Artificial Intelligence (AI) agents are becoming part of more and more workflows. From coding assistants and CLI-based agents to autonomous desktop applications, these tools can read files, execute commands, interact with APIs, and perform tasks on behalf of users. This unlocks significant productivity gains.
Feature currently in public preview
When installing agents on the local system, there is a risk that AI agents run with the user’s privileges on the endpoints, where the AI agents can read files, invoke tools, and run commands.
Unlike traditional applications, AI agents make decisions based on information gathered from multiple sources, including:
- User prompts
- Files and repositories
- Web content
- Tool outputs
- APIs and external services
Attackers can hide malicious instructions within any of these sources. If an agent interprets those instructions as legitimate, it could:
- Expose sensitive data
- Execute harmful commands
- Modify source code
- Access unauthorized resources
- Exfiltrate credentials or secrets
This technique is commonly known as prompt injection and is widely recognized as one of the most significant security challenges facing AI agents today.
Why do we need AI Agent Runtime protection within MDE?
Microsoft released a new feature within Defender for Endpoint for AI agent runtime protection. Runtime protection uses agent hooks, defined points in an agent’s
Understanding Agent Hooks
At the core of runtime protection are agent hooks; predefined points within an AI agent’s execution flow where external security tools can inspect and evaluate activity before it continues.
Modern AI agents such as Claude Code and GitHub Copilot CLI expose these hook points, enabling Microsoft Defender to gain visibility into the agentic workflow without requiring changes to the underlying AI model.
Rather than continuously monitoring the entire agent process, Defender focuses on specific decision points where security checks provide the greatest value with minimal performance impact.
Key Inspection Points in the Agentic Loop
When an AI agent supports hooks, Microsoft Defender receives payloads at three critical stages of execution:
1. User Prompt
The first inspection occurs when a user submits a prompt to the agent. At this stage, Defender analyzes the incoming request for signs of prompt injection attempts, malicious instructions, or suspicious content that could influence the agent’s behavior.
2. Pre-Tool Call
Before the agent executes a tool, command, or external action, Defender inspects the tool invocation request. This checkpoint is particularly important because many prompt injection attacks aim to convince an agent to perform risky actions, such as:
- Accessing sensitive files
- Executing system commands
- Retrieving credentials
- Modifying source code
- Interacting with external services
By evaluating the request before execution, Defender can stop potentially dangerous actions before they occur.
3. Post-Tool Response
After a tool completes its task, Defender performs another inspection on the returned output.
This is a crucial security layer because malicious instructions can be embedded within tool responses, websites, repositories, or external data sources. An agent that consumes this output without validation could unknowingly execute attacker-controlled instructions in subsequent steps. Defender helps identify these threats before the agent continues processing the response.
What are agent hooks?
Hooks are user-defined shell commands, HTTP endpoints, or LLM prompts that execute automatically at specific points in the lifecycle of the AI agent. Interested to learn more, the documentation of Claude’s code is interesting, where the Hooks reference is explained in-depth.
Hooks reference – Claude Code Docs
Prerequisites
Currently, the feature is in public preview, which means the Runtime protection platform is currently only available for devices configured in the Beta platform and engine updates ring. Use this feature only on a couple of test devices to collect input on the protection. The beta platform ring is not advised for broader roll-out.
The following needs to be completed from the MDE side:
- The device needs to be fully onboarded to Defender for Endpoint
- Defender Antivirus is enabled in active mode
- Defender is installed with the latest beta platform update and engine
For testing or validation on a single machine, the following PowerShell commands or scripts can be performed. It is needed to run the following commands:
When the Defender signature/ platform version is supported, the next step is to enable the runtime protection capability. Currently, there is no native way via Intune to manage the settings. Of course, you can deploy PowerShell or remediation scripts in Microsoft Intune to enable the runtime protection capability.
Set-MpPreference -AiAgentProtection <mode>Currently, the following modes are supported:
| Protection Mode | Behavior |
|---|---|
| Block | Blocks the threat, notifies the user in the agent UI and Windows, records the detection in Protection History, and generates a security alert for SOC investigation. |
| Audit | Allows the action to continue, records the detection, and generates a security alert for investigation. |
| Disabled | Runtime protection is turned off. No agent inspection, prompt injection detection, or blocking occurs. |
The enablement of AiAgentProtection can be validated via the Get-MpPreference command. Track the following object: AiAgentProtection. For block mode, the value must be 1.
Get-MpPreference | Select-Object AiAgentProtection
Supported agents
Not all local AI agents are currently supported for runtime protection. As already mentioned, the agent hook needs to be available. Currently, the following hooks/ agents are supported:
- Claude Code
- GitHub Copilot CLI
To install the Claude agent, run the following PowerShell script or use alternative ways to install Claude Code.
irm https://claude.ai/install.ps1 | iex
Claude Code:
When the hook protects the prompt, the following message will appear in the Claude code terminal: “UserPromptSubmit operation blocked by hook: ⚠️ This request was blocked by Microsoft Defender due to detected security concerns in your prompt“
As a result, Defender for Endpoint is blocking the initial hook. The result is the following in the Defender portal:
In Defender, the following alerts are visible:
- Suspicious AI prompt injection
- ‘PromptInjection’ malware was prevented
When the prompt is blocked by the Hook, the following detection is powered up: ‘Trojan:AIMCP/PromptInjection.A!Hook’
Discover agents
Another benefit of the runtime protection included with Microsoft Defender for Endpoint is AI Asset Discovery (Preview). Defender for Endpoint automatically discovers supported local AI agents and MCP servers configured on onboarded devices. The devices must be in active mode and configured with real-time protection.
Agents are discovered automatically,
Currently, AI agent discovery is part of the Microsoft 365 Copilot and Agent offering. However, the discovery of local agents is currently included with the Microsoft Defender for Endpoint license. Because this capability is still in preview, licensing requirements, feature availability, and entitlement may change before general availability.
Agents can be discovered in the Defender portal under Assets > AI Agents.
AI agent results: the AIAgentProtection value is not needed, since it is automatically discovered.
More information: Discover local AI agents with Microsoft Defender for Endpoint (Preview) – Microsoft Defender for Endpoint | Microsoft Learn
Sources
