Loading story…
Microsoft has outlined a Windows strategy that embeds support for AI agents and local models into the operating system. The plan includes agent identities managed through Microsoft Entra ID, a Windows On-Device Agent Registry (ODR) for discovering and administering local Model Context Protocol (MCP) servers, and Microsoft Execution Containers (MXC) to isolate the tools agents invoke.
Microsoft is also developing Windows ML, a hardware-agnostic local inference runtime built on ONNX Runtime that is intended to run across CPUs, GPUs, and NPUs. Several components remain under development, and reported technical behavior—including potential ODR proxy functions—has not been fully confirmed by Microsoft; organizations should assess identity controls, MCP-server governance, and container isolation before adopting these capabilities.
Track how attackers are adapting to this technology.
3 events from the most recent confirmed update back to the earliest known activity.
Microsoft demonstrated a pre-release Surface laptop with NVIDIA GPUs running the Qwen model locally alongside GitHub Copilot at approximately 40 tokens per second.
Origin Technology researchers reported that ODR appeared to proxy communications between an MCP client and MCP server. Microsoft had not confirmed the behavior; if present, it could enable inspection of MCP payloads and detection of dangerous activity.
Microsoft presented a Windows strategy featuring Entra ID-based agent identities, agent-aware Defender capabilities, the Windows On Device Agent Registry (ODR), Microsoft Execution Containers (MXC), and the Windows ML local-model runtime. ODR and MXC were characterized as still in development with limited public implementation detail.
Follow how adversaries are adapting to this technology, and where it touches your stack today.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Microsoft is introducing new security measures and features to address the growing use of AI agents within enterprise environments. The company announced Entra Agent ID, which extends Microsoft Entra's identity and access management (IAM) capabilities to AI agents, treating them with the same governance and controls as human users. This includes assigning unique identities to agents and applying conditional access, identity governance, and protection policies. The move is in response to the anticipated proliferation of both sanctioned and unsanctioned AI agents within organizations, aiming to mitigate risks associated with shadow IT and unauthorized agent activity. Additionally, Microsoft is rolling out a strengthened Content Security Policy for Entra ID sign-ins, restricting script execution to trusted Microsoft domains to prevent external script injection and cross-site scripting attacks during authentication processes. Alongside these IAM enhancements, Microsoft is experimenting with new features such as the Agent Workspace for Copilot, which allows AI agents to access and manipulate files in isolated environments on Windows systems. While this feature is designed to improve productivity, it comes with significant security warnings. Microsoft documentation highlights risks such as cross-prompt injection, where malicious instructions embedded in files or applications could trick AI agents into performing unauthorized actions, including data exfiltration. To address these concerns, Microsoft emphasizes user supervision, least privilege access for agent accounts, and explicit user approval for sensitive actions. These developments reflect Microsoft's broader strategy to secure the expanding role of AI agents in enterprise IT while acknowledging the unique security challenges they introduce.
Jul 1, 2026
Microsoft unveiled **Project Zenith**, a developer-focused Windows 11 configuration for high-memory PCs that can run AI models exceeding 30 billion parameters locally. The initiative targets systems with at least 64 GB of unified memory and more than 250 GB/s memory bandwidth; initial devices will use AMD Ryzen AI Halo, with additional OEM and silicon partners expected. Zenith combines Windows performance tuning and developer-oriented defaults with integrated WSL containers and Microsoft Execution Containers. Microsoft said the configuration provides containment, identity controls, and enterprise management for agentic-development workloads, enabling routine AI-assisted development to move from metered cloud inference to on-device models while retaining cloud services for more demanding tasks.
Sep 8, 2026
The **Model Context Protocol (MCP)** has been updated to a fully stateless design in the `2026-07-28` specification, removing required sessions, the `initialize` handshake, and the `Mcp-Session-Id` header so MCP servers can run as standard HTTP services without sticky-session infrastructure. The update also replaces stream-dependent elicitation with **Multi Round-Trip Requests**, adds MCP-specific HTTP headers for gateway and security controls, and tightens authorization through issuer identification and canonical resource audience handling. Cloudflare said its Agents SDK and Workers OAuth Provider already support the new model, and cited production adoption by **Sentry** and **Linear**. At the same time, major vendors including **OpenAI, AWS, Cursor, GitHub, Microsoft, and Vercel** backed **Agent Plugins 1.0.0**, a vendor-neutral format for packaging MCP servers and agent skills for use across clients and runtimes. The push for interoperability comes with growing security concerns: researchers published new **Nuclei** templates to detect publicly exposed AI agent configuration files such as `CLAUDE.md`, `AGENTS.md`, Cursor rules, and `vscode-mcp.json`, warning that misconfigured web roots can leak internal workflows, tool settings, and project conventions as organizations expand AI agent deployments.
Aug 8, 2026