Microsoft puts AI Agent on the internal threat list: It's not the model. It's the authority.

The first conclusion: Microsoft sent out this set on October 19, on the face of several new features, actually changed a default assumption.

The default assumption in the past was that Agent was deployed by ourselves, so the default was credible. Microsoft made it clear this time that this assumption is not valid. I'll copy that:"Agent has been trusted since we deployed him inside the company. Unfortunately, no front-line model can be trusted from anywhere.”

Note the second sentence:No matter where it comes from,I don't know. Including it at home.

It's not a PR. It puts an old concept from the 1970s -- internal threat -- straight to the model. And the internal threat theory never works by "trusting this man."

First, let's get the meaning of the word "internal threat."

Many people see "AI is an internal threat" and the first reaction is "AI is going to rebel." It's not that. Microsoft has clarified it three times.

The traditional definition of internal threats is:An insider with legitimate authority who was negligent, turned back or caught fishing caused damage that he should not have caused.The key is the word "lawful authority" -- he didn't come over the wall, he was swiped in.

On Agent, Microsoft gave three reasons:

• It makes mistakes., because the output is uncertain, the same input does not guarantee the same output;
• It will be manipulated.in an external document;
• It will be broken.It runs, it transfers the MCP server, it takes the certificate, and any link can be taken.

And I think it's the most important, the least visible sentence in the original:Agent collaborates with each other and even colludes to achieve the goal, and the process does not need to be broken.

This sentence is larger than the three preceding ones combined. It's not about "Agent will be used by the bad people," it's about "many Agents may not have been designed to do their job." That's what the word "internal" really means -- it grew from inside, not from outside.

II. REAL PRINCIPLES IS ONLY ONE THOUGHT

The cornerstone of the whole framework, Nadra, wrote in his brief on October 10th:

We must separate the supply of intelligence from the authority of intelligence.

Turn it into big words: Modellers are smart to make models, but "What can this model read in your system, what can it change, can it continue to run?" This decision cannot be left to modelers, nor to models themselves.

He's got another one in the same page:"The most credible super-intelligence system is not the one we trust in the model, but the one that allows us to trust the model."

It sounds like a paradox, but it's old engineering. It corresponds to a safety principle that was established in the 1970s:A procedure cannot circumvent or alter the mechanism used to bind its competence.

The problem is that most Agent is now deployed in the reverse way: the model is in the container, the right control is written in the system hint of the model and the log is reported by the model itself. It is tantamount to placing the police and suspects on the same individual.

Microsoft's solution is to untangle it: the model runs during the controlled operation (known as Microsoft Exchange Container, MXC), with identity in Entra, with permission determined by external strategy and evidence collected by external sensors. The model is in the cage, and the lock is not in its hand.

Three or four verbs, not four stages.

Microsoft broke it down into four actions, which were originally Know / Contain / Protec / Adapt. I would like to emphasize in particular:These four are not sequential, they are closed rings running simultaneously.

Actions	Chinese	For what?	Response
Know	Yes.	Who did, who built it, why? What are you doing?	Local Agent found extension to class 60
Contain	Limits	I'll cut the touch to death before I do it.	MXC Sandbox + Dynamic Missions
Project	Protection	Data, tools, running time, resources on its path	Purview/ Network/ Endpoint Control
Adapt	Adjustment	Behavior and risk change. Permission changes.	Dynamic Age Risk + Conditions Access

The text is very accurate:Evidence changes risks, risks change strategies, strategies change what it can do.

That's the cycle. Instead of "assess it once on entry and then issue a permanent pass", it is "recalculated for everything."

IV. "Zero Permission Start" is the toughest clause in this set.

I think the article is the one that is most effectively binding on A:

The employee retains his/her own access rights. Agent has his own identity, his own authority, and a mandate limited to current tasks and limited to the duration of missions.

The opening of this sentence is a three-fold requirement:

• Agent cannot inherit full authority.You gave the staff full access to the financial system, not the reimbursement that he had called, but also the Agent.
• Competences are issued by mandate and received by the time limit.The end of the mission and the lapse of authority are not to be retained for the next time.
• High-risk action requires approval.And it's "proveable manual approval" — the original word is cryptographyally proficient, as evidenced by the code, not a "consent" in a window.

Accompanying this is Dynamic Agent Risk: a continuously updated risk rating, which is not a static item such as "This Agent is unsafely configured" but "what is it doing now, and whether it has been assigned to a mission that deviates from it."

What are we going to do with that? Microsoft specifically emphasizesResponse is gradual, not a switch.:

• Keep reading, cut off writing;
• To narrow the range of data it can touch;
• Cut off the network path;
• Reduction or withdrawal of temporary powers;
• Forced manual approval for high-risk operations;
• Only when running in isolation is the highest level, it is stopped directly.

It's quite a design. It admits one thing:A strategy like "Kill if you find an anomaly" doesn't work in real business.Because the cost of manslaughter is too high, the end result must be luck to turn off the alarm. So it gave the first set of steps down.

Five or five specific things that match the top.

That's what's on the product. I press the "Can I verify it now" line:

1 Local Agent Discoveries extended to class 60

Add a new 35 class with clear designations Claude Code, OpenAI Codex, GitHub Copilot. I went through its support matrix file, which did have entries like Claude Code, Codex CLI, Codex Desktop, GitHub Copilot CLI, and singled out WSL.

The meaning of this article for domestic enterprises may be underestimated:Agent, the security team can see it now.It's a huge increase in visibility, but it's also an organizational problem. Whether or not to report it before it's ready to be used as a surveillance.

2 Entra Agent ID Extension

Make Agent independent of the user. The bottom line is "Let's let the business know which things are done by humans and which by Agent." This sentence is extremely valuable at the time of the accident — there is no independent identity, and you have no subsequent attribution of responsibility.

3 MXC Executing Container

It's not the sandbox itself, it's the original:"If Agent or its Harness were broken, it should not be able to turn off the controls that are watching it."This is to put the lock outside the cage on the project.

4 Dynamic Missions

The three requirements in section IV above are productization. There is one detail worth remembering: the organization-level strategy begins with an external border, which includes"to prevent Agent from gaining access to any of its users."I don't know. This block is power.

5 Guardians + Playbooks

This is the one thing that needs to be looked at calmly, and I will say it separately.

VI. The strongest bone of the frame: Guardian himself, Agent

I read the whole text, and I'd like to ask you a question of my own.

Microsoft says: Models cannot be their own security authority, and control must be outside the model.

And then the answer is, use a team. Guardian Ages(Guarder Agent) Go 7x24 and stare at every move of every Agent.

But the Guardian Agens themselves are Agent.

Microsoft obviously knew about the pit, and it gave three layers of response:

First level, the boundaries of the Guardian competence, the approval of the boundaries, and the rules governing the commissioningIt's up to you.Guardian only operates within the border. The original text is clear: "This is not to outsource judgment." People retain control over objectives and major decisions.”

Second floor, Guardian.External sensors- Identity, data, endpoints, networks, running times, clouds, not models. This is a prerequisite for its establishment.

Third, and most honest: the transparency of models (the chain of thought, etc.) is treated asSources of evidenceOne, but the text immediately adds:"The model cannot be its own safe border. An independent system must observe each layer, including the model itself.”

To be honest, these three layers of response are logically comfortable, but there are two stitches left on the project, and I think it has to come out:

First: The credibility of evidence depends on who has the evidence.For locally run Agent (Claude Code, Codex, etc.), the sensors are on your own endpoint, and the chain of evidence is clean. However, Agent, the cloud host, operated logs, thought chains and call records are in the vendor room. What you got is a summary of it for you, not raw data. The word "independent audit" is discounted on cloud Agent.

Second course: Guardian is as tired as man.It's not tired, but it's got a false alarm. When 10,000 Agents produce 100,000 "risk rises" a day, Guardian auto-depression, auto-separation moves begin to affect business continuity. At that point, the real bottleneck is not detection.Who will bear the cost of the misdeed?I don't know. The original answer is "people keep major decisions", but where is the "significant" border?

This is not a denial of this framework. On the contrary, few manufacturers have been able to put these two stitches clearly into the architecture document. But as a lander, you have to know where the stitch is.

Seven, the other half of the same week: Agent across the street is already on the run.

If you look only at Microsoft, it's a future trend. Put the 21st of October together, the nature changes.

Microsoft sent a threat message the same day: Storm-0940 An attacker convicted of Chinese national background. ARTEX The intelligent penetration framework, which has been automated since September 2026, has hit hundreds of organizations around the world across many industries.Many of these cases took less than three hours, from targeting to privileged access to cloud infrastructure.

And it hangs it on a real supply chain -- Microsoft has identified Storm-0940 as the perpetrator of the recent multi-tenant application of the supply chain. The attack path is to take the application and then use the approved permission to authenticate Microsoft 365 client environment without interactive login.

Microsoft wrote a very well-established sentence:"Agent is not subject to human restrictions. It can work 7x24, run weekends, holidays, and try multiple intrusion paths."

Put it together, 2026, October, the week came out:

• 10 October, CEO set: the model is an internal risk and responsibility cannot be outsourced;
• 19 October, Framework landing: detection, limitation, protection, adjustment;
• On 21 October, opposite fire: 3 hours to take privileges.

On the one hand, it's its Agent too capable, on the other hand it's Agent too fast.These two lines hit in the same quarter, not as trend predictions, but as current risks.

Eight, people in different positions, what can we do now?

I don't like the phrase "business should set up a system", but it's like saying nothing. Split by character.

If you're in charge of ISO or security,

The first thing is not to buy E7.First, clean up your family, Agent.I don't know. The starting point for Microsoft's set is "no one can see" and so can you. Now ask three questions: how many Agents are running in the company, who built it, and what authority each took. I guess most companies can't answer the third.

The second thing is...Take it off.I don't know. Agent's work as a human being is now the most common and the easiest place to happen — you can't even tell if it's a human being or a human being. Entra can do it without a single service account for Agent and a separate voucher, which is purely managed without money.

If you are an IT or a platform team

The minimum landable version is four: container isolation (not to allow Agent to run directly on the host), issuance of a mission voucher (not to use a long-term AK), stop traffic control (each external call by Agent is recorded), and concentration of action logs (not just letters Agent's own reply). None of these four need E7.

If you're a developer,

One should now read:Do not write permissions in the hints.The phrase "you are not allowed to access /etc" is not security control at the level of the hint, but only advice. The real boundary has to be at the tool level, at the network level, at the system level. Whichever family you use, Agent is set up.

If you're on a small team, you don't have a budget.

Microsoft's four verbs are actually handwritten: an Agent List (Know), a form (Contain) that each Agent allows to do, a separate Minimum Permission Certificate (Protect) for each Agent, a single searchable place in the log and a weekly reading of Adapt. Within one week of work, the result is no less than that of the product.

IX. Final sentence judgement

It's not a product line, it's a default value.

Over the past decade, the default value for corporate security has been “internally credible, border defense”. Zero trust took a long time to change this default, and by now half of the companies are using the idea of "net is safe."

Agent pushed the question again and pushed it harder:It is not an in-house person who can be trained, disciplined and processed through the separation process. It has no loyalty in its memory, nor does it have any interest in it. It's only authorized.

So the answer to that question is simple and difficult:As much power as you give it, it can cause as much damage as it can.

Microsoft's solution is to limit the powers to zero, to task, to time, to high-risk VIPs. It's not new, it's pushing the principle of minimal authority to the speed of the machine. What's new is that it admits for the first time:In this system, you cannot gain security by trusting any model, but by not trusting it.

If that's true, then all the vendors who sell Agent will have to answer the same question:To what extent can your model be trusted and the system run?

If the answer is not good, the next one is on the list.