You cannot switch off an agent you have not counted

Facts are attributed and linked to their sources. The analysis and opinions are the author's own.

What it is

On 29 October Microsoft made local AI agent discovery generally available in Defender for Endpoint on Windows and macOS. It now recognises more than 50 agents and MCP servers, up from the 20-plus types introduced at Build 2026. Examples include Claude Code, Codex CLI, Gemini CLI, Cursor and OpenClaw. The inventory links each agent to its device and user, along with the MCP servers it is configured to use, and the exposure graph shows what Microsoft calls the "blast radius" of each agent. Runtime protection on Windows is still in preview. It inspects agent activity through hooks and network flows, raises prompt-injection alerts and runs in audit or block mode. The feature needs Defender for Endpoint Plan 2 or higher.

On 2 November the UK's Financial Conduct Authority published supervision findings for wholesale banks. It reported "incidents of staff using AI tools unapproved by the firm resulting in data leaks, including of sensitive information". Firms responded with mandatory training, attestations and amnesty periods to surface undisclosed use. Banks' own internal audits found incomplete AI inventories and "insufficient training, testing and maintenance of kill switches, as well as no documented list of authorised individuals to operate them". In one case, inaccurate AI-generated code recommendations got past human review and caused a loss of service.

Why it matters

In my view the inventory comes before everything else. A kill switch, a risk tier and an approval all assume you know which agents are running. Coding agents on developer laptops are the fastest-growing category, and each MCP connection extends what the agent can reach. An inventory built from a staff survey lists the agents people remember. One built from the endpoint lists the ones that are actually running.

An AI inventory built from a survey lists the agents people remember. One built from endpoints lists the ones that are running.

Vendor discovery has limits. It sees the agents the vendor supports, on the devices the vendor manages. It is a floor, not a census. It also arrives as agents become easier to assemble. On 28 October Microsoft opened the Copilot harness, the runtime behind its own Copilot products, to developers in Foundry, with more than 20 frontier models plus bring-your-own-key. I would treat MCP server configurations as privileged access, review them like service accounts, and connect the discovered inventory to the named list of people who can operate each kill switch. That is the gap the FCA found.

What I'd watch

• Whether Defender's runtime protection leaves preview, and what its block mode breaks in practice.
• Whether other endpoint security vendors publish comparable agent and MCP inventories.
• Whether supervisors start asking firms for agent inventories that include MCP connections.