Microsoft has called for the deployment of AI security agents to monitor and control other AI agents operating within enterprises, warning that autonomous systems can pose insider threats even when they have not been compromised.
In a blog post, Hayete Gallot, Executive Vice President of Microsoft Security, said enterprises could no longer assume that AI agents would behave as intended simply because their organisations had deployed them.
“Frontier models, regardless of their origin, cannot be trusted,” Gallot wrote, arguing that AI agents can act unpredictably, exploit weaknesses in their operating environments and collaborate with other agents to achieve their objectives.
Microsoft is proposing the use of Guardian Agents to monitor and moderate the actions of AI agents before they are executed. The approach would assess risks in real-time and adjust an agent’s ability to act based on its behaviour and permissions.
Gallot said AI agents have become active participants in enterprise operations, with access to organisational data, tools and systems. Many are also overprivileged, potentially allowing them to take actions or make decisions in critical business processes.
“They are agentic insiders,” she wrote.
Microsoft plans to apply its Project Perception security system, announced in July, to manage and govern AI agents operating within enterprises. The system uses AI agents to help security teams defend against cyberattacks and respond to threats.
Under the proposed approach, organisations would first identify AI agents operating across their environments and bring them under centralised management. Each agent would receive an identity, a container, and a defined set of policies and permissions.
The system would then combine signals from identity, data, cloud, endpoint, network and runtime environments to assess the risks associated with an agent’s intended actions.
A team of Guardian Agents, including green and blue agents, would supervise these actions and intervene when an agent’s risk profile increases, according to Gallot.
The approach aims to place deterministic security controls around AI systems whose behaviour is not always predictable.
“Agentic security provides speed. Practitioners provide judgment,” Gallot wrote, arguing that automated systems could help security teams respond at the pace of AI-driven threats while leaving decisions requiring human judgement to security professionals.
Gallot also called for security systems to examine not only what an AI agent does but why it takes a particular action.
Current security systems can observe agent activity, but understanding whether an action aligns with the task assigned to an agent remains a challenge, she said.
Microsoft wants greater transparency into models, including information beyond their inputs and outputs, to help security systems assess whether an agent’s behaviour matches its intended purpose.
“Model transparency will not replace containment. It will make containment smarter and stronger,” Gallot wrote.
She argued that this additional visibility could improve accountability and help security teams understand how risks emerge, while reinforcing the need for controls that can restrict an agent’s actions.
The proposal comes as enterprises deploy AI agents to handle tasks across business functions. Microsoft argues that organisations must treat these systems as potential sources of internal risk, rather than focusing exclusively on external attackers using AI to breach corporate networks.
.