{"schema":"OTR-CURRENT-SIGNAL-READER-1","presentationSchema":"OTR-SIGNAL-SLIDES-1","signalId":"PDF-ae29e122216020b99c26d828-33","canonicalUrl":"https://ontherice.org/signals/PDF-ae29e122216020b99c26d828-33/","title":"The next AI security test happens before the agent clicks","category":"Technology","representation":"current-guided-reader","originalResearch":"preserved-separately","sources":[{"title":"T03 S1:","url":"https://blogs.microsoft.com/blog/2026/10/19/securing-the-agentic-insider/","contexts":["Sources and verification","Source trail","OTR EMERGING DATA","The idea, step by step","Research context","The key clues","What could change this view?","What this means","Evidence behind this view","Evidence against this view","What people say vs the facts","What’s changing?","What to check","People and organisations","OTR reasoning","Counterpoint","What changed","Why the view changed","Evidence, memory & review 4 linked sources","Keep exploring","Terms in simple English"]},{"title":"T03 S2:","url":"https://news.microsoft.com/source/asia/2026/10/13/microsoft-digital-defense-2026-report-highlights-new-cybersecurity-challenges-amid-rapid-ai-adoption/","contexts":["Sources and verification","Source trail","OTR EMERGING DATA","The idea, step by step","Research context","The key clues","What could change this view?","What this means","Evidence behind this view","Evidence against this view","What people say vs the facts","What’s changing?","What to check","People and organisations","OTR reasoning","Counterpoint","What changed","Why the view changed","Evidence, memory & review 4 linked sources","Keep exploring","Terms in simple English"]},{"title":"T03 S3:","url":"https://support.microsoft.com/en-au/windows/ai/ai-features/experimental-agentic-features","contexts":["Sources and verification","Source trail","OTR EMERGING DATA","The idea, step by step","Research context","The key clues","What could change this view?","What this means","Evidence behind this view","Evidence against this view","What people say vs the facts","What’s changing?","What to check","People and organisations","OTR reasoning","Counterpoint","What changed","Why the view changed","Evidence, memory & review 4 linked sources","Keep exploring","Terms in simple English"]}],"chapters":[{"id":"otr-slide-PDF-ae29e122216020b99c26d828-33-detail-1","url":"https://ontherice.org/signals/PDF-ae29e122216020b99c26d828-33/#otr-slide-PDF-ae29e122216020b99c26d828-33-detail-1","title":"OTR EMERGING DATA","topic":"emerging","kind":"cover","text":"Start with the main idea: what may be changing, how the clues connect, and what remains uncertain. An AI system that can use tools needs a safety check before it changes anything outside the conversation. A chatbot can give a poor answer without changing a business system. An AI agent with broad access can turn the same mistake into a changed file, an exposed record or an unwanted transaction. The key difference is what the software is allowed to do. A natural-sounding conversation does not establish safe permissions. Microsoft's latest discussion of internal AI agents connects with a wider business risk: linked systems can pass trust from one tool to another. A company may trust the person who installed an agent, then assume that every action by the agent is safe. When several tools or agents work together, individual steps that look safe can form an unsafe sequence. Before buying such a system, a business could ask whether a separate safeguard can inspect a proposed action, limit it and stop it. This is OTR's proposed system design, not proof that a supplier has solved the problem. The AI model's quality still matters. A business also needs evidence that safeguards work when software is about to change something.","links":[]},{"id":"otr-slide-PDF-ae29e122216020b99c26d828-33-detail-2","url":"https://ontherice.org/signals/PDF-ae29e122216020b99c26d828-33/#otr-slide-PDF-ae29e122216020b99c26d828-33-detail-2","title":"The idea, step by step","topic":"evidence","kind":"research","text":"Follow the reasoning from the observations to the proposed result. A possible link is not proof. Give each agent its own identity. Limit which resources it can change. Check a proposed action before execution, record the result and keep a human route for exceptions. Then test whether the controls still hold when the agent uses several tools together.","links":[]},{"id":"otr-slide-PDF-ae29e122216020b99c26d828-33-detail-3","url":"https://ontherice.org/signals/PDF-ae29e122216020b99c26d828-33/#otr-slide-PDF-ae29e122216020b99c26d828-33-detail-3","title":"Research context","topic":"evidence","kind":"research","text":"Understand the background and earlier comparisons, including the differences that matter. These are Microsoft’s security architecture claims, not an independent audit that every proposed control works. Multiple Microsoft pages are one corporate source family.","links":[]},{"id":"otr-slide-PDF-ae29e122216020b99c26d828-33-detail-4","url":"https://ontherice.org/signals/PDF-ae29e122216020b99c26d828-33/#otr-slide-PDF-ae29e122216020b99c26d828-33-detail-4","title":"The key clues","topic":"evidence","kind":"research","text":"See the main observations behind the idea, with their important qualifications. An internally deployed agent may be overprivileged. Monitoring an action after it happened cannot prevent the first harmful change.","links":[]},{"id":"otr-slide-PDF-ae29e122216020b99c26d828-33-detail-5","url":"https://ontherice.org/signals/PDF-ae29e122216020b99c26d828-33/#otr-slide-PDF-ae29e122216020b99c26d828-33-detail-5","title":"What could change this view?","topic":"changes","kind":"research","text":"See what could change this interpretation and what still needs to be checked. A supervising agent can also make mistakes. Excessive blocking could make the service unusable, while broad exceptions could reopen the same risk.","links":[]},{"id":"otr-slide-PDF-ae29e122216020b99c26d828-33-detail-6","url":"https://ontherice.org/signals/PDF-ae29e122216020b99c26d828-33/#otr-slide-PDF-ae29e122216020b99c26d828-33-detail-6","title":"What this means","topic":"evidence","kind":"research","text":"Read the takeaway and the limits that matter before drawing a conclusion. Buyers can require permission maps, action logs and a tested stop mechanism alongside model-quality scores.","links":[]},{"id":"otr-slide-PDF-ae29e122216020b99c26d828-33-detail-7","url":"https://ontherice.org/signals/PDF-ae29e122216020b99c26d828-33/#otr-slide-PDF-ae29e122216020b99c26d828-33-detail-7","title":"Evidence behind this view","topic":"evidence","kind":"research","text":"Review the information supporting this view and the limits on what it can show. Microsoft’s 19 October security statement treats internal AI agents as a risk even without an external attacker. It describes continuous supervision across identities, permissions, data and runtime. Its 2026 Digital Defense reporting separately describes expanding risks across interconnected digital systems.","links":[]},{"id":"otr-slide-PDF-ae29e122216020b99c26d828-33-detail-8","url":"https://ontherice.org/signals/PDF-ae29e122216020b99c26d828-33/#otr-slide-PDF-ae29e122216020b99c26d828-33-detail-8","title":"Evidence against this view","topic":"changes","kind":"research","text":"Check the opposing evidence and other explanations that could weaken this view. A supervising agent can also make mistakes. Excessive blocking could make the service unusable, while broad exceptions could reopen the same risk.","links":[]},{"id":"otr-slide-PDF-ae29e122216020b99c26d828-33-detail-9","url":"https://ontherice.org/signals/PDF-ae29e122216020b99c26d828-33/#otr-slide-PDF-ae29e122216020b99c26d828-33-detail-9","title":"What people say vs the facts","topic":"evidence","kind":"research","text":"Compare what people say with the observations, without treating attention as proof. We separate demonstrated research from promised products. These are Microsoft’s security architecture claims, not an independent audit that every proposed control works. Multiple Microsoft pages are one corporate source family.","links":[]},{"id":"otr-slide-PDF-ae29e122216020b99c26d828-33-detail-10","url":"https://ontherice.org/signals/PDF-ae29e122216020b99c26d828-33/#otr-slide-PDF-ae29e122216020b99c26d828-33-detail-10","title":"What’s changing?","topic":"evidence","kind":"research","text":"Follow the reasoning from the observations to the proposed result. A possible link is not proof. We shift the security check from the final answer to the permission needed for the next external action.","links":[]},{"id":"otr-slide-PDF-ae29e122216020b99c26d828-33-detail-11","url":"https://ontherice.org/signals/PDF-ae29e122216020b99c26d828-33/#otr-slide-PDF-ae29e122216020b99c26d828-33-detail-11","title":"What to check","topic":"evidence","kind":"research","text":"Read the details behind this part of the research and how they connect to the main idea. Measure blocked unsafe actions, mistaken blocks, time to stop a task and whether the audit log reconstructs every external change.","links":[]},{"id":"otr-slide-PDF-ae29e122216020b99c26d828-33-detail-12","url":"https://ontherice.org/signals/PDF-ae29e122216020b99c26d828-33/#otr-slide-PDF-ae29e122216020b99c26d828-33-detail-12","title":"Evidence, memory & review","topic":"evidence","kind":"research","text":"Read the details behind this part of the research and how they connect to the main idea. OTR Database Data: ZIP research ledger Q0233 (11 October 2026 18:27:42 SGT) and OMEGA-0513 (12 October 2026 08:23:45 SGT) warn against counting repeat articles from one underlying source as independent evidence. They support our evidence method, not these later technology results.","links":[]},{"id":"otr-slide-PDF-ae29e122216020b99c26d828-33-detail-13","url":"https://ontherice.org/signals/PDF-ae29e122216020b99c26d828-33/#otr-slide-PDF-ae29e122216020b99c26d828-33-detail-13","title":"People and organisations","topic":"evidence","kind":"research","text":"Identify the people, organisations or assets discussed and the part they play in the research. Microsoft Security; organisations deploying agents; identity administrators; users who approve consequential actions.","links":[]},{"id":"otr-slide-PDF-ae29e122216020b99c26d828-33-detail-14","url":"https://ontherice.org/signals/PDF-ae29e122216020b99c26d828-33/#otr-slide-PDF-ae29e122216020b99c26d828-33-detail-14","title":"OTR reasoning · Why we see this connection","topic":"evidence","kind":"research","text":"Follow the reasoning from the observations to the proposed result. A possible link is not proof. We would place enforceable checks outside the model because a model cannot be the sole judge of whether it should have permission to act.","links":[]},{"id":"otr-slide-PDF-ae29e122216020b99c26d828-33-detail-15","url":"https://ontherice.org/signals/PDF-ae29e122216020b99c26d828-33/#otr-slide-PDF-ae29e122216020b99c26d828-33-detail-15","title":"Counterpoint · Another possible explanation","topic":"evidence","kind":"research","text":"Check the opposing evidence and other explanations that could weaken this view. More supervision can itself add complexity and delay. A successful system needs evidence that risk falls without routine work becoming impossible.","links":[]},{"id":"otr-slide-PDF-ae29e122216020b99c26d828-33-detail-16","url":"https://ontherice.org/signals/PDF-ae29e122216020b99c26d828-33/#otr-slide-PDF-ae29e122216020b99c26d828-33-detail-16","title":"What changed","topic":"evidence","kind":"research","text":"See what changed in the research and why, while keeping earlier recorded views separate. Microsoft’s 19 October security statement treats internal AI agents as a risk even without an external attacker. It describes continuous supervision across identities, permissions, data and runtime. Its 2026 Digital Defense reporting separately describes expanding risks across interconnected digital systems.","links":[]},{"id":"otr-slide-PDF-ae29e122216020b99c26d828-33-detail-17","url":"https://ontherice.org/signals/PDF-ae29e122216020b99c26d828-33/#otr-slide-PDF-ae29e122216020b99c26d828-33-detail-17","title":"Why the view changed","topic":"evidence","kind":"research","text":"See what changed in the research and why, while keeping earlier recorded views separate. An agent’s ability to use tools changes the risk even when no outsider has compromised it.","links":[]},{"id":"otr-slide-PDF-ae29e122216020b99c26d828-33-detail-18","url":"https://ontherice.org/signals/PDF-ae29e122216020b99c26d828-33/#otr-slide-PDF-ae29e122216020b99c26d828-33-detail-18","title":"Evidence, memory & review 4 linked sources","topic":"sources","kind":"research","text":"Check where the information came from, when it was observed and what was verified. We retain 3 external records plus one historical OTR method record. These are not four independent experimental confirmations. These are Microsoft’s security architecture claims, not an independent audit that every proposed control works. Multiple Microsoft pages are one corporate source family.","links":[]},{"id":"otr-slide-PDF-ae29e122216020b99c26d828-33-detail-19","url":"https://ontherice.org/signals/PDF-ae29e122216020b99c26d828-33/#otr-slide-PDF-ae29e122216020b99c26d828-33-detail-19","title":"Keep exploring","topic":"evidence","kind":"research","text":"Choose how to follow this Signal or compare it with other research. Follow tests that combine permissions, tool chains and stop controls under realistic business workloads.","links":[]},{"id":"otr-slide-PDF-ae29e122216020b99c26d828-33-detail-20","url":"https://ontherice.org/signals/PDF-ae29e122216020b99c26d828-33/#otr-slide-PDF-ae29e122216020b99c26d828-33-detail-20","title":"Terms in simple English","topic":"glossary","kind":"glossary","text":"Find plain meanings for the specialist terms used in this research. Terms in simple English Runtime: where software executes. Least privilege: only the access needed for the job. Action boundary: the point before a tool changes the outside world.","links":[]}]}