Microsoft: Treat Your AI Agents as Insider Risks

On October 19, 2026, Microsoft published two posts arguing that AI agents should be treated as insider risks: tools with access to data and systems that can make mistakes, be manipulated or be compromised. The new controls target large enterprises, but the core rule works for any business: an agent gets only the permissions its task needs.

What we know

  • The posts: "Securing the agentic insider," by Hayete Gallot, executive vice president of Microsoft Security, on the official Microsoft blog; and "Agents are your newest insiders," by Nadim Abdo, corporate vice president for identity and network access, on the Microsoft Security Blog. Both are dated October 19.
  • The argument: Gallot writes that frontier models cannot be trusted, whoever builds them. Not because they are malicious, but because they are trained to get results and can take shortcuts an organization would not accept. She adds that agents are often given more access than they need.
  • The principle: Abdo's post cites Microsoft CEO Satya Nadella: separate the supply of intelligence from the authority over it. The controls on what an agent can read or do must sit outside the model, where the agent cannot bypass them.
  • What Microsoft announced: according to Abdo, discovery now covers 35 more types of local agents, 60 in total, including Claude Code, OpenAI Codex and GitHub Copilot. Microsoft is also adding agent identities in Microsoft Entra Agent ID, task-scoped and time-bound permissions (Dynamic Permissions), verified human approval for higher-impact actions, a risk score that updates while the agent works, and "Guardian Agents" in Project Perception, the security system it introduced in July.
  • Microsoft's example: an expense-approval agent should read submissions and approve routine claims, but not inherit every permission of the employee who uses it. If it reads an outside document with hidden instructions (prompt injection) and tries something unrelated, the system should remove its write access and require human approval.
  • What the posts leave out: neither gives availability dates, pricing or license requirements.

What changes and what doesn't

Small businesses have no new tool to switch on today. These are enterprise products for Microsoft security customers, and the posts do not say when the new features will be available. What changes is the message: one of the largest business software vendors now says in writing that a good model is not a reason to give an agent broad access. Safety has to come from the permissions you grant, not from trusting the model.

It is not a warning about one product either. Microsoft lists its own GitHub Copilot among the agents it detects.

How to tell if this affects you

It does if anyone in your business uses an AI agent (Claude Code, Codex, Copilot or another) with access to your website, hosting, content management system, email or Google accounts. Seven checks that cost nothing:

  1. Make a list. Which agents are in use and what they can reach: code repository, hosting panel, WordPress or Drupal, Search Console, ad accounts, email. Microsoft puts this first: you cannot protect what you cannot see.
  2. Give each agent its own account and its own keys. Not your admin login. That way you can tell what the agent did from what you did, and cut it off without changing your own passwords.
  3. Start with no permissions and add only what the task needs. Drafting posts needs an editor account; reviewing code needs read access to the repository, not access to the live server.
  4. Set expiry dates on API keys and tokens you hand over, and revoke them when the task ends.
  5. Require your approval before anything irreversible: publishing, deleting, changing DNS, paying, or emailing customers. If your tool has a mode that asks before running commands or editing files, keep it on for anything that touches production.
  6. Distrust text the agent reads from outside. A web page, an email or a PDF can carry hidden instructions; it is the case Microsoft uses to explain why risk changes mid-task.
  7. Keep a trail. Check the change history of your CMS, repository and hosting so you know what the agent touched if something goes wrong.

Related: AI Agents Got In With Exposed Keys: CERT-In's Warning

Sources

Updates: if Microsoft publishes availability dates or license requirements, they will be added here with a link.