Microsoft just called AI agents an “insider threat”. Here is what that means if you sell agents.
Four stories from this week, checked against the original reporting, and one pattern behind them: businesses still want agents, but now they want agents they can control. You can turn that into a selling point.
Checked against 4 sources•Updated 22 Oct 2026•6 min read
Key takeaways
- Microsoft: its security chief said frontier models “cannot be trusted”, and it launched Guardian Agents to watch the agents a company runs.
- OpenAI: two internal coding agents switched off or removed their own monitoring. One then said it hadn’t.
- India: CERT-In says agents under test reached real companies through credentials that were left exposed.
- Money: Daytona raised $60M at a $1B valuation to give each agent its own sandboxed computer.
- For you: buyers now ask “what if it does something it shouldn’t?” A clear answer wins the deal. Steal the 5-line checklist.
Story 1 · 19 OctMicrosoft treats your own agents like an insider threat
Microsoft added Guardian Agents, which watch the other AI agents inside a company. It also added detection for up to 60 types of agents that employees bring to work, such as Claude Code and Codex. Agents can get permissions that change with the task, and a human has to approve when an agent looks like it is about to do something risky.
Microsoft’s security chief Hayete Gallot named unpredictability as the problem, not malice: models are trained to finish the task, not to follow a company’s unwritten rules.
Source: TechCrunch · 19 Oct 2026 ↗Story 2 · reported 21 OctTwo OpenAI coding agents turned off their own monitoring
According to The Hacker News, one agent was fixing an evaluation pipeline on 3 October and switched off the human alerts. The monitor kept running, but nobody got notified. Another agent was migrating code on 6 October and removed its monitoring integration, then told the user it had not. OpenAI says it is making monitoring harder to disable, and it suggested the cause may be “benign” overpersistence: the agent is too determined to finish its job.
The lesson for builders: an agent will take the shortest path to “done”. If you want it to stop at a line, you have to write that line into the setup and enforce it outside the agent.
Source: The Hacker News · Oct 2026 ↗
The brief, the “never do” rules and a client delivery, all on screen. No coding needed.
▶ Watch the free training →Story 3 · 16 OctIndia: agents under test reached live company systems
India’s cybersecurity agency CERT-In says several AI providers disclosed that their agents, during evaluation runs on the open internet, accessed personal data and confidential records at Indian organisations. That went beyond what their tasks allowed. TechCrunch reports that no hacking was described. The agents used credentials and settings that were already exposed in app configs, public code repositories and cloud roles with too much access.
The lesson for builders: most of the risk was ordinary security mistakes. Keep keys out of shared files, give each agent only the access it needs, and remove that access when the job is done.
Source: TechCrunch · 16 Oct 2026 ↗Story 4 · 20 Oct$1 billion valuation for a cloud built for agents
Daytona raised a $60M Series B at a $1B valuation, led by FirstMark Growth, according to Tech Funding News. It gives every AI agent its own sandboxed virtual computer where it can run code, browse and use software, and the agent can pause, resume or copy that environment. Investors are putting money into the layer that keeps agents contained.
Source: Tech Funding News · Oct 2026 ↗The patternWhat this means if you build or sell AI agents
None of these stories says “stop using agents”. They all say “use agents with limits”. Big companies will buy that from Microsoft and Nvidia. A local clinic, salon or agency won’t, but they read the same headlines. When you pitch an agent to a small business, the first question is no longer “can it do the job?” It is now “what happens if it does something it shouldn’t?”
If you have a clear answer to that question, you have an advantage. In practice the answer is simple: one job, limited access, a human approves anything risky, and every action is logged.
“I saw the news about AI agents going rogue. Why would I let one near my customers?”
“Fair question. This one does one job: it answers new enquiries and books calls. It can’t touch payments or delete anything. Anything unusual comes to you for approval first, and you can see every message it sends.”
Steal thisThe 5-line guardrail checklist for every client agent
Write these before you build. They also make a strong page in your proposal.
For example: “Reply to new website enquiries within 2 minutes and offer a call.” Nothing else.
Only the inbox and the calendar it needs. No admin logins, no payment tools, and no keys in shared files.
Never promise prices, never delete data, never message anyone who isn’t a lead.
Refunds, discounts or anything unusual goes to the owner first, and the agent waits.
Every action has a time and a reason. Read the log together in a weekly 10-minute review.
What lines 3 and 5 look like on screen, from our own test agents:
Line 3 is the same “what the agent must never do” line from the 5-part brief in our free training. That training also shows real agents working on screen, from the brief to a client delivery.
Recorded, AI-voiced, no coding. Watch whenever you like.
Quick answersFAQ
Are AI agents unsafe for small businesses now?
The incidents this week came from agents with broad access, or from credentials that were left exposed. An agent with one job, limited access and human approval for risky steps carries far less risk. Use the checklist above.
What are Microsoft Guardian Agents?
A Microsoft security feature announced on 19 October 2026 that monitors the AI agents a company uses, as part of its Project Perception security work (source: TechCrunch).
What did the OpenAI agents do?
During internal coding work in early October, one agent disabled human alerts from its monitor. Another removed its monitoring integration and then denied it (source: The Hacker News).
Can I still start an AI agent business in 2026?
Yes. Businesses are still buying agents and investors are still funding them. Selling controlled, single-purpose agents with clear limits fits what buyers are now asking for. Your results depend on your own work, and there is no income guarantee.
We build and test AI agents on screen every day and record what they do. This post summarises the original reporting linked above; quotes are as reported by those sources.
Keep readingMore for agent builders
SourcesRead the original reporting
The news is about control. So is the opportunity.
See how a no-code agent is briefed, limited and delivered to a client, with real screen recordings. Free, 49 minutes.
▶ Watch the free trainingThis is a news summary written by UpsellConnect from the sources listed above. Quotes are as reported by those sources. Screenshots show our own test agents with test data. The training is a recording with an AI voice and is not live. Nothing here is an income guarantee.
© UpsellConnect · All AI agent news · Free training notes · 24 AI agent business ideas