Microsoft Defender’s new AI agent runtime protection gives Windows security teams a way to audit or block supported local agents while they are acting, rather than treating agent security as a pre-deployment review exercise.
As reported by Petri, the capability is tied to Microsoft Agent 365 and extends Defender monitoring to agent prompts, tool calls, and tool responses. Microsoft’s own documentation confirms that the endpoint component is in preview and is designed to catch prompt injection and risky agent actions before a supported action executes.
The practical concern is straightforward: a coding assistant or local autonomous agent can read a repository, browse a web page, access files, call tools, and execute commands with the user’s permissions. A malicious instruction hidden in documentation, a source file, or tool output can attempt to redirect that access toward data theft or unsafe commands.
Microsoft Defender for Endpoint inspects three key points: the user’s prompt, a tool request before execution, and the response returned by a tool. In block mode, Defender can stop a supported action and surface both an in-agent message and a Windows notification; in audit mode, it allows the activity but records the detection for review.
Microsoft lists Claude Code, Codex CLI, GitHub Copilot CLI, and the GitHub Copilot app among the agents supported through agent-native event inspection. A second network-inspection mode is intended to cover some agents that lack those event hooks, though it does not support certificate-pinned connections or HTTP/3.
That distinction matters for administrators: endpoint protection for local agents is configured separately from cloud-agent protection. Local Windows devices must be onboarded to Defender for Endpoint, run Defender Antivirus in active mode with real-time protection enabled, and use a supported agent.
Microsoft’s setup guidance also identifies eligible licensing as Defender for Endpoint Plan 2, Microsoft 365 E5, Microsoft Agent 365, or Microsoft 365 E7. Native Intune policy support is not yet available; Microsoft currently recommends deploying the required Defender preferences with PowerShell scripts through Intune.
For Windows organizations experimenting with local coding agents, the immediate value is visibility. Defender can turn opaque agent actions into endpoint telemetry and SOC incidents—but the real test will be how accurately its detections distinguish malicious prompt injection from the messy, instruction-heavy content agents encounter every day.
As reported by Petri, the capability is tied to Microsoft Agent 365 and extends Defender monitoring to agent prompts, tool calls, and tool responses. Microsoft’s own documentation confirms that the endpoint component is in preview and is designed to catch prompt injection and risky agent actions before a supported action executes.
Defender moves into the agent loop
The practical concern is straightforward: a coding assistant or local autonomous agent can read a repository, browse a web page, access files, call tools, and execute commands with the user’s permissions. A malicious instruction hidden in documentation, a source file, or tool output can attempt to redirect that access toward data theft or unsafe commands.Microsoft Defender for Endpoint inspects three key points: the user’s prompt, a tool request before execution, and the response returned by a tool. In block mode, Defender can stop a supported action and surface both an in-agent message and a Windows notification; in audit mode, it allows the activity but records the detection for review.
Microsoft lists Claude Code, Codex CLI, GitHub Copilot CLI, and the GitHub Copilot app among the agents supported through agent-native event inspection. A second network-inspection mode is intended to cover some agents that lack those event hooks, though it does not support certificate-pinned connections or HTTP/3.
Agent 365 is the cloud-side control plane
For cloud and Agent 365-managed agents, Defender’s real-time rules evaluate tool invocations before they run. Microsoft says the default policy audits activity, while custom rules can block matching actions for selected agents. Security events are recorded in theBehaviorInfo table for hunting, custom detection engineering, and downstream automation.That distinction matters for administrators: endpoint protection for local agents is configured separately from cloud-agent protection. Local Windows devices must be onboarded to Defender for Endpoint, run Defender Antivirus in active mode with real-time protection enabled, and use a supported agent.
Microsoft’s setup guidance also identifies eligible licensing as Defender for Endpoint Plan 2, Microsoft 365 E5, Microsoft Agent 365, or Microsoft 365 E7. Native Intune policy support is not yet available; Microsoft currently recommends deploying the required Defender preferences with PowerShell scripts through Intune.
Start with audit mode, not blanket blocking
Microsoft recommends a phased rollout: test on a small device group, review detections for one to two weeks, broaden audit coverage, then move validated groups into block mode. That is sensible because a blocked tool call can interrupt legitimate development workflows, especially where agents operate on codebases, terminals, and internal documentation.For Windows organizations experimenting with local coding agents, the immediate value is visibility. Defender can turn opaque agent actions into endpoint telemetry and SOC incidents—but the real test will be how accurately its detections distinguish malicious prompt injection from the messy, instruction-heavy content agents encounter every day.
References
- Primary source: Petri IT Knowledgebase
Published: 2026-07-29T11:09:19+00:00
Microsoft Defender Brings Runtime Security to Agent 365
Microsoft Defender now provides runtime protection for AI agents in Agent 365, helping organizations detect prompt injection and other risks.
petri.com
- Related coverage: learn.microsoft.com
AI agent runtime protection with Microsoft Defender for Endpoint (Preview) - Microsoft Defender for Endpoint | Microsoft Learn
Learn how Microsoft Defender for Endpoint provides runtime protection for local AI agents by detecting and blocking prompt injection attacks.learn.microsoft.com - Related coverage: microsoft.com
Microsoft Agent 365, now generally available, expands capabilities and integrations | Microsoft Security Blog
We’re announcing the general availability of Agent 365, plus previews of new capabilities to discover and manage shadow AI agents. Learn more.www.microsoft.com - Related coverage: techcommunity.microsoft.com
- Related coverage: cdn-dynmedia-1.microsoft.com
1084167628
Mid adult Chinese man sitting at desk using computer, IT supporter assisting office worker, software developer looking at screen and concentratingcdn-dynmedia-1.microsoft.com
- Related coverage: techradar.com
Microsoft reveals Agent 365 - the new and (hopefully) easy way to get a handle on all these new AI agents at work | TechRadar
Say hello to Agent 365www.techradar.com