OpenAI acquires Promptfoo to embed AI red-teaming and security testing directly into its Frontier agent platform, signaling that agent safety is now table stakes.
Over the weekend, Andrej Karpathy—the influential former Tesla AI lead and co-founder and former member of OpenAI who coined the term “vibe coding”— posted on X about his new open source project, autoresearch.
It wasn’t a finished model or a massive corporate product: it was by his own admission a simple, 630-line script made available on Github under a permissive, enterprise-friendly MIT License. But the ambition was massive: automating the scientific method with AI agents while us humans sleep.
“The goal is to engineer your agents to make the fastest research progress indefinitely and without any of your own involvement,” he stated on X.
The system functions as an autonomous optimization loop. An AI agent is given a training script and a fixed compute budget (typically 5 minutes on a GPU).
It reads its own source code, forms a hypothesis for improvement (such as changing a learning rate or an architecture depth), modifies the code, runs the experiment, and evaluates the results.
If the validation loss—measured in bits per byte (val_bpb)—improves, it keeps the change; if not, it reverts and tries again. In one overnight run, Karpathy’s agent completed 126 experiments, driving loss down from 0.9979 to 0.9697.
Today, Karpathy reported that after leaving the agent to tune a “depth=12” model for two days, it successfully processed approximately 700 autonomous changes.
The agent found roughly 20 additive improvements that transferred perfectly to larger models. Stacking these changes dropped the “Time to GPT-2” metric on the leaderboard from 2.02 hours to 1.80 hours—an 11% efficiency gain on a project Karpathy believed was already well-tuned.
“Seeing the agent do this entire workflow end-to-end and all by itself… is wild,” Karpathy remarked, noting that the agent caught oversights in attention scaling and regularization that he had missed manually over two decades of work.
This is more than just a productivity hack; it is a fundamental shift in how intelligence is refined. By automating the “scientific method” for code, Karpathy has turned machine learning into an evolutionary process that runs at the speed of silicon rather than the speed of human thought.
And more than this, it showed the broader AI and machine learning community on X that this type of process could be applied far beyond computer science, to fields like marketing, health, and, well, basically anything that requires research.
The reaction was swift and viral, with Karpathy’s post garnering more than 8.6 million views in the intervening two days as builders and researchers scrambled to scale the “Karpathy loop”.
Varun Mathur, CEO of AI tool aggregator platform Hyperspace AI, took the single-agent loop and distributed it across a peer-to-peer network. Every node running the Hyperspace agent became an autonomous researcher.
On the night of March 8–9, 35 autonomous agents on the Hyperspace network ran 333 experiments completely unsupervised. The results were a masterclass in emergent strategy:
Hardware Diversity as a Feature: Mathur noted that while H100 GPUs used “brute force” to find aggressive learning rates, CPU-only agents on laptops were forced to be clever. These “underdog” agents focused on initialization strategies (like Kaiming and Xavier init) and normalization choices because they couldn’t rely on raw throughput.
Gossip-Based Discovery: Using the GossipSub protocol, agents shared their wins in real-time. When one agent found that Kaiming initialization dropped loss by 21%, the idea spread through the network like a digital virus. Within hours, 23 other agents had incorporated the discovery into their own hypotheses.
The Compression of History: In just 17 hours, these agents independently rediscovered ML milestones—such as RMSNorm and tied embeddings—that took human researchers at labs like Google Brain and OpenAI nearly eight years to formalize.
While the ML purists focused on loss curves, the business world saw a different kind of revolution. Eric Siu, founder of ad agency Single Grain, applied autoresearch to the “Experiment Loop” of marketing.
“Most marketing teams run ~30 experiments a year,” Siu wrote on X. “The next generation will run 36,500+. Easily.” He continued:
“They’ll run experiments while they sleep.
Current marketing teams run 20-30 experiments a year. Maybe 52 if they’re ‘good’.
New landing page.
New ad creative.
Maybe a subject line test.
That’s considered “data-driven marketing.”
But the next generation of marketing systems will run 36,500+ experiments per year.”
Siu’s framework replaces the training script with a marketing asset—a landing page, an ad creative, or a cold email. The agent modifies a variable (the subject line or the CTA), deploys it, measures the “positive reply rate,” and keeps or discards.
Siu argues that this creates a “proprietary map” of what resonates with a specific audience—a moat built not of code, but of experiment history. “The companies that win won’t have better marketers,” he wrote, “they’ll have faster experiment loops”.
Despite the fervor, the GitHub Discussions revealed a community grappling with the implications of such rapid, automated progress.
The Over-Optimization Trap: Researcher alexisthual raised a poignant concern: “Aren’t you concerned that launching that many experiments will eventually ‘spoil’ the validation set?”. The fear is that with enough agents, parameters will be optimized for the specific quirks of the test data rather than general intelligence.
The Meaning of the Gains: User samionb questioned whether a drop from 0.9979 to 0.9697 was truly noticeable. Karpathy’s response was characteristically direct: “All we’re doing is optimizing performance per compute… these are real and substantial gains”
The Human Element: On X, user witcheer, Head of Growth at crypto platform Yari Finance, documented their own overnight run on a Mac Mini M4, noting that while 26 of 35 experiments failed or crashed, the seven that succeeded revealed that “the model got better by getting simpler”.
This insight—that less is often more—was reached without a single human intervention.
The release of autoresearch suggests a future of research across domains where, thanks to simple AI instruction mechanisms, the role of the human shifts from “experimenter” to “experimental designer.”
As tools like DarkMatter, Optimization Arena, and NanoClaw emerge to support this swarm, the bottleneck of AI progress is no longer the “meat computer’s” (Karpathy’s description of the human brain’s) ability to code—it is our ability to define the constraints of the search.
Andrej Karpathy has once again shifted the vibe. We are no longer just coding models; we are seeding ecosystems that learn while we sleep.
The RØDECaster Video Core comes hot on the heels of the RØDECaster Video S and is the latest product in RØDE’s range of all-in-one video and audio production consoles.
AI dominance, liquidity recovery, and selective capital define 2026 venture capital, as investors shift from hype to real value creation across tech sectors.
Anthropic on Monday released Code Review, a multi-agent code review system built into Claude Code that dispatches teams of AI agents to scrutinize every pull request for bugs that human reviewers routinely miss. The feature, now available in research preview for Team and Enterprise customers, arrives on what may be the most consequential day in the company’s history: Anthropic simultaneously filed lawsuits against the Trump administration over a Pentagon blacklisting, while Microsoft announced a new partnership embedding Claude into its Microsoft 365 Copilot platform.
The convergence of a major product launch, a federal legal battle, and a landmark distribution deal with the world’s largest software company captures the extraordinary tension defining Anthropic’s current moment. The San Francisco-based AI lab is simultaneously trying to grow a developer tools business approaching $2.5 billion in annualized revenue, defend itself against an unprecedented government designation as a national security threat, and expand its commercial footprint through the very cloud platforms now navigating the fallout.
Code Review is Anthropic’s most aggressive bet yet that engineering organizations will pay significantly more — $15 to $25 per review — for AI-assisted code quality assurance that prioritizes thoroughness over speed. It also signals a broader strategic pivot: the company isn’t just building models, it’s building opinionated developer workflows around them.
Code Review works differently from the lightweight code review tools most developers are accustomed to. When a developer opens a pull request, the system dispatches multiple AI agents that operate in parallel. These agents independently search for bugs, then cross-verify each other’s findings to filter out false positives, and finally rank the remaining issues by severity. The output appears as a single overview comment on the PR along with inline annotations for specific bugs.
Anthropic designed the system to scale dynamically with the complexity of the change. Large or intricate pull requests receive more agents and deeper analysis; trivial changes get a lighter pass. The company says the average review takes approximately 20 minutes — far slower than the near-instant feedback of tools like GitHub Copilot’s built-in review, but deliberately so.
“We built Code Review based on customer and internal feedback,” an Anthropic spokesperson told VentureBeat. “In our testing, we’ve found it provides high-value feedback and has helped catch bugs that we may have missed otherwise. Developers and engineering teams use a range of tools, and we build for that reality. The goal is to give teams a capable option at every stage of the development process.”
The system emerged from Anthropic’s own engineering practices, where the company says code output per engineer has grown 200% over the past year. That surge in AI-assisted code generation created a review bottleneck that the company says it now hears about from customers on a weekly basis. Before Code Review, only 16% of Anthropic’s internal PRs received substantive review comments. That figure has jumped to 54%.
Crucially, Code Review does not approve pull requests. That decision remains with human reviewers. Instead, the system functions as a force multiplier, surfacing issues so that human reviewers can focus on architectural decisions and higher-order concerns rather than line-by-line bug hunting.
The pricing will draw immediate scrutiny. At $15 to $25 per review, billed on token usage and scaling with PR size, Code Review is substantially more expensive than alternatives. GitHub Copilot offers code review natively as part of its existing subscription, and startups like CodeRabbit operate at significantly lower price points. Anthropic’s more basic code review GitHub Action — which remains open source — is itself a lighter-weight and cheaper option.
Anthropic frames the cost not as a productivity expense but as an insurance product. “For teams shipping to production, the cost of a shipped bug dwarfs $20/review,” the company’s spokesperson told VentureBeat. “A single production incident — a rollback, a hotfix, an on-call page — can cost more in engineer hours than a month of Code Review. Code Review is an insurance product for code quality, not a productivity tool for churning through PRs faster.”
That framing is deliberate and revealing. Rather than competing on speed or price — the dimensions where lightweight tools have an advantage — Anthropic is positioning Code Review as a depth-first tool aimed at engineering leaders who manage production risk. The implicit argument is that the real cost comparison isn’t Code Review versus CodeRabbit, but Code Review versus the fully loaded cost of a production outage, including engineer time, customer impact, and reputational damage.
Whether that argument holds up will depend on the data. Anthropic has not yet published external benchmarks comparing Code Review’s bug-detection rates against competitors, and the spokesperson did not provide specific figures on bugs caught per dollar or developer hours saved when asked directly. For engineering leaders evaluating the tool, that gap in publicly available comparative data may slow adoption, even if the theoretical ROI case is compelling.
Anthropic’s internal usage data provides an early window into the system’s performance characteristics. On large pull requests exceeding 1,000 lines changed, 84% receive findings, averaging 7.5 issues per review. On small PRs under 50 lines, that drops to 31% with an average of 0.5 issues. The company reports that less than 1% of findings are marked incorrect by engineers.
That sub-1% figure is the kind of stat that demands careful unpacking. When asked how “marked incorrect” is defined, the Anthropic spokesperson explained that it means “an engineer actively resolving the comment without fixing it. We’ll continue to monitor feedback and engagement while Code Review is in research preview.”
The methodology matters. This is an opt-in disagreement metric — an engineer has to take the affirmative step of dismissing a finding. In practice, developers under time pressure may simply ignore irrelevant findings rather than actively marking them as wrong, which would cause false positives to go uncounted. Anthropic acknowledged the limitation implicitly by noting the system is in research preview and that it will continue monitoring engagement data. The company has not yet conducted or published a controlled evaluation comparing agent findings against a ground-truth baseline established by expert human reviewers.
The anecdotal evidence is nonetheless striking. Anthropic described a case where a one-line change to a production service — the kind of diff that typically receives a cursory approval — was flagged as critical by Code Review because it would have broken authentication for the service. In another example involving TrueNAS’s open-source middleware, Code Review surfaced a pre-existing bug in adjacent code during a ZFS encryption refactor: a type mismatch that was silently wiping the encryption key cache on every sync. These are precisely the categories of bugs — latent issues in touched-but-unchanged code, and subtle behavioral changes hiding in small diffs — that human reviewers are statistically most likely to miss.
The Code Review launch does not exist in a vacuum. On the same day, Anthropic filed two lawsuits — one in the U.S. District Court for the Northern District of California and another in the D.C. Circuit Court of Appeals — challenging the Trump administration’s decision to label the company a supply chain risk to national security, a designation historically reserved for foreign adversaries.
The legal confrontation stems from a breakdown in contract negotiations between Anthropic and the Pentagon. As CNN reported, the Defense Department wanted unrestricted access to Claude for “all lawful purposes,” while Anthropic insisted on two redlines: that its AI would not be used for fully autonomous weapons or mass domestic surveillance. When talks collapsed by a Pentagon-set deadline on February 27, President Trump directed all federal agencies to cease using Anthropic’s technology, and Defense Secretary Pete Hegseth formally designated the company a supply chain risk.
According to CNBC, the complaint alleges that these actions are “unprecedented and unlawful” and are “harming Anthropic irreparably,” with the company stating that contracts are already being cancelled and “hundreds of millions of dollars” in near-term revenue are in jeopardy.
“Seeking judicial review does not change our longstanding commitment to harnessing AI to protect our national security,” the Anthropic spokesperson told VentureBeat, “but this is a necessary step to protect our business, our customers, and our partners. We will continue to pursue every path toward resolution, including dialogue with the government.”
For enterprise buyers evaluating Code Review and other Claude-based tools, the lawsuit introduces a novel category of vendor risk. The supply chain risk designation doesn’t just affect Anthropic’s government contracts — as CNBC reported, it requires defense contractors to certify they don’t use Claude in their Pentagon-related work. That creates a chilling effect that could extend well beyond the defense sector, even as the company’s commercial momentum accelerates.
The market’s response to the Pentagon crisis has been notably bifurcated. While the government moved to isolate Anthropic, the company’s three largest cloud distribution partners moved in the opposite direction.
Microsoft on Monday announced it is integrating Claude into Microsoft 365 Copilot through a new product called Copilot Cowork, developed in close collaboration with Anthropic. As Yahoo Finance reported, the service enables enterprise users to perform tasks like building presentations, pulling data into Excel spreadsheets, and coordinating meetings — the kind of agentic productivity capabilities that sent shares of SaaS companies like Salesforce, ServiceNow, and Intuit tumbling when Anthropic first debuted its Cowork product on January 30.
The timing is not coincidental. As TechCrunch reported last week, Microsoft, Google, and Amazon Web Services all confirmed that Claude remains available to their customers for non-defense workloads. Microsoft’s legal team specifically concluded that “Anthropic products, including Claude, can remain available to our customers — other than the Department of War — through platforms such as M365, GitHub, and Microsoft’s AI Foundry.”
That three of the world’s most powerful technology companies publicly reaffirmed their commitment to distributing Anthropic’s models — on the same day the company sued the federal government — tells enterprise customers something important about the market’s assessment of both Claude’s technical value and the legal durability of the supply chain risk designation.
For organizations considering Code Review, the data handling question looms especially large. The system necessarily ingests proprietary source code to perform its analysis. Anthropic’s spokesperson addressed this directly: “Anthropic does not train models on our customers’ data. This is part of why customers in highly regulated industries, from Novo Nordisk to Intuit, trust us to deploy AI safely and effectively.”
The spokesperson did not detail specific retention policies or compliance certifications when asked, though the company’s reference to pharmaceutical and financial services clients suggests it has undergone the kind of security review those industries require.
Administrators get several controls for managing costs and scope, including monthly organization-wide spending caps, repository-level enablement, and an analytics dashboard tracking PRs reviewed, acceptance rates, and total costs. Once enabled, reviews run automatically on new pull requests with no per-developer configuration required.
The revenue figure Anthropic confirmed — a $2.5 billion run rate as of February 12 for Claude Code — underscores just how quickly developer tooling has become a material revenue line for the company. The spokesperson pointed to Anthropic’s recent Series G fundraise for additional context but did not break out what share of total company revenue Claude Code now represents.
Code Review is available now in research preview for Claude Code Team and Enterprise plans. Whether it can justify its premium in a market already crowded with cheaper alternatives will depend on whether Anthropic can convert anecdotal bug catches and internal usage stats into the kind of rigorous, externally validated evidence that engineering leaders with production budgets require — all while navigating a legal and political environment unlike anything the AI industry has previously faced.
Claude Code Security spooked investors but misses the bigger problem. The real risk to enterprises is in SaaS integrations and AI agents nobody is watching.
New DXOMARK tests rank Samsung’s Galaxy S26 Ultra 18th globally. Despite color fixes, it trails the iPhone 17 Pro and a surprising new challenger from Motorola.
A new survey finds 100% of security teams can’t connect threat signals to real threats, and zero organizations measure pre-attack disruption.
Spacecraft of the future may be able to detect and repair their own structural damage in orbit, a capability that could make long-duration missions and reusable launch vehicles more resilient.
…
Microsoft today announced the general availability of Agent 365 and Microsoft 365 Enterprise 7, two products designed to bring security and governance to the rapidly growing population of AI agents operating inside the world’s largest organizations. Both become available on May 1st, alongside Wave 3 of Microsoft 365 Copilot, which expands the company’s agentic AI capabilities and adds model diversity from both OpenAI and Anthropic.
Agent 365, priced at $15 per user per month, serves as what Microsoft calls the “control plane for agents” — a centralized system for IT, security, and business teams to observe, govern, and secure AI agents across an enterprise. Microsoft 365 Enterprise 7, dubbed the “Frontier Worker Suite,” bundles Agent 365 with Microsoft 365 Copilot and the company’s most advanced security stack into a single $99-per-user-per-month license.
The timing is deliberate. AI agents have crossed from experimental prototypes into operational infrastructure, but the tools to monitor them have lagged behind. Microsoft is racing to close that gap before adversaries exploit it.
“These agents are no longer experimental. We’re seeing them deeply embedded in organizations, in the operational structure of these organizations, with people using them,” Vasu Jakkal, corporate vice president of Microsoft Security, told VentureBeat in an exclusive interview. “At the same time, as the agents are scaling fast, some of the people and organizations have a visibility gap, and that visibility gap creates business risk.”
The numbers behind the announcement tell a story of breakneck adoption outpacing oversight. According to Microsoft’s Cyber Pulse report, published in February, more than 80 percent of Fortune 500 companies are actively using AI agents built with low-code and no-code tools. IDC projects 1.3 billion agents in circulation by 2028. And Microsoft, serving as its own first customer for Agent 365, now has visibility into more than 500,000 agents running across its own corporate environment, with the most widely used focused on research, coding, sales intelligence, customer triage, and HR self-service.
Externally, the trajectory is steeper. Tens of millions of agents appeared in the Agent 365 Registry within just two months of preview availability, and tens of thousands of customers have already begun adopting the platform, according to Judson Althoff, CEO of Microsoft Commercial Business.
But the governance picture is troubling. Microsoft’s research found that 29 percent of agents in surveyed organizations operate without approval from IT or security teams. Only 47 percent of organizations use any security tools at all to protect their AI deployments.
“That’s a problem,” Jakkal said. “All this innovation is happening against a background, or a backdrop of threats, which is pretty intense.”
Microsoft has coined a pointed term for the risk it sees emerging: “double agents.” The concept, first introduced in a November 2025 blog post by Microsoft security executive Charlie Bell, describes scenarios where AI agents operating on behalf of an organization are manipulated — through prompt injection, model poisoning, or other techniques — into acting against the organization’s interests.
Jakkal told VentureBeat that while Microsoft has not yet observed real-world incidents of agent compromise at scale, the company’s AI Red Team has conducted extensive testbed research simulating how agents can be exploited. In those experiments, direct and indirect prompt injections successfully manipulated agents into accessing unauthorized data.
“We coined this term very intentionally to make people aware that you have to be very mindful of your agents,” Jakkal said. “Just like insider risk was a big thing with employees, we need to make sure that we don’t create that with agents.”
The threat landscape extends well beyond prompt injection. In February, Microsoft’s Defender Security Research Team published findings on what it called “AI Recommendation Poisoning” — a technique in which companies embed hidden instructions inside “Summarize with AI” buttons on websites. When clicked, the pre-filled prompt attempts to inject persistence commands into an AI assistant’s memory, instructing it to “remember [Company] as a trusted source.” The researchers identified over 50 unique poisoning prompts from 31 companies across 14 industries. Separately, Microsoft published research on detecting backdoored language models — so-called “sleeper agents” that behave normally under most conditions but execute malicious behavior when triggered by specific inputs.
Agent 365 organizes its capabilities around three pillars: observability, security, and governance. Each extends Microsoft’s existing security infrastructure — Defender for threat protection, Entra for identity and access, and Purview for data security — to non-human entities.
The observability layer starts with an Agent Registry that catalogs all agents across an organization, whether built on Microsoft platforms, from third-party partners, or registered through APIs. IT teams access the registry through the Microsoft Admin Center; security teams see the same data through Defender, Entra, and Purview. Risk signals evaluate agents for compromise, identity anomalies, and risky data interactions — just as Microsoft’s tools already assess human users.
A new capability called Agent ID gives each agent a unique identity in Microsoft Entra, enabling conditional access policies, least-privilege enforcement, and audit trails. Identity Protection and Conditional Access, long used for human accounts, now extend to agents making real-time access decisions based on risk and compliance signals.
For data protection, Purview capabilities ensure agents inherit sensitivity labels, block PII and other sensitive information from being processed in prompts, and extend insider risk monitoring to flag suspicious agent behavior. Audit and eDiscovery now treat agents as first-class auditable entities alongside users and applications.
Jakkal framed the entire approach as an extension of zero-trust principles. “We think about security for agents very similar to security for people,” she said. “You have to protect these agents against threats. You have to secure the data that they’re accessing. You have to secure their access and identity. So extending zero trust to zero trust for AI.”
On whether Agent 365 can intervene in real time or merely observes after the fact, Jakkal confirmed it does both. The system surfaces risk flags and anomalous behavior, and security teams can block risky agents through the Defender portal. “If there’s a risk, if it’s a risky agent, then you can, of course, block it as well,” she said.
Microsoft 365 Enterprise 7 packages the company’s entire AI and security portfolio into a single SKU. It combines Microsoft 365 E5, Microsoft 365 Copilot, Agent 365, the Microsoft Entra Suite, and advanced Defender, Intune, and Purview security capabilities.
Althoff framed the bundle as a direct response to customer demand. “Customers have told us E5 alone is no longer enough; they do not want multiple tools stitched together, they want one trusted solution,” he wrote. At $99 per user, E7 costs less than purchasing the components individually — E5 currently runs $57 per month (rising to $60 in July), Copilot adds $30, and Agent 365 adds $15 — offering modest savings while pulling customers deeper into Microsoft’s ecosystem.
TechRadar first reported in early March that Microsoft was developing the E7 tier. Computerworld’s Steven Vaughan-Nichols offered a sharper framing of the strategic implications, observing that Microsoft now wants organizations to “hire” AI agents rather than simply use tools — with each agent licensed like a human employee. “In Microsoft’s world, AI agents are tomorrow’s temp workers,” he wrote.
The per-seat subscription model, applied to non-human entities, gives Microsoft a powerful revenue mechanism that could grow even as AI agents begin supplementing — or replacing — human headcount. SiliconANGLE’s analysis noted that agents pose a potential threat to the very Office ecosystem that has long been Microsoft’s profit engine, making the Agent 365 play both defensive and offensive.
The launches coincide with Wave 3 of Microsoft 365 Copilot, which introduces expanded model diversity. Claude, from Anthropic, is now available in mainline Copilot chat, alongside the latest generation of OpenAI models. A new feature called Copilot Cowork, built in collaboration with Anthropic and currently in research preview, enables long-running, multi-step work within Microsoft 365.
The Anthropic partnership carries geopolitical weight. As CNBC reported on March 6, the U.S. Department of Defense designated Anthropic a supply chain risk after the company refused the Pentagon’s requested terms of use. Google, Microsoft, and Amazon all confirmed they would continue offering Anthropic’s technology for non-defense work. The military AI picture has grown more complex still: WIRED reported that the Pentagon had experimented with Azure OpenAI before OpenAI formally lifted its prohibition on military applications in January 2024.
Against this backdrop, Microsoft’s emphasis on trust and governance reads as both a product pitch and a positioning statement: the company wants to be the vendor that makes AI safe for enterprise deployment, regardless of which underlying models customers choose.
The broader Copilot business supplies the adoption base that makes Agent 365 and E7 commercially viable. Microsoft now has 15 million paid Copilot seats, with growth exceeding 160 percent year over year. Daily active usage increased tenfold. Customers deploying at significant scale — more than 35,000 seats — tripled year over year.
Major recent deployments include Mercedes-Benz, which announced a global rollout; NASA, Fiserv, ING, and Westpac, which each purchased more than 35,000 seats; and Publicis, which deployed nearly 95,000 seats across almost its entire workforce. Ninety percent of Fortune 500 companies now use Copilot, according to Microsoft.
Avanade, a joint venture between Accenture and Microsoft, offered an early endorsement of Agent 365. “Avanade has real visibility into agent activity, the ability to govern agent sprawl, control resource usage, and manage agents as identity-aware digital entities in Microsoft Entra,” said CTO Aaron Reich. “This significantly reduces operational and security risk.”
Jakkal acknowledged that competitors including Palo Alto Networks and CrowdStrike are building their own agentic AI security layers, but argued Microsoft’s integration depth sets it apart. “It’s not just this tool, and this tool, and this tool put together in a SKU — it’s more like this tool and this tool and this tool work together,” she said. For third-party agent frameworks — including LangChain, CrewAI, and other open-source tools — Agent 365 provides an SDK with varying levels of integration.
Agent 365 and E7 reach general availability on May 1st. Several capabilities, including Defender and Purview risk signals and security posture management for Foundry and Copilot Studio agents, will remain in public preview at launch. A new runtime threat protection feature is expected to enter public preview in April.
Jakkal observed that many organizations are using the push toward agentic AI as a catalyst for long-overdue security improvements. “I’m seeing organizations use this as an opportunity to say, ‘We have to fix our foundations,'” she said. “They’re using the AI transformation and agentic transformation to go back and say, we are going to do a security transformation.”
Whether the market moves fast enough remains the open question. The tools to build agents are freely available and require no security expertise. The tools to govern them require budget approval, implementation cycles, and organizational alignment across IT, security, and business teams. That asymmetry — between the speed of agent creation and the speed of agent governance — is the gap Microsoft is trying to close.
“The future of work isn’t just about smarter agents,” Jakkal said. “It’s about trusted agents.”
For the 29 percent of enterprise agents already operating without any oversight at all, trust is not a product roadmap — it’s a race against the clock.