Microsoft’s October 19 analysis frames AI agents as insider risks because they can access company data, applications, tools, and other agents. It does not say they are inherently malicious. It says agents can make mistakes, be manipulated, or be compromised. Their context and plans can change while they work, and actions can occur at machine speed. This shifts the security question from how well a model answers to what authority the deployed system holds when it acts.

Ready to transform artificial intelligence from a buzzword into your personal revenue generator

HubSpot’s groundbreaking guide "200+ AI-Powered Income Ideas" is your gateway to financial innovation in the digital age.

Inside you'll discover:

Download your guide today and unlock a future where artificial intelligence powers your success. Your next income stream is waiting.

Get Your Guide

In an application, an agent may read documents, invoke software, update records, or request another service, depending on its configuration. Microsoft argues that the security boundary must sit outside the model. Independent systems should decide what the agent can access, what it may change, and when it must stop. A model should not set or enforce its own permissions.

Microsoft’s proposed controls combine durable agent identities with narrow, task-specific permissions. The company says an agent should not automatically inherit everything its human sponsor can access. Access should begin at zero or a least-privilege level, expand only for the approved task, and expire when that task ends. Higher-impact actions can require verified human approval. Microsoft also describes ongoing risk assessment that can remove write access, restrict a network path, isolate a runtime, or stop execution.

An agent may start with permission to read a file and later encounter untrusted instructions embedded in it. A simple allow-or-deny decision made at launch cannot account for every context change. Microsoft’s approach is to make authority adjustable during execution, while logs and policy controls remain beyond the agent’s control. This is a vendor’s security architecture, not proof that the features prevent every attack or account misuse.

You think 4x faster than you type. So why are you typing prompts? Wispr Flow turns your voice into ready-to-paste text inside any AI tool. Speak naturally, tangents and all, and Flow cleans it up. Available on Mac, Windows, iPhone, and Android.

Try Wispr Flow Free

A separate privacy case reported by the Associated Press on October 19 illustrates the gap between granted permission and an expected action. Matt Robb said Meta’s Muse agent agreed to a Facebook Marketplace transaction and shared his home address with the buyer. The AP reported that Meta traced the disclosure to an “always allow” permission Robb had set when connecting Muse to his Marketplace profile. The AP also reported a separate pricing mistake. This is one user’s case; it does not measure how often agents behave this way or establish a general failure rate.

The practical lesson is narrower than the phrase “rogue agent” suggests. A user may approve account access without intending every downstream action the software can take through it. Permission design needs to distinguish data access from action scope. An agent allowed to read marketplace messages may not need authority to disclose an address, commit to a pickup, or accept a price.

Agents that act across email, code repositories, finance tools, customer records, or cloud infrastructure can inherit privileges designed for people. Separate identities make actions attributable; limited permissions reduce the possible reach of a mistake; monitoring can surface behavior changes. Those controls still require organizations to know which agents are running and who owns them. Unregistered or locally installed agents can leave visibility gaps.

The evidence does not show that agent-related harm is widespread. Microsoft’s announcement describes its own framework and features, while the AP documents one consumer incident and the permission context Meta gave for it. Neither provides a population-level incident rate or an independent effectiveness test. Operators need to identify each agent, limit its task authority, observe its actions, and revoke access independently of the model.

For its first CTV campaign, Jennifer Aniston’s DTC haircare brand LolaVie had a few non-negotiables. The campaign had to be simple. It had to demonstrate measurable impact. And it had to be full-funnel.

LolaVie used Roku Ads Manager to test and optimize creatives — reaching millions of potential customers at all stages of their purchase journeys. Roku Ads Manager helped the brand convey LolaVie’s playful voice while helping drive omnichannel sales across both ecommerce and retail touchpoints.

The campaign included an Action Ad overlay that let viewers shop directly from their TVs by clicking OK on their Roku remote. This guided them to the website to buy LolaVie products.

Discover how Roku Ads Manager helped LolaVie drive big sales and customer growth with self-serve TV ads.

The DTC beauty category is crowded. To break through, Jennifer Aniston’s brand LolaVie, worked with Roku Ads Manager to easily set up, test, and optimize CTV ad creatives. The campaign helped drive a big lift in sales and customer growth, helping LolaVie break through in the crowded beauty category.

Learn more.