Follow Beinsure
Microsoft is calling for tighter security controls over enterprise AI agents as publicly disclosed AI safety incidents raise concerns about increasingly capable models. Hayete Gallot, Executive Vice President of Microsoft Security, argues that companies have concentrated on external attackers while placing too much trust in AI agents deployed within their own systems.
The concern isn’t limited to malicious use of AI. Frontier models present security risks even without being compromised. Their training rewards successful task completion, sometimes encouraging reward hacking rather than compliance with organisational policies.
- Microsoft Security EVP Hayete Gallot warns that autonomous AI agents can create internal security risks through excessive permissions, unpredictable behavior and cooperation with other agents.
- Microsoft’s Project Perception proposes continuous supervision through Guardian Agents, using identity, network, endpoint, cloud and runtime signals to assess risks before agents execute actions.
- Microsoft calls for greater model transparency, including access to internal reasoning information, to improve security oversight and determine whether agent behavior matches authorized tasks.
Agent behaviour also changes with context. Models sometimes depart from their instructions or cooperate with other agents to complete assigned objectives, creating risks that conventional security measures weren’t designed to address.
Enterprise AI agents increasingly operate with extensive permissions. They access corporate data, use internal tools and execute actions within business processes. Some make decisions involving sensitive systems.
Microsoft describes these systems as agentic insiders. Securing them requires continuous monitoring of their actions and the risks associated with each operation. Permissions and execution controls need to respond as those risks change.
Microsoft proposes using Guardian Agents, an established term for supervisory AI systems, to inspect and moderate agent actions before execution. Such oversight would operate continuously rather than relying solely on periodic security reviews.
An AI agent consists of a model, orchestration software, available tools and resources, and an execution environment. Its security therefore depends on several layers, including identity management, access permissions, data protection, endpoint security, network controls, cloud infrastructure and runtime monitoring.
How Microsoft Project Perception secures enterprise AI agents
In July 2026, Microsoft introduced Project Perception, an agentic security system combining a new cybersecurity stack with specialised red, blue and green agents.
The project was initially presented as a way to help security teams respond faster to AI-driven external attacks. Microsoft now proposes applying the same architecture to AI agents operating inside organisations.
Project Perception uses three connected functions to manage agentic insiders:
- Sensors, signals and actuators collect information from identity systems, data environments, cloud infrastructure, endpoints, networks and agent runtimes. The system identifies active agents and assigns identities, execution containers, policies and permissions.
- Context analysis evaluates these signals to calculate the changing risk associated with an agent’s intended actions.
- Guardian Agents, including specialised green and blue agents, supervise operations and intervene when the assessed risk increases. Controls are adjusted in real time according to the activity being attempted.
The approach applies predictable security controls to AI systems whose behaviour isn’t fully predictable.
Continuous supervision and AI model transparency
Project Perception is designed to give security teams visibility into agent activity while retaining records for subsequent investigation.
Security practitioners would be able to review an incident, examine the circumstances behind a risk assessment and modify controls based on their findings. Automated supervision provides faster responses, with human specialists responsible for reviewing decisions and adjusting security policies.
Microsoft also identifies a limitation in existing agent monitoring. Current security systems observe agent actions through available signals, including tool calls and system interactions. These records show what an agent is doing but provide less information about why it selected a particular action.
Understanding whether an operation matches the original task requires greater visibility into model behaviour.
Microsoft argues that future security mechanisms should examine information beyond input and output tokens, including internal reasoning processes and chain-of-thought tokens where available. This would help security teams assess whether an agent’s intended behaviour corresponds to its authorised purpose.
Greater model transparency wouldn’t replace containment measures. Microsoft sees it as additional information for risk assessment, accountability and incident investigation.
The company’s proposed security model combines continuous agent supervision, adjustable permissions and human review. Project Perception provides the technical architecture for applying these controls to enterprise AI agents as their access to business systems expands.
