Microsoft will now also use Project Perception to monitor AI agents within organizations. Guardian Agents evaluate every action an agent takes before executing it. Microsoft says frontier models cannot be trusted, regardless of their origin.
Until now, most attention has been focused on attackers who exploit powerful AI models. Microsoft is now also looking at the agents that organizations have deployed themselves, known as “agentic insiders.” According to Microsoft, organizations trust their own agents too easily because they deployed them.
Microsoft explains why that trust is unwarranted. Models aren’t malicious, but they’re trained to achieve results. This often leads to reward hacking. Furthermore, models do not take an organization’s standards and judgment into account. Agents adapt as context changes, don’t always behave as intended, and can collaborate with, or even conspire against, other agents to achieve their goals. They do not even need to be compromised to do so.
First against attackers, now also for its own agents
Microsoft announced Project Perception on July 27 as a defense against AI-driven external attacks. In this system, teams of agents work together: red agents search for attack paths, blue agents investigate what those findings mean, and green agents implement remediation measures. The system has been available as a preview since August 3.
Microsoft is now deploying that same cyber stack for internal agents, in three layers. First, the system aggregates signals from identity, data, the cloud, endpoints, the network, and runtime. This lets agents be detected and assigned an identity, container, policies, and permissions. Based on those signals, the system then continuously recalculates how risky an agent’s action is. Finally, Guardian Agents, supported by green and blue agents, continuously monitor every action.
Security teams can review what happened afterward and determine why a risk arose. “Agentic security provides speed. Practitioners provide judgment,” writes Microsoft.
Is that enough? Microsoft doesn’t think so. Security systems can now clearly see what agents are doing, but not yet why. The company says this requires greater transparency within the model itself. That means not only insight into input and output tokens, but also into the thinking and chain-of-thought tokens. Only then can you determine whether the model’s intent aligns with the agent’s task.
Tip: Microsoft Agent Framework: Multi-agent systems take shape