Microsoft Targets Rogue AI Agents With Dynamic Permissions, Risk Scoring

Microsoft on Monday announced new controls to monitor and restrict potentially rogue AI agents in enterprise environments, arguing that organizations should treat these agents as insiders rather than trusted software.

The capabilities extend Project Perception , the agentic security system Microsoft launched in July. Perception was initially pitched as a defense against AI-driven attacks from outside, but it is now being applied to the agents companies run internally.

Hayete Gallot, executive vice president of Microsoft Security, said companies tend to trust the agents they deploy by default. She warned that frontier models are trained to get results and aren’t built around organizational norms or judgment. “These agents are frequently overprivileged, have access to data, tools and systems and can take actions and make decisions in critical processes,” Gallot wrote.

Nadim Abdo, Microsoft’s corporate vice president of identity and network access, clarified the insider label. “This does not mean agents are inherently malicious. It means they are capable tools that can be granted access to important systems by users. They can make mistakes, be manipulated, or be compromised,” he explained.

One of the new features, Dynamic Permissions, gives agents no permissions, or the bare minimum, at the outset. Access is then granted per task and expires or shrinks as the task changes or ends, while high-impact actions require human review.

Dynamic Agent Risk gives each agent a risk score that is continuously updated, drawing on the agent’s activity as well as identity, data, endpoint, cloud, network and runtime signals. The score factors in the agent’s security configuration, the resources within its reach, how much damage it could do if something goes wrong, and whether it is straying from what the user or organization intended.

Dynamic Conditional Access, which brings Entra Conditional Access to agents, acts on those risk changes. Rather than simply allowing or blocking an agent, it can scale back its permissions, let it read but not write, limit the data and network resources it can reach, or require a person to approve consequential actions. If the risk climbs high enough, the agent’s runtime can be isolated or its execution halted.

To make this work at scale, Microsoft is introducing Playbooks and a team of Guardian Agents in Project Perception. Humans establish the rules and approval limits, Playbooks specify what the security response should achieve, and Guardian Agents execute it, looking into why an agent’s risk shifted and suggesting or enforcing containment.

Microsoft is also expanding discovery to 35 more types of local agents, bringing the supported total to 60, including Claude Code, OpenAI Codex and GitHub Copilot.

Related : Small AI Models Could Soon Self-Replicate on IoT Devices, Anthropic Warns

Related : AI Agents Navigate Unfamiliar OT Systems and Move Equipment in Minutes, Booz Allen Finds

Related : AI Turns Familiar Cyberattacks Into a Race Against Time

Eduard Kovacs (@EduardKovacs) is senior managing editor at SecurityWeek. He worked as a high school IT teacher before starting a career in journalism in 2011. Eduard holds a bachelor’s degree in industrial informatics and a master’s degree in computer techniques applied in electrical engineering.

More from Eduard Kovacs

Plex2Shell Exploit Chain Weaponized Against Plex Servers Hours After Disclosure

One Compromised Login Exposed Millions of California Students’ Records

MITRE ATT&CK v20 Catalogs AI Abuse, MFA Bypass, Water Utility Attacks

Anthropic Acquires Confidential AI Startup Opaque Systems

BAE Systems Security Incident Stalls Notices From US Bankruptcy Courts

OpenAI Models Hacked Data Portals, Raided a Crypto Wallet to Finish Tasks

Proofpoint Inks $6.3 Billion All-Cash Deal to Acquire Varonis

Supermarket Refrigeration Attack Widens to Copeland, Dixell Controllers

AOMEI Backupper Compromised in Short-Burst Supply Chain Campaign

The Key to AI Software Security Isn’t Speed, It’s Maturity

Ahold Delhaize Restoring Services Disrupted by Cyberattack

AI Platform Cairn Abused to Hack Over 100 Organizations

Ex-OpenAI Worker Accused of Bugging Conference Room Planned to Fly to Saudi Arabia, Prosecutors Say

Hackers Steal 1.8 Million Records From Nikkei

970,000 Medi-Cal Members Affected by Paradigm Healthcare Data Breach

Siemens Software Center Vulnerability Exploited in ClickFix Malware Attacks

Webinar: The AI Access Risk Already in Your Google Workspace

AI tools connected to Google Workspace can access millions of sensitive emails and files. Join this session to uncover your organization’s risk and learn a framework to manage AI access.

Virtual Event: CISO Forum 2026 Summit

Join as we bring together CISOs, senior cybersecurity executives, practitioners, industry experts, and other security leaders to practical experience and examine the issues shaping enterprise cybersecurity strategy.

Flipboard Whatsapp Whatsapp Email