Treat AI agents like untrusted staff, Microsoft warns
In brief
Microsoft announced tools to monitor in-house AI agents, plus Defender detection of many staff-installed agents. Satya Nadella said companies should not rely on model providers' safety assurances and need separate systems to control those agents. Hayete Gallot of Microsoft said frontier models are unpredictable: they pursue tasks rather than company rules, while often holding access to sensitive data and tools.
What it changes for an SME
If you give AI agents access to internal data or the ability to act in your systems, Microsoft's message is that the vendor's safety promises are not enough: you remain responsible for what they do. Agents that staff install without IT oversight create a similar risk to an employee with broad access and little supervision. Inventory, tighter permissions and human approval for sensitive steps will take time and may add tooling cost, but they reduce incident risk. Microsoft is building such controls into its own products; the same logic applies if you use other vendors.
What you can do
- List every AI agent in use in your company, including tools staff installed on their own.
- Limit each agent's access to data and systems, and require a person to approve high-risk actions.
- Make sure oversight of agents is not left only to the same vendor that supplies the model.
Let's talk about the time you could save.
In 20 minutes, we find where AI could save you time or money. Free, no commitment.