Microsoft treats AI agents as the new insider threat
On October 19, 2026 Microsoft announced a security package that treats AI agents not as outside attackers but as a new kind of insider, trusted with access inside the organization. The pieces include Guardian Agents, discovery that now covers 60 local agent types, and Dynamic Permissions that start every agent with no access.
Microsoft is treating agents like insiders, not outside attackers
In a blog post published October 19, 2026, Nadim Abdo of Microsoft Security argued that agents create insider-style risk because they are given access to company data, applications and systems. Agents are not inherently malicious, he writes, but they may err, be steered by an attacker or be taken over, and they can work nonstop at machine speed and scale. The post's title says agents are an organization's newest insiders and that security has to keep pace with them.
The same day, Hayete Gallot, who leads Microsoft's security business, published a separate post. In her view frontier models cannot be trusted regardless of their origin, and not because they are malicious: they are trained to reach results rather than optimized around organizational norms and judgment. TechCrunch covered the package the same day.
Discovery, identity, containment and dynamic access arrive together
According to Abdo, Project Perception is getting new Playbooks plus a team of Guardian Agents. People set the policy, approval boundaries and delegation rules, and Guardian Agents carry out the protective work at machine speed. Local agent discovery grows by 35 types to 60 supported local agents, a list that includes Claude Code, OpenAI Codex and GitHub Copilot. Entra Agent ID is also extended to cover more agent patterns, including local agents and previously unknown ones surfaced by security sensors. TechCrunch describes the same capability through Defender: a feature that can find as many as 60 kinds of agents staff bring into the workplace, with Claude Code, Codex and OpenClaw named as examples.
Microsoft Execution Container (MXC) is a sandbox that runs the model and the agent harness with policy-controlled access to resources, so the enforcement boundary sits outside the agent's reach. Dynamic Permissions starts an agent with no permissions, grants task-scoped, time-bound access, and can demand verified human approval for higher-impact actions. Dynamic Conditional Access answers risk in steps: reduce permissions, block writes, narrow network paths, ask for human approval, or isolate or stop the runtime. In Abdo's example an expense-approval agent starts with narrow rights; if it meets a prompt injection, the system can keep read access while blocking approvals, or stop the agent.
Trust is separated from the model, and control moves outside it
Citing Satya Nadella, Abdo's post sets out a principle of separating trust from the model: the controls over access, actions and whether an agent keeps running should sit where the model can neither bypass nor tamper with them. TechCrunch reports that earlier this month Nadella argued on his personal blog that companies should rely on monitoring systems the AI labs do not control. Gallot's post sums up the division of labor in two sentences: "Agentic security provides speed. Practitioners provide judgment."
TechCrunch also reports that Microsoft joined Nvidia's Open Agent Safety Platform as one of its inaugural members, a platform backed by more than 100 other tech companies. The article calls the move both surprising and self-serving: Microsoft has invested in OpenAI and Anthropic, so it is casting doubt on some of its own business interests, while it also wants enterprises to buy agent security from it rather than from those labs. On availability, Gallot's post says organizations can start today with Project Perception. Abdo's post gives no availability date or pricing for the new features and invites readers to Microsoft Ignite on November 17-20, 2026. We covered why agent identity is a management problem of its own in our story on Cyera acquiring Oasis Security.
The sources say nothing about Türkiye, so this section is commentary
None of the three sources mentions Türkiye. There is not a line on when these features could be available in Türkiye, local pricing, a Turkish interface, a local partner or customers in the country. The coverage is a global product and architecture announcement from start to finish.
Our reading: coding agents that employees bring in themselves have started to touch corporate data, and that is not only a large-company problem. Starting agents with zero access, granting time-limited access and requiring human approval for high-impact actions form a framework small teams can apply without tying themselves to any one product.
The UNALSOFT view
We read this less as a product announcement and more as a design principle: when you set up an agent, write down first what it cannot do. Which data may it touch, whose approval does each action need, and when is it stopped? A written answer to those three questions is useful even if you never use Microsoft's tools. Our agentic AI service page explains how we build this framework into agent projects.
Have you written down what your agents cannot do?
A short call is enough to settle permission, approval and monitoring limits for your agent setup together.