Microsoft Defender adds protection for local AI agents
Microsoft Defender can now discover local AI agents and block prompt injection attempts on managed devices.
Microsoft has announced new Defender capabilities designed to help organisations secure local AI agents and Model Context Protocol servers across enterprise environments.
The company said Microsoft Defender can now discover more than 25 types of local AI agents and MCP servers across managed Windows and macOS devices.
Microsoft said the feature also provides runtime protection when developers use coding agents such as GitHub Copilot CLI or Claude Code. According to the company, Defender can detect and block prompt injection attempts before a malicious action is executed.
Security teams can investigate AI agent exposure through Advanced Hunting. Microsoft said the local AI agent capabilities are currently in preview.
The update reflects a broader shift in enterprise security as organisations deploy AI agents, coding tools and MCP servers inside development and productivity workflows.
Microsoft also announced Codename MDASH, a private-preview multi-model agentic scanning system designed to discover, validate and help remediate software vulnerabilities. The company said MDASH can route validated issues into Microsoft Defender workflows and engineering pipelines.
Other June security updates include Microsoft Entra Backup and Recovery, expanded multicloud coverage in Defender for Cloud, new database threat protection for open-source relational databases on AWS RDS, Microsoft Purview customisable reports and a unified identity risk score.
Why does it matter?
AI agents are becoming part of enterprise infrastructure, which means they also become part of the attack surface. Local coding agents, MCP servers and agentic development tools can interact with files, code, credentials and internal systems. Microsoft’s update shows end point security expanding beyond traditional malware detection towards prompt injection, agent exposure and AI-driven development workflows. It also reflects a wider trend: security teams will need visibility and controls for AI systems deployed inside organisations, not only for cloud-hosted models.
Would you like to learn more about AI, tech, and digital diplomacy? If so, ask our Diplo chatbot!