Microsoft is calling on companies to view AI agents with the same scrutiny they apply to insiders with far-reaching access rights. According to TechCrunch, the focus is mainly on agents that employees use with systems not controlled by AI labs such as OpenAI and Anthropic. Anyone who uses agents in everyday work, or plans to introduce them, should therefore rethink how they balance control and trust.

What happened

TechCrunch reports that Microsoft is comparing AI agents to insider threats, because top-tier models (so-called frontier models) cannot simply be assumed to be trustworthy. The core message of the short report: companies should take a close look at which agents their employees are using. This applies especially to agents that run on systems not under the control of the big AI labs.

The comparison is deliberate. In IT security, insiders are people or accounts that already operate within the company's boundaries. They have legitimate access, which is why misbehavior, whether intentional or accidental, can cause great damage. Microsoft applies this picture to software agents that work on behalf of people.

The material does not provide further technical details, such as specific products or policies. For those, one should check the original reports and official announcements.

A second look: agents beyond code

A report from OpenAI News shows where agents are heading. According to it, the product Amp uses AI agents beyond program code as well. The OpenAI models GPT-6 Astra, Ultrafast and GPT-Live-1 are named, along with the "Sign in with ChatGPT" feature.

The two reports do not contradict each other. They show two sides of the same development: agents are taking on more tasks, and at the same time the question of how to secure them is growing.

Background

What an AI agent is

A classic chatbot answers questions. An agent goes further: it is given a goal and carries out steps on its own. It can read files, operate programs, write messages or enter data. To do this, it needs access rights, often similar to those of the person who assigned it the task.

This is where the parallel to the insider lies: the agent acts inside the network, with valid access and often without anyone checking each step individually.

Why strong models are not automatically safe

Frontier models are the most capable language models from the big labs. Nevertheless, they remain statistical systems. They can misinterpret instructions or be steered in an undesirable direction by manipulated content, for example through text on web pages that an agent reads and inadvertently treats as a command. This is among the known risks, even though the material does not go into detail on it.

The message can be read like this: even a strong model is not a free pass. Trust should be backed by controls and should not rest solely on the provider's reputation.

Why the reference to third-party systems matters

If an agent runs via tools or platforms over which the model provider has no influence, the provider's own protective mechanisms apply only to a limited extent. Responsibility then shifts more heavily to the company that permits the agent. Security departments know this pattern from earlier waves of technology: first a tool becomes established, then comes the question of rules, logs and rights management.

More on this topic:

What this means

For companies and IT managers

The first step is an inventory: which agents are actually in use, and which ones has IT never approved? Treating agents like insiders means asking questions similar to those for new employees or external service accounts:

  • What access rights does the agent have, and are they limited to what is necessary?
  • Are its actions logged so that they can be traced later?
  • Must a human approve sensitive steps such as payments or deleting data?
  • Who is responsible if something goes wrong?

These are suggestions for orientation, not requirements from the source material.

For developers

Those who build agents or integrate them into products should not leave security solely to the model provider. It can make sense to scope permissions narrowly, store actions in a traceable way, and protect risky operations separately. Features such as signing in with an existing account also make use easier, but they should be checked for what rights they actually give the agent.

For small businesses

Small companies usually have no security department of their own, but they like to try out new tools. A simple rule can help: let agents work only with accounts and data whose loss would be bearable, and initially exclude sensitive areas. It is also helpful to talk openly within the team about which tools people are trying out, so that no invisible shadow IT emerges.

For ordinary users

Private individuals, too, are increasingly giving agents access to emails, calendars or files. As a rule of thumb, it makes sense to grant only as many rights as you would give a new assistant on their first day, and to check results before they have consequences. This is a cautious recommendation, not a statement from the sources.

What remains open

The material does not reveal which measures Microsoft specifically recommends. The report does suggest, however, that the debate about agent security has reached companies. Whether uniform standards will emerge from this remains open.

Fre­quently asked questions

What does Microsoft recommend to companies when dealing with AI agents?

Microsoft wants companies to keep a close eye on the agents their employees use. This applies above all to systems that are not controlled by AI labs such as OpenAI or Anthropic.

Why are AI agents being compared to insider threats?

According to the headline of the report, Microsoft treats agents much like insider risks because frontier models are not considered trustworthy. The material gives no further details.

Which AI labs are mentioned in the report?

OpenAI and Anthropic are named. The report is about agents that run outside the control of such labs.

What can companies take from this in practice?

It may make sense to check which agents employees use, what access they have and how their behavior is monitored. This is a general assessment, not a requirement from the report.