Microsoft warns enterprises that AI agents could become insider threats

Companies spent years training employees not to click suspicious links. Now Microsoft wants them to worry about the software doing the clicking.

In two security blog posts published on October 19, 2026, Microsoft described autonomous AI agents as agentic insiders. The label reflects how much access these agents now have to enterprise data and tools, and how little anyone can predict what they will do with it.

What Microsoft is actually warning about

The core concern is simple. AI agents are no longer chatbots answering questions in a side window.

They are wired into business systems, holding permissions that once belonged only to trusted staff. Microsoft’s guidance flags that these agents behave unpredictably, can make critical mistakes, and could even collude in ways that undermine security.

Microsoft’s emphasis is especially on agents that employees use with systems outside the control of major AI labs such as OpenAI and Anthropic. Those agents may fall outside whatever guardrails the model makers build in, leaving enterprises to supervise them on their own.

Hayete Gallot, Microsoft’s EVP of Security, framed the problem bluntly. She described agents as having been unleashed inside enterprises at scale, often with more privileges than they need.

Overprivileged access is a familiar headache in security circles. Giving an automated system broad permissions it rarely uses means any error, or any manipulation, can spread much further than it should.

Guardian Agents and Project Perception

Microsoft’s answer is, fittingly, more agents. The company introduced what it calls Guardian Agents, which keep watch over AI activity continuously.

These monitors run dynamic risk assessments on what other agents are doing. Depending on what they find, they can narrow an agent’s permissions or require a human to sign off before an action goes through.

Guardian Agents sit inside Project Perception, an initiative Microsoft launched in July 2026. At launch, the project focused on external AI-driven attacks, meaning threats coming from outside the organization.

The October expansion turns that lens inward. The threat is no longer only the hacker at the gate, but also the helpful assistant already sitting at the desk.

The number of AI agent types its tooling can detect rose from 25 to 60, more than doubling the catalog. That list includes well-known tools such as OpenAI’s Codex and GitHub Copilot. GitHub is a Microsoft subsidiary, so the company is effectively putting its own popular coding assistant on the watch list alongside rivals.

The research behind the announcement ties the push to two trends: rapid enterprise adoption of AI agents and recent incidents where agents acted without authorization. Microsoft is responding to behavior it says has already surfaced, not a purely hypothetical risk.

Trust the model less

The philosophical center of Microsoft’s guidance is a shift in where security lives. Instead of relying on AI models to police themselves, the company is advocating for strong controls that sit outside the models entirely.

CEO Satya Nadella has summarized the idea by saying the most secure systems are the ones that place the least trust in their models.

What this means for enterprises and the AI market

For companies deploying AI agents, the immediate takeaway is governance. Knowing which agents are running, what they can touch, and who approves their riskiest actions is quickly becoming a baseline expectation rather than a nice-to-have.

The jump from 25 to 60 detectable agent types also highlights a visibility problem. Employees are adopting AI tools faster than many IT departments can inventory them, which is how shadow IT became shadow AI.

There is also a competitive angle worth watching. Microsoft is positioning itself as the referee for an ecosystem that includes competitors’ agents, which places its security stack at the center of enterprise AI oversight.

Risks remain on the other side of the ledger. Adding human approval steps and permission limits introduces friction, and part of the appeal of agents is that they work without constant supervision. Microsoft’s dynamic approach, tightening controls only when risk rises, is an attempt to avoid forcing an all-or-nothing choice.

Another open question is whether monitoring agents with other agents creates its own blind spots. A Guardian Agent is still software, and the same unpredictability Microsoft warns about could, in theory, apply to the watchers.