Microsoft Unveils Guardian Agents to Monitor and Restrict Risky AI Agents

Microsoft introduced a set of security tools on October 19, 2026, aimed at watching and restricting the AI agents that employees run at work. The centrepiece is Guardian Agents, a monitoring capability that extends Project Perception, the agentic security system Microsoft introduced in June. TechCrunch reports that the company announced the tools in a blog post that day, and Help Net Security covered them the following day.

Microsoft’s central argument is that AI models cannot be relied on to police themselves. Hayete Gallot, the company’s security business chief, wrote that “frontier models, regardless of their origin, cannot be trusted.” She said the problem was not malice or ease of hacking. The concern is that models are unpredictable and are trained to finish tasks rather than to follow an organisation’s norms or judgement. Microsoft’s position is that oversight should come from a separate system rather than from the model providers.

The toolset goes beyond monitoring. Microsoft describes Dynamic Permissions, which gives an agent only the access a given task needs and only for as long as that task runs. Dynamic Agent Risk combines signals from identity, data, endpoints, cloud systems, networks and agent activity into a risk assessment that updates continuously. Dynamic Conditional Access responds to rising risk by blocking writes, narrowing access, requiring human approval or stopping execution, according to Help Net Security. The same report describes new playbooks that define security outcomes and coordinate protective actions.

Discovery is a second thread. TechCrunch reports that Microsoft Defender can now detect up to 60 types of agents that employees bring into the workplace, including Claude Code, OpenAI’s Codex and OpenClaw. Help Net Security names Claude Code, Codex and GitHub Copilot among the tools covered. Microsoft Agent 365, its control plane for deploying and governing agents, and Entra Agent ID, its identity system, are being extended to cover local agents and previously unknown agents found by security sensors.

Why it matters: many organisations already let staff run coding agents and automation tools without central oversight. A large vendor building controls into the security stack, rather than leaving them to model providers, suggests that enterprise buyers will expect agents to be governed much like privileged users. Microsoft also said it was an inaugural member of Nvidia’s Open Agent Safety Platform, which TechCrunch says more than 100 other technology companies support.

Some of the claims rest on the company’s own framing. Microsoft says the features limit an agent to the task it was approved for, but the coverage does not include any test results, error rates or case studies that show how often the automatic restrictions would trigger or whether they would block legitimate work. Independent testing of the controls has not been reported.

What is still unknown is when these features reach customers. Help Net Security says the reporting does not state whether the features are in preview, generally available or limited to certain customers, and no release timing was given. Pricing, licensing and the exact list of supported agent types are also not covered in the sources reviewed, so buyers should check with Microsoft before planning around any of these capabilities.