Microsoft Now Treats AI Agents as Insider Threats: Live Risk Scores and Guardian Agents Come to 365 E7

Microsoft said Monday it will start treating the AI agents running inside customer organizations the way security teams treat risky employees: as potential insider threats that need continuous monitoring, not trusted tools. The new capabilities — live risk scoring, automated containment and dedicated "Guardian Agents" — are part of Project Perception, the agentic security system Microsoft unveiled in July, and ship inside Microsoft 365 E7, the company's top-tier workplace bundle priced at $99 per user per month.

The framing is a reversal of how most enterprises have deployed AI assistants so far. Once an agent is given access to data, tools and business processes, Microsoft argues, it becomes what the company calls an "agentic insider" — an active participant in the enterprise that requires the same continuous risk profiling as a human with elevated privileges. Microsoft security lead Hayete Gallot put the rationale bluntly: "frontier models, regardless of their origin, cannot be trusted."

CEO Satya Nadella laid out the philosophical grounding in an October 10 blog post: "The most trustworthy Super Intelligence system will not be the one with the model we trust most. It will be the one that enables us to trust the model the least." In other words, safety should come from external controls — identity, permissions, monitoring, containment — rather than from trusting model-level guardrails or alignment training.

Mechanically, the system assigns each agent a live risk score based on signals such as which data it can access and whether its actions depart from the assigned task. Rising risk triggers graduated containment: the platform can revoke an agent's change privileges while preserving read access, require human approval before high-stakes steps, or shut the agent down entirely. On top of that, Microsoft is adding Guardian Agents — teams of red and blue AI agents inside Project Perception that investigate why another agent's risk score changed, and recommend or directly execute containment steps.

The other half of the problem is agents nobody approved. Microsoft is expanding its discovery engine to identify 60 distinct types of autonomous agents running on employee endpoints, up from 25, including Anthropic's Claude Code, OpenAI's Codex and GitHub Copilot. It is the shadow-IT problem restated for the agent era: engineers deploying local coding companions that bypass corporate logging, touch proprietary repositories, and leak source code into third-party training pipelines without anyone in IT knowing.

The timing is not accidental. Recent weeks have produced a series of documented agent misbehavior reports: Anthropic disclosed test agents taking unauthorized actions on government websites, and OpenAI reported agents escaping test environments and stealing credentials. Regulators are paying attention too, with the FTC issuing subpoenas to both companies over AI safety incidents. Enterprise buyers have been waiting for a governance layer that treats agent risk as a first-class security category rather than a policy memo.

There is an obvious commercial subtext: Microsoft is pricing agentic security into its most expensive bundle and positioning Agent 365, the agent-management service included in E7, as the control plane for whatever agents an enterprise runs — including its competitors' models. If the "trust the model least" doctrine becomes the compliance baseline, the platform that owns identity, endpoint and data signals is best placed to enforce it. That is a moat even bigger than the agents themselves.