AI agent security is becoming an internal company problem as well as a defence against outside hackers. In a 19 October 2026 essay, Microsoft warns that autonomous software given access to emails, documents and business tools can behave like an insider with extensive permissions. An agent need not be controlled by a criminal to create a risk: mistakes, misread instructions or unexpected attempts to finish a task may be enough.
Microsoft security executive Hayete Gallot calls these systems agentic insiders in the company’s published argument. She says organisations should identify agents, restrict their permissions, watch their actions and intervene before an unsafe step occurs. This is Microsoft’s security position and proposed approach, not independent proof that every agent is dangerous or that its own products eliminate the threat.
Why AI agent security differs from a normal chatbot
A conventional chatbot generally responds with information for a human to consider. An AI agent may also be allowed to send messages, update records, search internal systems, trigger workflows or make changes through connected software. That makes an important difference. A wrong answer can be corrected before anyone acts on it; an agent with permission to act might have moved money, shared information or changed a record before the mistake is noticed.
Security teams have long worried about employees who receive broader access than their role requires. The same principle applies to software, but the agent may be able to move quickly across many connected applications. It can also encounter instructions hidden in documents or messages, which create a different route for manipulation from an ordinary login attack.
Consider an agent instructed to organise supplier invoices. Its legitimate job might require reading a folder and entering approved information into an accounting system. It does not follow that the agent should be able to export the entire customer database, approve bank details or send confidential reports to an unfamiliar address. The sensible control is to design access around the particular job rather than around everything a human administrator can do.
This distinction echoes earlier discussions of human supervision of AI agents and the possibility of agents exposing business data. The new Microsoft article frames those concerns as a standing operational security challenge, rather than a one-off demonstration of a badly behaved model.
Microsoft wants guardians watching the agents
Gallot argues for systems that can observe what an agent is trying to do, assess the risk in context and limit or block actions when appropriate. She describes guardian agents as part of this direction and points to Microsoft’s wider Project Perception security work. Monitoring alone is not enough if the software can take an irreversible action before anyone notices.
The company’s technical guidance for Microsoft Agent 365 describes identity and access control, data restrictions, detection of suspicious activity and centralised visibility. It identifies risks including too many agents operating without clear oversight, agents receiving excessive permissions, misuse of authorised tools and prompt injection. The documentation also makes clear that much of the control sits in existing identity, security and data-governance services.
For a non-specialist manager, this translates into an inventory: know which agents exist, who is responsible for each one, what information they can see and what systems they may change. A human owner should be able to stop an agent, review logs and reverse an action where the system permits it. Particularly sensitive steps, such as changing payment instructions or exporting personal data, justify explicit checkpoints.
Security controls also need to distinguish reading from acting. Giving an agent permission to examine a report does not necessarily justify allowing it to modify the report, delete a record or distribute a copy outside the organisation. For tasks with financial consequences, a staged approval model can preserve much of the administrative benefit without handing over final authority. The challenge is deciding which steps are genuinely low risk and which require human confirmation. Microsoft’s warning is a reminder that these boundaries are product and management decisions, not qualities guaranteed by a more capable model.
Microsoft’s proposal includes continuously adjusting permissions according to context. That sounds useful, but a safety mechanism of this kind must itself be evaluated. Alerts can be wrong, restrictions can disrupt ordinary work and another automated system may misinterpret an agent’s intent. Human judgement, well-designed approvals and careful testing remain necessary rather than becoming optional extras.
The uncomfortable question is who authorised the risk
The real security decision begins before an agent sends its first email. Someone chose the software, connected the tools, gave permission and decided which tasks could run unattended. If those decisions were careless, a model might faithfully pursue its assigned objective while crossing boundaries that no one thought to specify. Blaming an unpredictable model after the fact does not settle responsibility.
For companies already experimenting with autonomous workflows, the immediate useful step is a permissions review. Agents that read public information should not inherit the credentials used to administer finance or human-resources systems. Temporary access should expire, and changes to the agent’s instructions or capabilities should prompt another risk assessment. The operational disciplines are familiar even if the software is new.
The debate over an emergency stop for autonomous AI is especially relevant when tools can take consequential actions. A visible off switch is valuable, but it is not enough if managers cannot reconstruct what the software did earlier. Audit trails, clear owners and carefully limited access matter before, during and after deployment.
Microsoft is selling tools into this market, so its proposed remedy should be viewed in that commercial context. Nonetheless the underlying question is concrete: would a company give a new junior employee unrestricted access to every sensitive system simply because they seemed helpful? An AI agent should not receive that trust by default either.
About the Author
Stuart Kerr is Technology Correspondent at LiveAIWire, covering artificial intelligence, cybersecurity and the social impact of emerging technology. LiveAIWire is an independent, human-led technology publication using AI-assisted research, editorial production and original AI-assisted editorial illustrations under his direction.