Overview
Microsoft is expanding Project Perception to treat AI agents running inside an organization as potential insider threats. The update, announced around October 19, 2026, adds Guardian Agents: AI agents that continuously watch and control the behaviour of other agents. Dark Reading reports that experts are skeptical, warning that policing unpredictable agents with more agents could multiply risk rather than contain it.
What Microsoft Announced
- Guardian Agents monitor other agents around the clock, assess risk in real time, and intervene when an agent does something potentially harmful. They can narrow an agent's permissions or require human sign-off before an action proceeds.
- Playbooks let humans define the desired security outcomes and approval limits; Guardian Agents carry them out.
- Discovery and identity: Perception can find agents running in an environment, assign identities and permissions, and score their risk continuously. Support grows by 35 local agent types, to 60 in total, and Entra Agent ID is being expanded so agents get identities separate from their human sponsors.
- Containment: Anomalous agents can have access cut off, using zero-start dynamic permissions and staged responses that can halt execution.
- Unified view: Guardian Agents share signals and a registry with Microsoft Agent 365, so IT and security teams see one picture of agent activity.
Project Perception launched in July as a defence against external AI-driven attacks; Microsoft is now pointing it at agents companies run themselves. Pricing and general availability dates were not disclosed.
The Criticism
Microsoft's Nadim Abdo says "agentic insider" does not mean agents are inherently malicious, only that they are capable tools users can grant access to important systems. Critics counter that:
- Guardian Agents are themselves non-deterministic and can be fooled or misconfigured.
- Layering agents to supervise agents adds attack surface and new failure modes.
- Concentrating discovery, identity and enforcement in a single vendor stack increases dependence on that stack.
What Security Teams Should Do
- Inventory every AI agent, including local coding and desktop agents, and who sponsors each one.
- Give agents their own identities and least-privilege, short-lived permissions rather than inheriting a user's access.
- Require human approval for destructive or high-value actions.
- Log agent actions to your SIEM independently of any agent-based monitoring.
- Treat supervising agents as untrusted components and test them like any other control.