AI agents are taking too many liberties. Microsoft’s new safeguards
Following the cases documented by Anthropic and OpenAI, time-limited access, continuous monitoring and systems to halt corporate assistants are now being introduced. For Nadella, security must remain outside the control of the models.
In recent days, Anthropic has documented instances in which Claude, during evaluations and internal use, circumvented restrictions and submitted a sensitive form to a live website. The impact, the company points out, was minimal. OpenAI has described agents that bypassed access controls and used credentials exposed online during training and testing. The risk is that, in order to complete a task, the software might find a shortcut that nobody had authorised.
It is in this context that Microsoft has announced new safeguards for business agents. Satya Nadella outlined the rationale behind this in a speech on 10 October: treating models as potential internal risks, as they may make mistakes or be compromised. Controls must be located outside the model, where it cannot alter them. Microsoft’s senior management notes that the manufacturer’s assurances do not relieve companies of their own responsibilities.
What’s new?
Essentially, Microsoft is responding with new security measures for business agents, as part of Microsoft 365, Agent 365 and Project Perception. The first new feature, Dynamic Permissions, grants agents only the access rights necessary for their task and for a defined period. An assistant responsible for checking expense claims should not inherit all the permissions of the finance director. Permissions may be restricted or withdrawn when the task changes.
Dynamic Agent Risk continuously reassesses risk based on behaviour and context. Dynamic Conditional Access translates this assessment into actions: blocking a change, restricting access to data, requesting human approval or stopping the agent.
It is also important to know how many assistants are in use within the organisation. Microsoft is extending detection to 35 additional types of local agents, bringing the total to 60, including Claude Code, OpenAI Codex and GitHub Copilot. It is also expanding Entra Agent ID to assign distinct identities and make it possible to identify responsible parties, activities and access.
