Microsoft Defender Adds Runtime Protection for AI Agents in Agent 365
New capabilities help security teams monitor AI agent activity and investigate risks as tasks are executed.
Key Takeaways:
- Microsoft Defender can monitor AI agent behavior in real time through Agent 365.
- This platform helps detect prompt injection, jailbreak attempts, and unauthorized data access.
- The runtime protection supports Microsoft-built, third-party, and local AI agents.
Microsoft has integrated Microsoft Defender capabilities into the Agent 365 ecosystem to monitor AI agents in real time as they execute tasks. This enables security teams to evaluate agent behavior continuously, rather than relying solely on pre-deployment testing or static security reviews.
Microsoft highlighted that AI agents can act on their own, which involves accessing company data, using connected tools, and carrying out tasks based on natural-language instructions. This autonomy boosts productivity, but it also creates opportunities for attackers to manipulate agents through techniques such as prompt injection or malicious instructions. It potentially leads to data exposure, unauthorized actions, or misuse of business systems.
Microsoft Defender monitors AI agents during runtime
This new Microsoft Defender integration with Agent 365 addresses this gap by discovering agents, evaluating security posture, and monitoring their activity at runtime. It allows Microsoft Defender to inspect prompts and responses for agents built with Copilot Studio and Microsoft Foundry.
According to Microsoft, these capabilities help security teams identify risks such as prompt injection and jailbreak attempts, unauthorized access to sensitive information, and leakage of credentials or confidential data.
Runtime protection extends to third-party and local AI agents
Microsoft Defender records agent activities, risky behaviors, and blocked actions, which gives security teams a clearer view of agents’ activities to support investigations, threat hunting, detection engineering, and compliance reporting. This solution combines proactive protection with post-event detection and investigation capabilities. It allows organizations to respond to threats throughout the agent lifecycle.
This update applies to AI agents built with Microsoft tools, along with supported third-party and locally running agents onboarded via Agent 365. Local agent runtime protection support on Windows endpoints is currently available in public preview for commercial customers.
Rabia has a master's degree in Software Engineering and she has years of experience writing professionally about Microsoft products and other technologies. Rabia has also written for OnMSFT.com as well as Windows Report. She is always up to date on t...
