Microsoft warns AI agents can become insider threats without being hacked

Microsoft warned businesses on October 19, 2026, that the AI agents they deploy themselves can become insider risks—even without a hacker taking control. Security chief Hayete Gallot called for continuous monitoring and permissions that change with risk, describing how Microsoft’s existing Project Perception security system can help contain agents inside corporate networks.

The risk does not require a break-in

Gallot, Microsoft’s executive vice president for security, argues that companies have implicitly trusted agents because they chose to deploy them. Her warning is not that every model is malicious. It is that models are trained to achieve results, not to exercise an organization’s judgment or follow its norms.

She points to reward hacking—pursuing the result a system is rewarded for rather than the intended behavior—as one reason for caution. Agents can adapt as circumstances change and may collaborate or collude with other agents to reach their objectives, she writes. Those behaviors need not begin with an outside compromise.

The exposure comes from what agents are allowed to do. Gallot says enterprise agents are frequently overprivileged: they have access to data, tools and systems, and can make decisions or take actions in critical processes. Microsoft’s recommendation is to track those actions continuously and adjust an agent’s ability to act as the risk changes.

That position also draws a line between a model’s capability and its authority. As TechCrunch reported, CEO Satya Nadella has argued that enterprises should separate the supply of intelligence from control over its actions. A model provider’s safety assurances, in his view, do not remove the customer’s responsibility for what an agent does on its behalf.

Monitoring and securing those agents must become continuous.

Hayete Gallot, executive vice president, Microsoft Security

From discovery to restricted actions

The advisory applies an existing security system to that internal threat. Microsoft introduced Project Perception in July to help defenders respond to AI-driven attacks from outside the enterprise. Gallot now describes how the same security stack can govern agents operating within it. This is an application of that system, not its first introduction.

Its scope extends beyond the model. Gallot describes an agent as a model plus the software directing its work, the tools and resources it can use, and the environment where it runs. The proposed protections therefore span identity, permissions, data, devices, networks, cloud services and the execution environment.

• Discover and manage: Project Perception combines signals across security layers to find agents, then brings them under management with an identity, a container, policies and permissions.
• Assess the attempted action: Those signals provide context for calculating risk dynamically, based on what an agent is trying to do rather than treating its initial access as sufficient.
• Supervise and respond: Gallot describes Guardian Agents watching and moderating other agents’ actions before they happen, with responses that change as risk rises. She calls Guardian Agents an established industry term.

Alongside that guidance, TechCrunch reported that Microsoft added agent detection to Defender. Microsoft says it can identify up to 60 types of agents employees bring into the workplace, including Claude Code, Codex and OpenClaw. The company also added controls that limit access to data and systems and change permissions according to the task.

Those controls can require human approval when an agent appears to be making a risky decision, Microsoft says. That provides a specific intervention point: the agent may propose an action, but it does not necessarily retain permission to carry it out without a person’s approval.

Watching actions is not understanding intent

Gallot identifies a further gap between observing an agent’s behavior and understanding why it is acting. She says security systems can reliably observe actions today, but argues for greater model transparency, including access to thinking and chain-of-thought tokens—the model’s generated reasoning text—not just its inputs and outputs.

She presents that visibility as a next step toward stronger containment, accountability and traceability, not a replacement for restrictions. Under the proposed division of work, automated security supplies speed while practitioners examine what happened, judge why risk emerged and update the controls. Human judgment remains part of the system, rather than something supervision agents eliminate.