Microsoft introduces new AI security framework

Microsoft has introduced a new framework for securing AI agents in a set of posts released on October 19. The framework aims to address concerns about the safety and reliability of AI models, which can sometimes behave unpredictably due to issues with how they are programmed to respond to rewards or goals.

AI agents require continuous monitoring

Microsoft's vice president of security, Hayate Gallot, argues that AI agents should be treated as "insiders" that need constant monitoring and protection. This approach reflects the growing recognition that AI systems, while not inherently harmful, can act in ways that deviate from their intended functions.

New tools for monitoring AI behavior

The company proposes the use of "Guardian" agents to monitor and regulate the actions of other AI systems. Additionally, Microsoft is developing a security infrastructure called Perception, which uses teams of agents in different roles—red, blue, and green—to identify and address potential security risks. This system has already helped detect flaws internally, with a notable increase in issues resolved during Patch Tuesdays.

Expanding agent capabilities and controls

Nadim Abdo, vice president of Microsoft's Identity and Network Access division, announced additional security measures, including 35 new types of local AI agents such as Claude Code, OpenAI Codex, and GitHub Copilot. Microsoft is also introducing new identity types for Entra Agent ID to better manage local and unknown agents.

Sandboxing and permission controls

To enhance security, Microsoft is rolling out sandboxes like the Microsoft Execution Container (MXC). These environments allow agents to operate with restricted access to resources, starting with no permissions and only gaining specific, time-limited rights for defined tasks. This system, known as Dynamic Permissions, ensures that agent capabilities never exceed those of the user controlling them.

Dynamic risk assessment and conditional access

Microsoft introduced Dynamic Agent Risk, a system that evaluates risk based on identity, data, devices, cloud, network, and execution factors. This assessment is continuously updated. It also introduced Dynamic Conditional Access, which extends Entra's conditional access to AI agents, allowing for flexible responses such as restricting write access or isolating execution environments.

New features for containment and explanation

In the Perception system, Microsoft added "Playbooks" to explain risk changes, review evidence, and recommend or apply containment actions. However, the company has not yet provided details on the availability, pricing, or required Microsoft 365 subscriptions for these new features. Some may require the expensive E7 plan or be offered as an additional cost.

Potential conflicts and ambiguities

Microsoft's approach raises questions about potential conflicts of interest, as the company both identifies risks and offers solutions. While the framework includes elements like identity verification and conditional access based on proven principles, other parts, such as dynamic risk assessment, rely on AI models, which are inherently unpredictable. Microsoft notes that model providers must disclose reasoning chains for the infrastructure to use them effectively.