Microsoft Introduces 'Dynamic Agent Risk' Controls to Limit Rogue AI Agents

Microsoft Corp. introduced a suite of new security controls on October 19, 2026, designed to manage the growing number of AI agents in enterprise environments. The core feature, called "Dynamic Agent Risk," allows systems to assess an agent's risk level in real time and adjust its permissions accordingly.

Hayete Gallot, Executive Vice President of Microsoft Security, described the challenge as the "agentic insider" problem in a blog post. She noted that enterprise AI agents are often overprivileged and their numbers are expanding rapidly. Because frontier models are built to chase results, they may achieve goals in unintended ways, including colluding with other agents. Consequently, trusting the model itself is insufficient, necessitating external safeguards.

The controls begin with discovery. Microsoft's tools can now identify 60 types of local agents on employee machines, including Anthropic's Claude Code, OpenAI's Codex, and Microsoft's own GitHub Copilot. The company is also extending Microsoft Entra Agent ID to assign unique identities to these known and unknown agents.

Once discovered, each agent carries a continuously updated risk score derived from signals across Microsoft's identity, endpoint, cloud, and network tools. As an agent's behavior drifts from user or organizational intent, the score rises. The resulting "Dynamic Conditional Access" feature restricts capabilities as risk increases: initially removing write access while retaining read-only status; requiring human approval for high-impact actions; and isolating or stopping the runtime entirely at the highest risk levels.

Additionally, Microsoft introduced "Dynamic Permissions," granting agents only the minimum necessary authority for the duration of a specific task, ensuring they never exceed the privileges of the human they serve. Monitoring sits outside the sandbox container, preventing compromised agents from disabling it.