Microsoft says its new controls can contain risky AI agents—what do they actually cover?
The company has widened local-agent discovery and announced adaptive permissions and containment. Its own support matrix shows runtime blocking is still preview and much narrower than discovery.
The short version
- What happened
- Microsoft says Defender can now discover 35 additional local-agent types, bringing its documented total to 60, including Claude Code, OpenAI Codex and GitHub Copilot.
- Who it affects
- Employees may keep their own access while an agent receives narrower temporary authority; high-impact actions can be routed to a person for approval.
- What remains unproven
- All central claims come from Microsoft product announcements and documentation; no independent evaluation is supplied.
Keep in mind
All central claims come from Microsoft product announcements and documentation; no independent evaluation is supplied.
Discovery is activity-based; runtime protection is separate, narrower and documented as preview on Windows.
Microsoft reports no customer denominator, containment rate, false-positive rate, latency result or comparative benchmark.
Source analysis · 4 linked sources. Primary analysed source date: 19 October 2026. Earliest linked supporting source: 1 May 2026.
Read the full report · 3 min The evidence, methods, implications and limitations
Microsoft has added discovery and adaptive controls
Microsoft has extended Project Perception so AI agents can be managed as identities whose access changes while they work. In a 19 October announcement, the company said Defender can discover 35 additional types of local agent, taking the documented total to 60. The Windows list includes Claude Code, OpenAI Codex and GitHub Copilot. Discovery is activity-based: installation alone does not guarantee that Defender sees an agent.
Dynamic Permissions are meant to give an agent task-scoped, time-limited authority instead of a worker's full access. Dynamic Agent Risk combines signals from identity, endpoints, networks, cloud, data and runtime activity. Conditional Access can then block writes, narrow resources, require human approval, isolate the runtime or stop execution. Playbooks and Guardian Agents are intended to recommend or apply those responses under policies set by people.[1][2]
Why this matters for workers and security teams
For staff, the practical change could be a clearer separation between a person's permissions and an agent's temporary authority. Security teams may gain one registry and an automated containment path, but must decide which actions can proceed, which need approval and what evidence should stop an agent. Agent ID is available to Entra customers; Microsoft's agent-security extensions require Agent 365 licensing.[1][3]
The distinction that matters
Discovery and containment are different claims
Microsoft's own documentation shows a wide inventory layer and a narrower preview enforcement layer.
Discover
Observe agent activity and MCP configuration
Up to 60 documented local-agent types
Assess
Combine identity, data, endpoint and runtime signals
Dynamic risk and policy decision
Contain
Reduce access, require approval, isolate or stop
Preview coverage for fewer combinations
The support matrix sets a much narrower boundary
The total should not be read as 60 agents receiving the same blocking. Microsoft's matrix separates discovery from runtime protection. WSL discovery is preview and limited to three tools. Windows runtime protection is also preview: agent-native inspection lists six combinations centred on Claude and GitHub Copilot, while network inspection lists four applications and excludes certificate pinning and HTTP/3. Agent 365 itself became generally available on 1 May, so this is an extension rather than a new platform launch. Microsoft provides no deployment denominator, independent adversarial test, containment rate, false-positive rate or response-time result. Evidence of reliable containment across real enterprises still has to be published.[2][4]