Microsoft Defender now spots 60 kinds of coding agents on employee machines

The security team at a company that pays for Claude Code, Codex or GitHub Copilot now has to track every agent its employees run, as a separate thing from the employee. Microsoft said on Monday that its Defender product can discover 60 kinds of local AI coding agent on an employee's machine, and ships a Guardian Agent that watches each one.

The announcement, written by Nadim Abdo, Corporate Vice President for Identity and Network Access, extends Microsoft's Project Perception product. Microsoft says Defender's agent discovery grew by 35 types this round, taking the total to 60 supported local agents and naming Claude Code, OpenAI Codex and GitHub Copilot in the list. Every discovered agent is given a first-class identity in Microsoft Entra Agent ID, separate from the employee who sponsored it, so attribution and permissions can sit on the agent instead of on the person.

Permissions that shrink and grow during a task

Microsoft is also introducing a feature it calls Dynamic Permissions. Instead of an agent inheriting all the standing access of its user, an agent begins with no authority and receives only what the current task needs, for only as long as the task runs. Policy at the organisation level can prevent an agent from being given authority its user does not have in the first place. Higher-impact actions can require a human approval that is cryptographically provable.

A sibling feature called Dynamic Agent Risk combines signals from identity, data, endpoints, cloud, network, runtime and the agent's own activity into a continuously updated score. Dynamic Conditional Access then responds in steps instead of a single on-or-off switch: it can keep read access while blocking writes, narrow the network paths an agent can reach, shorten time-bound access or isolate the runtime altogether.

Guardian Agents and the sandbox underneath

Project Perception also gains Guardian Agents and Playbooks. Playbooks define the security outcome and the Guardian Agents do the continuous work of investigating risk changes, applying containment and feeding what they learn back into policy. The post is clear that this is not meant to replace human judgment: Microsoft says people keep control of objectives and consequential decisions.

The whole stack sits on top of a sandbox called Microsoft Execution Container (MXC), which runs the model and its harness inside a boundary where security controls operate outside the agent's reach. Nadim Abdo writes that the goal is a system designed to require the least possible trust in the model it contains, with authority sitting outside the model instead of inside it.

A team shipping a feature backed by Claude Code or Codex should expect its corporate security owner to ask three questions soon: which agents are running on which machines, which identity each one carries, and what evidence exists that its authority is being adjusted as its task changes. The answers used to be a developer problem. Microsoft is making them an IT problem.

Source

Microsoft Security blog, Nadim Abdo, "Agents are your newest insiders. Security must move at their speed." Reporting also by TechCrunch, Julie Bort.