As local agents have moved from experimentation into everyday work, traditional security visibility is no longer enough. Unlike static software, local agents such as coding assistants, command-line agents, desktop applications, and agentic development environments can operate on endpoints with access to a user's data, credentials, tools, and services. They can also connect to Model Context Protocol (MCP) servers that extend their access to additional tools and data. This change requires security teams to look beyond. They need to understand which local agents are running and where, which users and devices these agents are associated with, and which MCP servers these agents are configured to use.
To address this challenge, at Microsoft Build 2026, we introduced new Microsoft Defender capabilities to help security teams discover and protect more than 20 types of local AI agents. Today, discovery of AI agents and their configured MCP servers on Windows and macOS is generally available, with discovery coverage expanded to more than 50 supported agents and MCP servers. On eligible, onboarded devices, Defender discovers supported agents by observing their activity and brings the agent, device, account, and configured MCP context together to give security teams visibility for their local agent environment.
Beyond discovery, runtime protection for local agents for Windows continues to be available in preview, helping protect discovered agents as they operate. Teams can deploy runtime protection at scale from either the Microsoft Defender portal or the Microsoft Intune portal, with Intune-based deployment available in preview. Both discovery and runtime protection for local agents will be available for Microsoft Defender for Endpoint P2 and higher customers.
See the local agents and associated MCPs operating in your environment
In the Defender portal, security teams can see the discovered agents under Assets. The inventory associates each agent with the device and user account where it runs and includes details such as agent name, version, vendor, related process, and discovery history. Examples of supported local AI agents include:
- CLI agents: Claude Code, Codex CLI, Gemini CLI, GitHub Copilot CLI
- Desktop applications: ChatGPT Desktop, Claude Desktop, Codex Desktop, GitHub Copilot app, Microsoft Copilot app, Ollama Desktop, Perplexity Desktop
- Agentic IDEs: Cursor, Devin Desktop, Kiro IDE, Antigravity IDE
- VS Code extensions: Claude Code, Cline, Codex, Gemini Code Assist, GitHub Copilot, Roo Code
- Claw-based agents: OpenClaw, Clawpilot, QClaw
We will continue expanding support for agents across both discovery and runtime protection. The supported agent list continues to evolve; see AI agent support matrix for the current list.
[Screenshot 1: Local AI agent inventory in the Microsoft Defender portal]In addition, security teams can see supported local and remote MCP server configurations associated with discovered agents. Depending on the configuration, details such as the MCP server name, type, endpoint, or the command used to start a local server are visible, helping teams understand not only which agents are present, but also the tools and services those agents can access.
[Screenshot 2: Local AI agent details showing associated MCP server configurations]Assess exposure and investigate local agents
After discovering agents, security teams need to understand what those agents are connected to and what risk they may introduce. The exposure graph in Defender provides a clear visual of the agent’s blast radius including the agent associated devices, identities, and MCP context. These data sources can be used to investigate agent activity in advanced hunting, alongside the data from endpoints, identities, email, and cloud. Risk indicators and security recommendations are also available to help teams prioritize risks.
For ready-to-use queries, see Discover local AI agents with Microsoft Defender.
Secure local agents while they operate
AI agents are good for productivity, but they also undeniably introduce new security risks to organizations. For example, prompt injection can be hidden in a file, web page, repository, or tool response that an agent reads. If the agent follows an attacker’s instructions, the attacker could attempt to misuse the user's access, run unwanted commands, modify code, or expose sensitive information.
Defender inspects supported points in the agent loop and stops malicious instruction before an agent acts on them. When Defender detects prompt injection, it raises a suspicious AI prompt injection alert with agent and session context. Administrators can view detections and validate accuracy in audit mode, then move selected device groups to block mode for enforcement. In block mode, Defender can stop the action before it continues and notify the user in the agent experience and through Windows.
In preview, Defender currently supports runtime protection via agent-native event inspection and network inspection for discovered agents for Windows; coverage varies by agent and inspection approach.
- Agent-native event inspection (Hooks) uses vendor-supported event interfaces to inspect user prompts, tool requests before execution, and tool responses after execution.
- Network inspection extends protection to supported agents that don't expose an agent-native event interface by inspecting supported agent-to-model network flows.
Security teams can investigate agent-related threats in Defender with the rich context of existing endpoint protection, alerting, incident correlation, and investigation workflows.
[Screenshot 3: Runtime protection blocking a prompt injection, with the corresponding Defender alert]Deploy runtime protection at scale
As local AI agent adoption grows, security teams need a scalable way to deploy runtime protection consistently across managed devices in the organization. In Defender, security teams can create a Windows policy, select the Microsoft Defender AI agent runtime protection profile and configure AI Agent protection settings with one of three values:
- Default: Runtime protection is disabled.
- Audit: Defender detects and reports prompt injection while allowing the supported agent action to continue.
- Block: Defender detects prompt injection and blocks supported agent actions before they run.
We recommend beginning with a limited group in Audit mode, reviewing detections for one to two weeks, and then moving to Block mode when your organization is ready to enforce protection.
[Screenshot 4: Deploy AI agent runtime protection with Microsoft Defender]In public preview, Microsoft Intune also provides a native AI agent runtime protection for Microsoft Defender endpoint security policies. Security teams can configure agent-native event inspection on enrolled Windows devices without relying on a custom deployment script. Now, security teams can choose either Microsoft Defender portal or Microsoft Intune portal to deploy runtime protection at scale.
For configuration requirements and deployment steps, see Set up AI agent runtime protection with Microsoft Defender for Endpoint.
To safely validate your configuration on a test device, see AI agent runtime protection demonstration.
Learn more:
Microsoft