Microsoft Has a Strategy to Secure AI Agents

Microsoft is addressing the recent explosion in AI safety risks by formalizing its strategy to protect its customers. It’s surprisingly straightforward: You cannot trust AI.

“Frontier models, regardless of their origin, cannot be trusted,” Microsoft executive vice president Hayete Gallot writes. “This is not because models are inherently malicious. Models have been trained to attain results, which often leads to reward hacking, and models are not optimized around organizational norms or judgment. Agents are unpredictable. They will adapt as the context changes, may not behave as intended and will collaborate and collude with other agents to reach their objectives, without needing to be compromised.”

This thinking was first expressed publicly by Microsoft CEO Satya Nadella earlier this month in a post to his Scratchpad blog. In that post, he noted that we can’t treat AI as a set of nested black boxes and simply accept or reject its recommendations, answers, and actions. Instead, we need purpose-built systems so we can observe, limit, and contain any actions that AI takes on our behalf.

Put another way, frontier AI models and the agents that run against them will be treated as insider risks. And to address this issue, Microsoft is extending Project Perception, its agentic security system, to secure these insider risks by surrounding AI, which is non-deterministic, with deterministic controls, independent evidence, and containment boundaries. This system has to run across an organization’s identity, permissions, data, endpoints, network, cloud, and runtime assets, and it has to know which agents exist, who owns them, why they exist, and what they do. Each agent will be contained to control what it can access before it goes live, and the system has to adapt as behavior, context, and risk change.

This work is in keeping with Microsoft’s Zero Trust initiatives, but it will require significant effort across the stack. Microsoft is introducing Dynamic Permissions to prevent agents from obtaining privileges the user doesn’t have, Dynamic Agent Risk to continuously evaluate the risk each agent poses, and Dynamical Conditional Access to extend Microsoft Entra Conditional Access for agents. It’s also adding Playbooks–for defining desired security outcomes–and teams of Guardian Agents that monitor AI agents to Project Perception.

Microsoft will discuss these changes further at Ignite 2026 in November, but you can learn more now on the Microsoft Security website. I’m curious how this work will extend to individuals using Copilot and Autopilot in Windows 11.