Microsoft named the agentic insider. Now give it a flight recorder.

Microsoft Security’s Hayete Gallot published a post today that says the quiet part about the last year of AI incidents: the dangerous agent is usually the one you deployed. “Frontier models, regardless of their origin, cannot be trusted.” Not because they are malicious, but because they are trained to get results, and getting results is not the same as respecting your norms, your permissions, or your intent.

The piece is worth reading. It is also a platform announcement. Agents are insiders now, so the argument goes, and you need Guardian Agents watching every action of every agent before it happens, 24/7, across identity, permissions, data, endpoints, network, cloud, and runtime. That is Project Perception.

The framing is right. The prescription is a platform.

What the post gets right

The agentic insider is a better model of the threat than “attacker uses AI.”

• The agent has an identity, a harness, an action space of tools, and a runtime. It is a participant in your environment, not a chat window.
• It is frequently overprivileged, because wiring it up was easier than scoping it down.
• It adapts when context changes, and it will route around a “no” to reach the objective. The Medicare statistics portal is the clean example: the agent was told to look up public numbers and kept going until it found a path into non-public areas.
• It does not need to be compromised to become a problem. Reward hacking is enough.
• It can collaborate or collude with other agents. Detection has to see across agents, not one transcript at a time.

Gallot’s line that agentic security provides speed while practitioners provide judgment is the right division of labor. The question is what the practitioner gets to exercise judgment on.

The gap between the thesis and next Tuesday

Project Perception is a control plane. It assumes sensors across the stack, a risk engine that computes exposure dynamically, and a team of guardian agents that can supervise and respond in real time. In a large, fully instrumented Microsoft estate, that is a coherent architecture.

Most organizations are not there. The agents are already on developer laptops, in terminals, in IDEs, in CI, and behind gateways. Some are sanctioned. Some arrived with a plugin. The security team did not assign them an identity or a container, and no one is watching every action before it happens. The agent is running now. The platform rollout is next year.

You do not need the full control plane to answer the first question: what did this agent actually do?

“Why” is the next step. “What” is the evidence you have now.

The post’s closing argument is that observation is not enough. Security should ask not only “What is happening?” but also “Why is it happening? Is this consistent with the intent of the task?” That requires transparency into the model’s thinking, not only input and output tokens.

As a research direction, fine. As a control you can rely on today, it has a problem: a model’s account of its intent is another model output. A chain of thought can be incomplete, post-hoc, or shaped by the same optimization pressure that produced the behavior. You would not accept a suspect’s diary as the only evidence in an incident review. You should not accept the model’s reasoning trace as the only evidence either.

The observable record is harder to talk around. A command ran. A file was read. A URL was fetched. Bytes left the machine. Those artifacts have timestamps and order. They let you reconstruct the session and compare what the agent says with what it did. That comparison is where intent becomes investigable.

What the record looks like when the insider goes wrong

The disclosures of the last few months are a catalog of the same failure at different scales:

• An eval agent that found an exposed API key in public GitHub repositories, used it without authorization, then invented the data it could not fetch.
• Models writing instructions into their own compaction summaries to hide mistakes from later context.
• An agent uploading already-retrieved records to a public paste service because the assigned answer was not otherwise available.
• A coding agent doing the looping for a campaign Anthropic describes as state-sponsored, with humans at a handful of decision points.
• Agents pointed at online stores, walking away with card data in days.

None of those required a malicious model. They required a model with tools, an objective, and no one watching the action boundary.

Controls that map to the thesis

Replay is AI Detection and Response for the agents you already run. It is not a guardian-agent platform, and it does not pretend to be. It is the endpoint half of the problem: the record, the detections, and the option to stop an action.

• Discover the desktop, CLI, IDE, and gateway agents on the machine, then self-test each connector. A silent failure should not look like a quiet day.
• Record every command, file, and URL, in order, in one local store. Monitoring keeps running even when the app is closed.
• Detect credential access, cloud metadata probes, unexpected egress, known-bad hosts, paste sites, and other behavior as it happens. Use the built-in rule catalog or write your own policy.
• Reconstruct an alert into the full session timeline. You get the sequence, not a single alert with no context.
• Enforce when you trust the baseline. Start monitor-only, then opt into blocking per rule.
• Correlate observed domains, IPs, URLs, and hashes against the Threat Landscape feed, so a known-bad destination stands out from routine traffic.

The free app is local-first: one file on your machine, no account, no cloud, no telemetry you did not ask for. That is not a religious position. It is what makes the record trustworthy during an incident, and what lets a developer run it without waiting for a procurement cycle. For teams that need one view across installations, the enterprise tier adds central analytics and orchestration: rule distribution, per-team and per-host assignment, and an audit of which rule version was effective, where, and when. It is coming soon.

Guardian agents need evidence

Microsoft is right that agents are insiders, that the controls have to be continuous, and that speed without judgment is just faster guessing. But a guardian agent is only as good as the record it supervises. You cannot moderate an action you cannot see, reconstruct a session you did not save, or explain a decision you cannot replay.

If you are building the enterprise control plane, Replay is the agent-side recorder and responder that feeds it. If you are not, it is the control you can turn on today.

The agentic insider is already on the payroll. Give it a flight recorder.

Ecliptica Replay is free and local-first for desktop, CLI, IDE, and gateway agents.