Find and Secure Local AI Tools with Defender for Endpoint

• Local AI tools like GitHub Copilot and Claude Code on Windows offer powerful capabilities but can introduce significant new risk.
• Defender for Endpoint is getting capabilities to discover AI tools and help protect a narrow but important range of AI agents from abuse.
• Support for these features is currently in preview and will require Defender for Endpoint Plan 2 licensing for end users.

New local AI discovery and security capabilities for Windows endpoints are in preview for Defender for Endpoint (DfE) Plan 2 customers and are expected to arrive during the second half of 2026. 

Large language model (LLM)-based AI tools like Claude Code and GitHub Copilot are gaining popularity because they can help users—typically developers—perform complex tasks more readily. However, they also introduce a significant potential for exploitation on developer workstations. Due to these potential risks of abuse from misused AI tools and agents that are running locally, it’s increasingly important for organizations to discover, catalog, and ideally secure these tools. With these two new features, DfE extends its existing on-device sensor software on Windows and macOS to help discover and help protect specific AI software running locally on each device. The list of AI technologies supported by these new features is currently quite short; however, it includes those technologies and features that most organizations are likely to want to discover and secure today, and the list of technologies will expand in the future to include other AI tools and agents on desktops, as they become relevant. These features require DfE Plan 2 or a plan that includes that license. Customers who don’t license DfE or use a third-party endpoint detection and response (EDR) tool other than DfE won’t be able to take advantage of these new features.