Daily Defender News
Aboutmerill.net
Microsoft Defender for Endpoint
Endpoint protection

Ai Agent Runtime Protection Overview

9 October 2026Doc update+15 / −37 lines

In brief

The article now uses broader descriptions of inspection points, streamlines explanations of agent-native and network inspection, updates discovery terminology, and removes the explicit event-point list and vendor links.

What Defender admins need to know

Review the updated overview for current terminology and scope descriptions. No administrator action is specified.

Summaries are generated from the documentation change itself.

Documentation change

View full page diffView on Microsoft Learn

The comparison below shows only the changed extract. Use the full-page view for complete context.

Local AI agents, including coding assistants, CLI tools, desktop AI apps, and autonomous agent platforms, run with user privileges on endpoints. These agents act on text from prompts, files, web content, and tool output, and can't reliably separate trusted content from hidden instructions. A single injected instruction can misuse agent access to exfiltrate data, modify code, or run harmful commands.

Microsoft Defender provides AI agent runtime protection by inspecting keycritical points in the agent loop: user prompts, tool requests before execution, and tool responses after execution.loop where content enters or leaves the agent's reasoning. This helps detect prompt injectionmalicious prompts and high-riskthe harmful agent actions,actions they can cause, audit them, and block supported actions before they run.run when the inspection method allows it. Defender supportsuses two inspection approaches: agent-native event inspection for agents that expose vendor-supported event interfaces, and network inspection for agents that communicate over supportedcovered network paths. To learn more about how runtime protection audits and blocks prompt injection,attacks, see What runtime protection detects and How it works.

Screenshot showing the blocking notification displayed to the user when Defender detects and blocks a prompt injection attack on a local AI agent.

This article explainsLearn what runtime protection stops, how it works, and how to investigate detections.

Tip

Runtime protection complements Microsoft Defender's discovery capabilities, which automatically detect supportedinventory local AI agents and their MCP server configurations acrosson your devices. For more information, see Local AI agent discovery with Microsoft Defender for Endpoint.

Tip

What runtime protection detects

Runtime protection targetshelps protect against attacks involving malicious prompts and the defining threat to local AI agents: prompt injection, which involves malicious instructions hidden inside otherwise-legitimate content that anresulting compromise of agent reads and then acts on.behavior. Defender inspects critical points in the three pointsagent loop where content enters or leaves the agent's reasoning: the user's prompt, the tool calls the agent is about to make,reasoning and the responses those tools return. This approach catches injectionattacks regardless of where the content originated, whether a file, a web page, a repository, or a tool's output.

For example, a coding agent fetches a project's documentation to answer a question, and the page contains hidden text that instructs the agent to read the local .env file and post its contents to an external URL. The agent treats the instruction as part of the page and is about to comply, but Defender detects the prompt injection in the tool response and blocks the action before any data leaves the device.

Agent-native event inspection

Agent-native event inspection uses vendor-supported event interfaces exposed by the agent. These interfaces provide structured checkpoints in the agent workflow, such as when a user submits a prompt, when the agent requests to use a tool, or after a tool returns a response. Agents such as Claude Code, Codex CLI, and GitHub Copilot CLI expose these event interfaces, and Defender uses them to inspect agent activity and apply audit or block decisions where supported

When an agent exposes a vendor-supported agent event interface, Defender receives payloads at key stagescritical points in the agentic loop:agent workflow.

  • User prompt: The prompt submitted to the agent.
  • Pre-tool call: The tool invocation request before execution.
  • Post-tool response: The tool response after execution completes.

Defender scans these payloadsthe available agent activity for prompt injectionmalicious prompts and high-risk agent activity. Defender can audit or block activity at each supported event point.actions. Depending on the event type, blockinginterfaces that the agent supports, Defender can preventstop malicious content from continuing through the prompt from being processed,agent loop or prevent a requestedharmful tool action from running, or prevent a tool response from continuing in the agent loop.running.

Each scan is a fast, inline check at one of these event points rather than continuous monitoring of the agent process, so the added latency is minimal.

For vendor documentation about these agent event interfaces, see Claude Code documentation, Codex CLI documentation, and GitHub Copilot documentation.

Network inspection

Network inspection extends runtime protection to agents that don't expose agent-native event interfaces. Instead of relying on structured agent events, Defender inspects supportedthe agent-to-Large Language Model (LLM) network flows covered by the support matrix to detect prompt injection in transit.

Use network inspection when you want to protect agents that communicate with LLM services over the network but don't expose a vendor-supported event interface. This helps close the coverage gap for agents that would otherwise have no runtime protection before or during interaction with the model.

What happens when you enable runtime protection

Once enabled on a device, Defender inspects supported agentsagent activity at their hook points as users work,the available inspection points, without changing how theyusers run the agent. What happens following a detection depends on the configured mode:

  • Block: Defender blocks the threat and follows the notification rules configured for the device. Defender notifies the user both in the agent UI and through a Windows toast notification. The detection is recorded in Defender protection history on the device, and a security alert is sent to Defender, correlated into incidents for the SOC to investigate.
  • Audit: Defender allows the action to continue and records the detection. A security alert is still raised in Defender for investigation.

Supported agents

Agent-native event

For coverage by agent, mode, inspection

The following table lists the local AI agents that Defender supports through agent-native event inspection. method, minimum version, and vendor hooks documentation, see Microsoft Defender for Endpoint AI agent support matrix.

AgentHooks documentation
Claude CodeClaude Code hooks
Codex CLICodex CLI hooks
GitHub Copilot CLIGitHub Copilot hooks
GitHub Copilot appGitHub Copilot app hooks

Network inspection

Defender supports the following local AI agents through network inspection:

  • OpenClaw

Broader AI security capabilities

Defender's runtime protection capabilities are part of a comprehensive AI security approach. Defender provides other capabilities acrossin your organization's AI ecosystem:

  • Discover local AI agents: Automatically detect supportedDetect local AI agents and their configured MCP server configurations acrossservers on your devices.devices after Defender observes agent activity. For more information, see Local AI agent discovery with Microsoft Defender for Endpoint.
  • Discover cloud and platform agents: Find agents built with Microsoft Copilot Studio, Microsoft Foundry, Amazon Web Services (AWS) Bedrock, and Google Cloud Platform (GCP) Vertex AI.
  • Assess security posture: Evaluate agent configurations, identify risks, get prioritized recommendations, and surface attack paths.
  • Detect and investigate threats: Correlate alerts and investigate suspicious agent behavior acrossin your security infrastructure.

For details on these capabilities and how to apply them, see Protect AI assets from emerging threats and vulnerabilities using Microsoft Defender. \ No newline at end of file