Microsoft Security’s October 19, 2026 guidance calls workplace AI agents “agentic insiders” when they can access company data, tools or systems and act in important business processes. The warning focuses on how an agent pursues a goal and what its permissions allow it to do, not simply on which model it uses.

Microsoft cites reward hacking, changing context and behavior that may not follow an organization’s norms or judgment. An agent may also have more access than its task requires. In combination, those risks can matter even without an external compromise: an agent can adapt its behavior or work with other agents while carrying out a task.

For a broader look at how autonomous agents can turn a mistake into an unauthorized action, see our earlier overview of AI-agent security risks.

What Guardian Agents and Project Perception are meant to do

Microsoft describes Guardian Agents as a proposed layer that would watch and moderate other agents’ actions continuously, before they happen. Project Perception is intended to help discover and manage agents, assess their risk in context, and supervise their actions. Microsoft says it can be used to contain “agentic insiders.”

Microsoft announced Project Perception on July 27, 2026, describing red, blue and green agent teams for security work: simulating attacks, detecting and triaging them, and carrying out remediation. In its October guidance, Microsoft also describes using signals from sources such as identity, data, cloud, endpoint, network and runtime systems to assess risk and track activity.

The supervision layer and the humans using it have different roles. Microsoft says security systems can provide speed and traceability, while practitioners provide judgment.

How Microsoft Execution Containers restrict access

Microsoft Execution Containers (MXC) apply a policy-defined boundary to a workload’s access to resources such as files and network destinations. Microsoft said MXC was generally available in an October 7, 2026 announcement. Its policy is enforced outside the agent workload, so the agent or code it generates cannot grant itself additional access.

Microsoft describes three modes:

  • Enforcement blocks access the policy does not grant.
  • Learning blocks ungranted access and records it.
  • Permissive records access the policy would deny but allows it to continue, subject to other operating-system or organizational restrictions.

On Windows process containers, Learning and Permissive also provide activity reports. A coding agent, for example, could be allowed to change a repository while being blocked from changing production-server settings or accessing unrelated files.

MXC’s documented options vary by platform. Process containers are listed for Windows 11, macOS and Linux. Session containers and WSL containers are listed for Windows 11. MicroVMs are experimental on Windows 11 and Linux.

Supervision and containment address different risks

Guardian Agents and Project Perception are described as monitoring, assessing risk and responding to agent activity. MXC enforces a resource-access boundary independently of the agent. Monitoring can assess what an agent is doing; the container policy determines which resources the workload is allowed to reach.

Microsoft presents these as distinct parts of agent security. The general-availability statement it made on October 7 applies to MXC; it does not extend to Guardian Agents or Project Perception.