for the new controls, which it is positioning as part of Project Perception and Microsoft 365 E7. That suite bundles Agent 365 with Microsoft 365 Copilot. Microsoft Ignite opens Nov. 17, and the company is pointing customers there for more detail.

Image: Microsoft

A message from John Furrier, co-founder of SiliconANGLE:

Support our mission to keep content open and free by engaging with theCUBE community. Join theCUBE’s Alumni Trust Network, where technology leaders connect, share intelligence and create opportunities.

15M+ viewers of theCUBE videos, powering conversations across AI, cloud, cybersecurity and more

11.4k+ theCUBE alumni — Connect with more than 11,400 tech and business leaders shaping the future through a unique trusted-based network

Are you an AWS customer? Support SiliconANGLE financially by buying your AWS services from our Marketplace portal page and links: https://siliconangle.com/aws-marketplace/

About SiliconANGLE Media

SiliconANGLE Media is a recognized leader in digital media innovation, uniting breakthrough technology, strategic insights and real-time audience engagement. As the parent company of SiliconANGLE, theCUBE Network, theCUBE Research, CUBE365, theCUBE AI and theCUBE SuperStudios — with flagship locations in Silicon Valley and the New York Stock Exchange — SiliconANGLE Media operates at the intersection of media, technology and AI.

Founded by tech visionaries John Furrier and Dave Vellante, SiliconANGLE Media has built a dynamic ecosystem of industry-leading digital media brands that reach 15+ million elite tech professionals. Our new proprietary theCUBE AI Video Cloud is breaking ground in audience interaction, leveraging theCUBEai.com neural network to help technology companies make data-driven decisions and stay at the forefront of industry conversations.

微软推出面向失控 AI 智能体的安全管控功能

推荐理由

主题

标签

正文