Microsoft Warns Companies That AI Agents Could Become Insider Security Risks
Microsoft has issued a warning to businesses about the growing cybersecurity risks associated with artificial intelligence agents operating within corporate networks. The company says organizations should not automatically trust AI agents simply because they were deployed internally for legitimate business purposes. Instead, these systems should be treated as potential insider security risks and monitored continuously.
In a blog post published on October 19, 2026, Microsoft explained that AI agents are increasingly being used to perform tasks such as writing code, researching information, analysing business data, processing expenses and interacting with enterprise applications. Although these capabilities can improve productivity, they also create risks when agents receive broad access to company systems and sensitive information.
Microsoft's concern is that AI agents can make mistakes, respond to manipulated information or become compromised. Their behaviour may also change as they encounter new instructions or different operating conditions. As a result, an agent that initially operates within its intended limits may later attempt actions that conflict with an organization's security policies.
Why AI agents could become insider threats
Traditional insider threats generally involve employees or contractors who misuse legitimate access, either deliberately or accidentally. AI agents introduce a different challenge because software systems can now perform many actions independently while using permissions granted by an organization.
For example, an AI agent may be authorized to review financial records, process invoices or retrieve internal documents. If the agent receives more permissions than necessary, an error or manipulated instruction could lead it to access information or perform actions beyond the intended task.
Microsoft emphasized that AI systems are not necessarily malicious. The concern is that their decisions can be unpredictable, particularly when they interact with untrusted information or operate with extensive access to business resources.
The company argues that businesses should establish independent security controls around AI agents rather than relying on the AI model itself to determine whether an action is safe.
This approach is particularly important as organizations deploy increasing numbers of agents across departments, applications and cloud environments. Without proper oversight, companies may struggle to identify every active agent, determine who is responsible for it and understand which systems it can access.
Microsoft expands Project Perception
To address these concerns, Microsoft is extending its Project Perception security initiative to cover AI agents operating inside enterprise environments.
The initiative is designed to help security teams identify agents, understand their activities and respond to potential threats. Microsoft's approach combines information from identity systems, devices, networks, cloud services, data resources and agent activity to assess security risks.
The company says its expanded security framework is intended to provide a clearer picture of which agents exist within an organization, what permissions they hold and whether their behaviour remains consistent with their assigned tasks.
Microsoft is also developing ways to adjust an agent's access when its risk level changes. If an agent begins behaving suspiciously or attempts an action outside its authorized responsibilities, security controls could restrict its capabilities or isolate it when necessary.
The objective is to prevent a potentially unsafe agent from causing further damage while allowing other legitimate business activities to continue.
Dynamic Agent Risk and permissions
One of Microsoft's key additions is Dynamic Agent Risk, which assesses changes in an agent's security risk using information gathered across the enterprise environment.
The assessment can consider the agent's identity, permissions, access to sensitive data, device security, network activity and behaviour. This allows organizations to evaluate risk as an agent works rather than relying only on the permissions assigned when it was first created.
Microsoft is also introducing Dynamic Permissions to help organizations control what an agent can do during a particular task.
Under this approach, agents should receive only the permissions required for their assigned work. Those permissions can be limited to specific resources and time periods, reducing the risk associated with excessive or permanent access.
For example, an AI expense-processing agent may need to review reimbursement requests and compare them with company policy. It would not necessarily need unrestricted access to employee records, financial systems or unrelated business documents.
If the agent attempts an action outside its approved responsibilities, the system could block that action, narrow its access or require human approval before allowing a consequential operation.
Microsoft is also extending Adaptive Conditional Access to help adjust access decisions based on an agent's current risk and the organization's policies.
Guardian Agents to monitor AI activity
Microsoft has also highlighted Guardian Agents, which are intended to help security teams monitor and manage the activities of other AI agents.
These systems are designed to support continuous supervision, investigate changes in risk and coordinate protective responses. They may help security teams understand why an agent's risk level has increased and determine whether additional restrictions are required.
The approach reflects the growing need for automated cybersecurity operations. As businesses deploy large numbers of AI agents, manually reviewing every action may become difficult for security teams.
Guardian Agents are intended to help carry out monitoring and response activities at machine speed, while operating within rules and approval boundaries established by people.
Microsoft says organizations should retain control over security policies and consequential decisions. Automated systems can assist with detection and containment, but they should not be allowed to bypass the controls designed to govern their behaviour.
The importance of identity and least-privilege access
Another major part of Microsoft's strategy is ensuring that every AI agent can be identified and managed separately from the employee who uses or sponsors it.
When agents operate through shared or inherited user credentials, it can be difficult for security teams to determine whether an action was performed by a person or an automated system. Assigning agents distinct identities can improve accountability and help organizations trace their activities.
Microsoft is extending its Microsoft Entra Agent ID capabilities to support additional agent types and improve their visibility within corporate environments.
The company also recommends following the principle of least privilege. Under this principle, an agent should receive only the access necessary to complete its approved task, rather than inheriting all the permissions available to its human sponsor.
Additional safeguards include controlled execution environments, monitoring interactions with external tools, protecting sensitive information and requiring verified human approval for high-impact actions.
These measures can reduce the potential consequences of errors, manipulated instructions and compromised agent systems.
What businesses should do
Microsoft's warning highlights several practical steps that organizations can take as they introduce AI into their operations.
Businesses should maintain an inventory of deployed agents, assign clear ownership and review the permissions granted to each system. They should also monitor agent activity, restrict access to sensitive data and establish procedures for stopping or isolating agents that behave unexpectedly.
Security teams should evaluate the risks associated with third-party tools, connected applications and external information sources. They should also maintain audit records so that suspicious actions can be investigated and traced.
Companies can continue using AI agents for productivity and automation, but their deployment should be accompanied by appropriate security policies, testing and human oversight.
Balancing AI innovation with security
AI agents are becoming an increasingly important part of enterprise technology, offering businesses new ways to automate routine work and improve decision-making. However, the same ability to interact with systems and perform tasks independently can create additional security challenges.
Microsoft's latest announcements underline the importance of treating AI agents as distinct digital identities that require monitoring, limited permissions and continuous risk assessment.
The company's expanded Project Perception initiative, Dynamic Agent Risk capabilities and Guardian Agents are intended to help organizations manage these challenges as AI adoption grows.
The central message is that businesses should not assume an AI agent is safe simply because it operates within their own systems. Security controls must independently determine what each agent can access, which actions it can perform and when its permissions should be restricted.
As organizations expand their use of AI, effective governance and cybersecurity will be essential to ensuring that automation improves productivity without creating unnecessary risks to company data, applications and operations.
Source: Microsoft's official security announcements published on October 19, 2026.
