Listen to this Post
Introduction:
Local AI agents are the new shadow IT. Developers run coding assistants, autonomous CLI tools, and desktop AI runtimes on managed endpoints, often without security oversight. These agents have access to source code, cloud credentials, and internal APIs – creating a blind spot for traditional EDR. Microsoft Defender now extends visibility to 20+ local AI agent types on Windows and macOS, enabling real‑time blocking, exposure assessment, and advanced hunting for agent activity. This article dissects how to operationalize this capability, detect malicious agent behavior, and harden your endpoint fleet against AI‑driven attacks.
Learning Objectives:
– Discover and inventory local AI agents (coding CLIs, agentic IDEs, desktop assistants, autonomous runtimes) using Microsoft Defender’s new discovery features.
– Block malicious AI agent activity in real time and assess identity/resource exposure across managed devices.
– Build custom Advanced Hunting queries to investigate agent execution, data exfiltration, and privilege escalation attempts.
You Should Know:
1. Enumerate Local AI Agents Across Windows & macOS with Defender Discovery
Microsoft Defender now detects over 20 agent types including GitHub Copilot CLI, Claude Code, Cursor, Windsurf, OpenClaw, and Ollama Desktop. Security teams can generate inventory reports via the Defender portal or API.
Step‑by‑step guide:
– Navigate to Microsoft 365 Defender > Endpoints > Device inventory.
– Filter by `Software` → contains `AI agent` or specific names (e.g., “Claude Code”).
– Export the list using Actions > Export devices (CSV).
– For programmatic enumeration, use the Microsoft Graph API:
PowerShell – get devices with AI agents
$token = Get-MsalToken -ClientId <your_app_id> -TenantId <tenant_id> -Scopes "https://api.security.microsoft.com/.default"
$uri = "https://api.security.microsoft.com/api/machines?`$filter=software/any(s:s/name eq 'GitHub Copilot')"
Invoke-RestMethod -Uri $uri -Headers @{Authorization = "Bearer $($token.AccessToken)"}
– On Linux (if extended by Microsoft Defender for Endpoint), use `ps aux | grep -E “ollama|claude|copilot|codex”` to manually verify local agent processes.
Why this matters: Unknown AI agents act as lateral movement vectors – an assistant with file system access can read SSH keys or .aws/credentials.
2. Block Malicious AI Agent Activity in Real Time Using Attack Surface Reduction Rules
Defender can block suspicious behaviors such as an AI agent invoking `curl` to upload sensitive files or executing unsigned child processes. Real‑time blocking requires enabling ASR rules and custom indicators.
Step‑by‑step guide:
– In Defender portal, go to Endpoints > Attack surface reduction > ASR rules.
– Enable rule `Block process creations originating from AI agents` (new GUID available via the blog).
– Create a custom indicator to block any AI agent binary from writing to `%TEMP%\.zip`:
PowerShell for Windows – add indicator New-MpPreference -AttackSurfaceReductionRules_Ids <rule_ID> -AttackSurfaceReductionRules_Actions Enabled Add-MpPreference -ControlledFolderAccessAllowedApplications "C:\Users\\AppData\Local\Claude\Claude.exe"
– For macOS (using Defender MDM profile):
Deploy configuration profile with com.microsoft.wdav.extensions blocklist sudo mdatp config real-time-protection --value enabled sudo mdatp threat policy set --1ame "AI agent block" --type process --path "/Applications/Claude Desktop.app" --action block
– Verify blocks via Advanced Hunting using `DeviceEvents | where ActionType contains “AsrRule”`
Attack simulation example: Attempt to make an AI agent read `/etc/passwd` and pipe to external IP – Defender should terminate the process.
3. Assess Exposure: Identity & Reachable Resources from Local Agents
Each AI agent runs under a user context (developer) and inherits access to SharePoint, Git repos, and internal web apps. Defender now maps agent-to-identity and agent-to-resource relationships.
Step‑by‑step guide:
– Open Defender Vulnerability Management > Exposure assessment.
– Filter by `Software` → `AI Agents`. For each agent, review `Associated identities` (UPN, local account) and `Reachable resources` (file shares, URLs, cloud buckets).
– Query via Graph API for exposure score:
import requests
GET /api/vulnerabilities/machines/{machineId}/software/{softwareId}/exposure
response = requests.get("https://api.security.microsoft.com/api/exposure/aiagents",
headers={"Authorization": f"Bearer {token}"})
print(response.json()['reachableS3Buckets'])
– Remediate: Use Conditional Access policies to restrict the developer’s account from accessing high‑value resources unless the agent is signed by corporate PKI.
Pro tip: An agent like OpenClaw (autonomous platform) can chain commands – if it has write access to a DevOps pipeline, it can push malicious code. Assess and revoke overprivileged tokens.
4. Investigate Agent Activity with Advanced Hunting Queries (KQL)
Defender’s Advanced Hunting ingests agent lifecycle events: start, file read/write, network connections, registry changes. You can hunt for data staging or beaconing.
Step‑by‑step guide:
– Go to Hunting > Advanced hunting and run these KQL queries:
Detect AI agent exfiltrating code:
DeviceProcessEvents | where InitiatingProcessFolderPath contains "claude" or "copilot" or "cursor" | where ProcessCommandLine contains "curl" or "Invoke-WebRequest" or "netcat" | project Timestamp, DeviceName, InitiatingProcessFileName, ProcessCommandLine, AccountName
Identify agents contacting unknown external domains:
DeviceNetworkEvents
| where InitiatingProcessFileName in~ ("ollama", "codex", "antigravity")
| where RemoteUrl !endswith ".microsoft.com" and RemoteUrl !endswith "github.com"
| summarize Count=count() by RemoteUrl, DeviceName
| where Count > 10
Detect agent tampering with SSH keys:
DeviceFileEvents
| where FolderPath contains ".ssh" and FileName in ("id_rsa", "authorized_keys")
| where InitiatingProcessFolderPath contains "openclaw" or "nanobot"
– Export results to CSV or create custom detection rules with scheduled alerts.
5. Harden Local AI Runtimes (Ollama, OpenClaw) Against Command Injection
Autonomous platforms like Ollama Desktop run local LLMs with API endpoints. If misconfigured, attackers can exploit them to run arbitrary commands via prompt injection.
Step‑by‑step guide for Linux/macOS:
– Restrict Ollama to localhost only (default is `0.0.0.0:11434`):
Edit systemd service or launch with OLLAMA_HOST export OLLAMA_HOST="127.0.0.1:11434" ollama serve
– Use iptables/nftables to block external access:
sudo iptables -A INPUT -p tcp --dport 11434 -s 127.0.0.1 -j ACCEPT sudo iptables -A INPUT -p tcp --dport 11434 -j DROP
– For OpenClaw (agentic automation), disable dangerous plugins by editing `~/.openclaw/config.yaml`:
plugins: - name: filesystem enabled: false - name: subprocess allowed_commands: [] block all command execution
– On Windows, use AppLocker or WDAC to only allow signed AI agent binaries from trusted publishers.
6. Real‑time Response: Automate Isolation When AI Agent Becomes Rogue
Defender supports automated playbooks – if an AI agent triggers multiple high‑severity alerts, isolate the device or kill the agent process tree.
Step‑by‑step guide:
– Create an automation rule in Defender (Settings > Endpoints > Automation rules):
– Trigger: `Alert severity = High` and `Alert title contains “AI agent”`
– Actions: `Run PowerShell script` on device:
Get-Process -1ame "claude", "copilot", "codex" | Stop-Process -Force Set-MpPreference -DisableRealtimeMonitoring $false ensure Defender still active
– Add second action: `Isolate device from network` for 60 minutes.
– Test by simulating a malicious agent (e.g., a script named `cursor.exe` that tries to access LSASS). Defender should trigger isolation.
7. Build a Training Course for Developers on Secure AI Agent Usage
Security teams must train developers to run local agents within guardrails. Create a 2‑hour workshop covering agent permissions, data leakage risks, and reporting policy violations.
Course outline and commands:
– Module 1: Discovering agents on your own machine – run PowerShell script to list all installed AI tools:
Get-ChildItem "C:\Users\$env:USERNAME\AppData\Local" -Directory | Where-Object {$_.Name -match "Copilot|Claude|Cursor|Ollama"}
– Module 2: Blocking unintended outbound connections – use Windows Firewall to restrict agent to corporate proxy:
New-1etFirewallRule -DisplayName "Block Claude External" -Direction Outbound -Program "C:\Program Files\Claude\Claude.exe" -Action Block -RemoteAddress "10.0.0.0/8","172.16.0.0/12" -RemoteAddress $false
– Module 3: Reporting suspicious agent behavior – create a Microsoft Forms link integrated with Defender API to auto-quarantine reported agents.
– Provide hands‑on lab: Developers attempt to exfiltrate a dummy secret via a local AI agent while Defender blocks it – this demonstrates real‑time protection.
What Undercode Say:
– Key Takeaway 1: Defender’s extension to local AI agents transforms them from shadow risk to manageable assets. The ability to discover 20+ agent types and block in real time closes a critical gap that no other EDR currently addresses.
– Key Takeaway 2: Advanced Hunting with KQL is the most powerful feature – security teams can now correlate agent process trees with network flows and file events to detect data staging, credential theft, and command injection without deploying additional sensors.
Analysis (10 lines):
Microsoft’s move acknowledges that AI agents have become de facto endpoint applications, not just developer toys. Traditional EDRs fail because agents often use interpretative execution (Python scripts, Node.js runtimes) that look legitimate. Defender’s agent‑specific telemetry – such as identifying the `Claude Code` CLI vs a regular bash session – enables precise policy enforcement. The real‑time blocking capability is especially critical for autonomous agents like OpenClaw, which can chain multiple commands without human approval. However, security teams must complement this with identity controls: an agent inheriting a domain admin’s token is still a disaster, even if blocked from writing to disk. The blog and docs (linked below) provide ASR rule GUIDs and sample KQL, but missing from the announcement is Linux coverage for agents like Ollama – many AI runtimes run on Ubuntu development VMs. Expect Microsoft to extend this to Linux in Q3 2026. Organizations should immediately run the discovery script and create low‑severity alerts for any unexpected agent type (e.g., “ZeroClaw” appearing on a finance workstation). Finally, pair this with VDI hardening – agents running on persistent VDI often have cached cloud tokens, making them prime targets.
Prediction:
– -1 Increased targeting of AI agent supply chains – Attackers will backdoor popular VS Code extensions or publish malicious “agentic IDEs” on package registries. Defender’s discovery will need to evolve to detect behavioral anomalies (e.g., an agent that suddenly starts keylogging). Expect a surge in “prompt theft” where malicious agents trick developers into revealing API keys via social engineering inside the AI chat interface.
– +1 Defender becomes the de facto standard for AI endpoint security – By integrating agent visibility natively, Microsoft forces competitors (CrowdStrike, SentinelOne) to release similar features within 12 months. This will drive standardization of AI agent telemetry schemas (likely via OCSF), making cross‑platform detection rules reusable.
– -1 False positive fatigue from over‑blocking – Security teams that enable all ASR rules for AI agents will break legitimate developer workflows (e.g., a coding agent needing to access `~/.npmrc`). Without granular per‑agent allowlists, organizations may turn off protections. Microsoft must add “developer mode” exemptions based on certificate signing or corporate device compliance.
– +1 Integration with Purview DLP – Within 18 months, Defender will label AI agent exfiltration attempts (e.g., an agent pasting source code into ChatGPT Desktop) as a DLP violation, triggering automated legal hold and user remediation. This will be a game changer for regulated industries (finance, healthcare).
Blog & docs: [Microsoft Blog](https://lnkd.in/dMK7Kuj5) | [Documentation](https://lnkd.in/dhJK7q3C)
▶️ Related Video (64% Match):
🎯Let’s Practice For Free:
🎓 Live Courses & Certifications:
[Join Undercode Academy for Verified Certifications](https://undercode.co.uk/certifications/)
🚀 Request a Custom Project:
Secure, high-velocity infrastructure and disruptive technological engineering. Contact our engineering team for high-tier development and proprietary systems:
[[email protected]](mailto:[email protected])
💎 Smart Architecture | 🛡️ Secure by Design | ⭐ Trusted by Thousands
IT/Security Reporter URL:
Reported By: [Markolauren Agents](https://www.linkedin.com/posts/markolauren_agents-devices-share-7467610563699990528-0CLG/) – Hackers Feeds
Extra Hub: Undercode MoN
Basic Verification: Pass ✅
🔐JOIN OUR CYBER WORLD [ CVE News • HackMonitor • UndercodeNews ]
[💬 Whatsapp](https://undercode.help/whatsapp) | [💬 Telegram](https://t.me/UndercodeCommunity)
📢 Follow UndercodeTesting & Stay Tuned:
[𝕏 formerly Twitter 🐦](https://x.com/undercodeupdate) | [@ Threads](https://www.threads.net/@undercodetesting) | [🔗 Linkedin](https://www.linkedin.com/company/undercodetesting/) | [🦋BlueSky](https://bsky.app/profile/undercode.bsky.social)
