Local AI agent discovery in Microsoft Defender
Microsoft Defender capability, now GA, that finds 50+ local AI agents and their MCP configs on Windows and macOS endpoints.
Overview
Microsoft's November 2026 security update, published November 5, lists local AI agent discovery in Microsoft Defender as generally available. It observes activity to discover more than 50 supported local AI agents and their configured MCP servers on Windows and macOS, and links each agent to its device, account and MCP context. The same update lists Microsoft Execution Containers (MXC) as GA, plus Dynamic Permissions for task-scoped agent access whose status is not stated.
This is a sourced directory entry. Features and capabilities are reported in the linked sources; this entry does not document independent Aymorphic testing.
Key features
- Discovers 50+ supported local AI agents on Windows and macOS
- Finds each agent's configured MCP servers
- Links agents to device, account and MCP context
- Generally available per Microsoft's November 2026 security update
Use cases
- Inventorying shadow coding agents on employee laptops
- Finding which MCP servers local agents can reach
Pricing
Unknown; not stated in the announcement.
Pricing reflects the source record and may change. Confirm current terms with the provider.
Dates and sources
- Released
- 5 Nov 2026
- Record updated
- 7 Nov 2026
- Record last checked
- 7 Nov 2026