Microsoft expands Project Perception to monitor, contain rogue AI agents inside enterprises

As the focus shifts from a spate of rogue AI agent incidents to improving AI safety, Microsoft has outlined a new approach centred on securing agents as insiders.

The Windows-maker on Monday, October 19, announced new capabilities in Microsoft 365 E7, including Agent 365, and ‘Project Perception’ that are designed to continuously understand what agents are doing, what they can access, and whether they can still be trusted as their behaviour and risk change.

With the new Dynamic Agent Risk capabilities, organisations will be able to assess each agent’s changing risk based on signals across identity, data, devices, cloud, network, and agent activity.

Additionally, Dynamic Agent Permissions and Adaptive Conditional Access operate on Zero Trust, meaning that it dynamically limits what an agent can access and do based on its task, current risk, and company policy. It can be used to contain a risky agent without locking out the employee, Microsoft said.

For 24/7 defence, Microsoft said it has upgraded its Project Perception stack with new playbooks and ‘green agents’ that can reason across changing risk and coordinate protective actions at machine speed, within policies and guardrails set by security teams.

The announcement comes days after Microsoft CEO Satya Nadella called for putting an emergency brake in AI models, amid mounting safety concerns fuelled by a growing list of incidents involving AI agents behaving in unintended ways.

Nadella also laid out his views on the dangers posed by highly advanced AI models and how to tackle those risks. Timely incident disclosure, independent audits, verifiable data, and containment were some of the key recommendations outlined by the chief executive.

Story continues below this ad

“We can’t treat Super Intelligence as a set of nested black boxes and simply accept or reject its recommendations, answers, and actions,” Nadella wrote, adding that it was time to “to step back and assess the trust architecture” of AI.

With Project Perception and other agentic security features, Microsoft is looking to bolster trust among enterprises concerned about the lack of full visibility and control over AI agents.

“Unfortunately, frontier models, regardless of their origin, cannot be trusted. This is not because models are inherently malicious. Models have been trained to attain results, which often leads to reward hacking, and models are not optimized around organisational norms or judgment,” Hayete Gallot, executive vice president, Microsoft Security, said in a blog post.

“Agents are unpredictable. They will adapt as the context changes, may not behave as intended and will collaborate and collude with other agents to reach their objectives, without needing to be compromised,” Gallot added.

Story continues below this ad

What is Project Perception?

Microsoft’s security approach involves deploying ‘Guardian Agents’ that can watch and moderate every action of every agent 24/7. It can work across multiple layers, including identity, permissions, data, endpoints, network, cloud, and runtime.

First announced in July 2026,  Project Perception is an agentic security system that uses teams of red, blue, and green agents to help defenders act with speed, while simultaneously defending against AI driven attacks from outside of the enterprise, according to Microsoft.

The guardian agents can respond as the risk increases in real time. (Image: Microsoft)

To contain AI agents, Project Perception looks to implement the following deterministic controls on their behaviour:

-Sensors or signals: Signals across the various sensors (identity, data, cloud, endpoint, network, runtime) are used to discover agents in the enterprise and bring them under management by assigning an identity, container, and set of policy and permissions.

Story continues below this ad

-Context: These signals are used to dynamically compute the risk associated with what the agents are attempting to do.

-Dynamic Agent Risk: Based on the computed risk, a team of ‘green’ and ‘blue’ agents, actively and continually supervise every action of every agent and can respond as the risk profile increases, in real time.

Under Project Perception, Microsoft further said that the team of guardian agents can “supervise in real time while providing traceability for practitioners to examine what happened, understand why the risk emerged, and apply the judgment needed to update their security system accordingly.”