MOUNTAIN THEORY VS MICROSOFT DEFENDER FOR ENDPOINT
New here? The short version: Mountain Theory checks each action an AI is about to take, against rules you write in plain English, before the action runs. Everything below compares that with what Microsoft Defender for Endpoint does.
Microsoft Defender for Endpoint added AI agent runtime protection in preview. It inspects local AI agents such as Claude Code, Codex CLI and GitHub Copilot CLI and can block an action before it runs. Its target is prompt injection. Mountain Theory checks every action against your company's own rules, whether or not anything malicious is involved.
| Microsoft Defender for Endpoint | Mountain Theory | |
|---|---|---|
| What it controls | Prompt injection and the harmful actions it causes, on local AI agents | The action an AI agent is about to take |
| Where it sits | On the endpoint, in the Defender for Endpoint agent | Inline at execution, between the decision and the action |
| How policy is set | Microsoft detections; audit or block | Plain English, no code |
| Deployment reach | Claude Code, Codex CLI, GitHub Copilot CLI; other agents through network inspection | Model and framework agnostic, including custom and on-prem agents |
| Best fit when | You run Defender for Endpoint and want prompt-injection coverage on developer machines | An AI acting wrongly has physical or regulatory consequences |
Why you might pick Microsoft Defender for Endpoint
If you already run Defender for Endpoint, this is the shortest path to some protection for local AI agents. It lives in the agent you already deploy, is managed through Intune, sits behind tamper protection, and turns every detection into an alert and an incident in the Defender portal for your SOC. It inspects the prompt, the tool request and the tool response, and covers agents without hooks through network inspection. A companion preview discovers local agents and their MCP servers (Microsoft Learn, updated October 13th, 2026).
Why you might pick Mountain Theory
Defender looks for malicious prompts and the harmful actions they cause, and answers audit or block. Mountain Theory checks the action itself against rules your risk owners write in plain English, so it stops an allowed agent doing something the business does not allow, with no attacker in the picture. It adds a third answer, hold for a named person, and keeps a decision record for the auditor rather than a security alert. It is not tied to one endpoint stack: it works with 158 AI systems today, in your environment or the cloud. Microsoft marks its feature as a prereleased product that may change before release.
The honest verdict
If you run Defender, turn this on in audit mode; it is coverage against prompt injection on endpoints you already own. It does not write or enforce your business rules for agents. That is the job Mountain Theory does, and the two run together.
What we can actually show
Proof
Four things with a published run behind them.
Claims in this category are easy to make and hard to check, so here is ours on the record. The same 10 actions were run in the same order under three configurations. Ungoverned, 10 of 10 executed. Under NVIDIA OpenShell alone, all 5 sandbox-boundary crossings were denied at the kernel, and all 3 in-bounds bad decisions still went through, including a secrets read that printed credentials to the screen. Under OpenShell plus Mountain Theory, those same 3 actions returned HOLD, HOLD and BLOCK, and the secrets read was stopped before it executed, so the credentials never printed. Terminal recordings of all three runs are published, including the two actions Mountain Theory has no policy for.
Separately, when a third-party provider updated the foundation model driving an autonomous agent, the agent began attempting multi-step actions it had never tried before. Nothing on our side changed. Every attempt was stopped on July 30th and 31st, 2026, the days the behavior first appeared. No new rule, no signature, no patch.
Both products in this comparison operate at the execution layer. What execution-layer security is, and how it differs from prompt filtering and from access control.
Watch the three-configuration run against NVIDIA OpenShell
See novel agent behavior stopped the day it appeared
Ask Microsoft Defender for Endpoint, and every other vendor you are evaluating, for the same four things: the exact action set, the ungoverned control condition, the outcome per action including the ones the product did not stop, and the recording. A certification, an integration list or a customer logo answers a different question.
Compare all 77 AI security vendors