Microsoft Says to Treat AI Agents Like Insiders

On 19 October Microsoft published a post called "Securing the agentic insider", arguing that the AI agents companies are rolling out should be treated like insiders: people-like users with access to real data, who should not be trusted by default. TechCrunch's report says Microsoft also announced new security features aimed at monitoring and limiting those agents.

Most of the product detail is aimed at large IT teams. The principle is not, and it applies to a five-person recruitment agency as much as to a bank.

What actually happened

The post, written by Hayete Gallot of Microsoft Security, says enterprise agents often have excessive privileges and can act on critical processes, so they should not be implicitly trusted. Microsoft's proposed approach is to give each agent an identity, a container, and policies and permissions, score its risk as it works, and use oversight agents ("Guardian Agents") to respond as risk rises.

According to TechCrunch, the announcements also include a Microsoft Defender feature that can find up to 60 types of AI agent that employees bring into the workplace, and controls that limit what data and systems an agent can touch and require human approval for risky decisions. TechCrunch quotes Gallot as saying frontier models "cannot be trusted", and says her point is unpredictability rather than malice: models are trained to complete tasks, not to follow an organisation's norms.

This follows comments earlier in October from Microsoft CEO Satya Nadella, who, according to TechCrunch, wrote that companies should not rely on AI providers' safety assurances alone. TechCrunch also notes that Microsoft sells security products and wants customers to buy oversight from Microsoft, so read the warning with that in mind.

What it means for a small business or recruiter

You probably do not run Microsoft Defender's enterprise tooling. But the underlying problem is the same: staff are already using AI tools you have not formally approved, and some of those tools can read files, send messages or take actions in other software.

For a recruiter, that might mean an assistant connected to a mailbox full of candidate CVs and client details. If it is given more access than it needs, or follows a malicious instruction hidden in an email, the damage can be real. The sensible approach is the one Microsoft describes for big companies: know which agents exist, give each the minimum access, and keep a person in the loop for anything risky.

What to do

1. List every AI tool your team uses, including free ones on personal accounts. Ask people; do not assume.
2. Cut each tool's access to the minimum. If an assistant only needs to draft emails, it does not need your whole file store or the ability to send on its own.
3. Require human approval for irreversible actions: sending to clients, deleting data, changing payment details.
4. Keep candidate and client data out of tools you have not checked. Know where each one stores and processes it.
5. Make it someone's job. One named person owns the list and reviews it every quarter.

If you want a starting template, our one-page AI use policy covers the basics.

The caveat

This is Microsoft describing its own approach and its own products, and it has a commercial interest in selling them. The primary post does not say which parts are in preview and which are generally available, so we cannot tell you what you can buy or switch on today. TechCrunch's figure of 60 detectable agent types comes from its report, and we did not see it in the Microsoft post we read. Nothing here shows agents are widely being turned against companies; the argument is about reducing risk before that happens.

Want help working out which of your tools should have access to what? Get in touch.