Microsoft Open Sources an AI Agent Risk Eval Loop
Microsoft introduced run-assert-eval, a skill that finds an AI agent's risks, measures how often the agent fails, writes a runtime policy from those findings, and reruns the same evaluation to prove whether the fix worked. Everything below is Microsoft describing its own tooling and its own example agent.
Transcript
Microsoft says developers can now prove an AI agent's safety fix actually worked. The evidence is Microsoft's own.
Microsoft introduced a skill called run assert eval. It runs from a single prompt inside Visual Studio Code.
The skill discovers an agent's risks and measures how often it fails. A billing agent disclosed another customer's data in thirty percent of baseline conversations.
It then writes a runtime policy from those findings and reruns the same evaluation. Microsoft reports helpfulness violations fell to zero on every split.
The announcement includes no third party verification and no adoption numbers. The results come from Microsoft's own example agent.
Inboxsmith builds AI receptionists for small business. Please like and subscribe for more news.
Sources
Every claim in this video comes from the top ranking coverage of this topic. The claims and where each one came from:
- Today, we're introducing run-assert-eval, a skill that discovers the risks that matter for a given agent, measures how often the agent fails, generates runtime policy directly from those findings, and reruns the eval to prove whether the fix worked.(Microsoft (commandline.microsoft.com), first party announcement titled "Introducing run-assert-eval: Find the risk, fix it, prove it" by Alex Ngo, Chang Liu, Mehrnoosh Sameki, Mike Shi, Katelyn Rothney and Ahmed Magooda, published 2026.09.24, read from the alert time snapshot captured 2026-09-25T20:39:24Z.)
- Today, we're introducing run-assert-eval, a skill designed to remove both of those assumptions. From a single prompt in VS Code, it discovers the risks that matter for a given agent, measures how often the agent fails, generates runtime policy directly from those findings, and reruns the same evaluation to prove whether the fix worked.(Microsoft (commandline.microsoft.com), first party announcement titled "Introducing run-assert-eval: Find the risk, fix it, prove it" by Alex Ngo, Chang Liu, Mehrnoosh Sameki, Mike Shi, Katelyn Rothney and Ahmed Magooda, published 2026.09.24, read from the alert time snapshot captured 2026-09-25T20:39:24Z.)
- In the example we walk through below, a billing-support agent disclosed another customer's data in 12 of 40 applicable baseline conversations, an observed rate of 30.0%.(Microsoft (commandline.microsoft.com), first party announcement titled "Introducing run-assert-eval: Find the risk, fix it, prove it" by Alex Ngo, Chang Liu, Mehrnoosh Sameki, Mike Shi, Katelyn Rothney and Ahmed Magooda, published 2026.09.24, read from the alert time snapshot captured 2026-09-25T20:39:24Z.)
- The baseline results showed clearly where to focus: Suite / Impermissible behavior violated / Permissible behavior violated. Unverified high-risk action 6.3% 10.0%. Cross-customer data exposure 30.0% 8.7%.(Microsoft (commandline.microsoft.com), first party announcement titled "Introducing run-assert-eval: Find the risk, fix it, prove it" by Alex Ngo, Chang Liu, Mehrnoosh Sameki, Mike Shi, Katelyn Rothney and Ahmed Magooda, published 2026.09.24, read from the alert time snapshot captured 2026-09-25T20:39:24Z.)
- To move from finding to fix, the skill can generate and validate a draft policy from the evaluation results. The output has two parts, with the Rego policy expressing the decision and the ACS manifest specifying where in the agent's runtime that decision applies. Generation isn't automatic approval: the policy, manifest, intervention point, and target wiring must be reviewed before the governed run.(Microsoft (commandline.microsoft.com), first party announcement titled "Introducing run-assert-eval: Find the risk, fix it, prove it" by Alex Ngo, Chang Liu, Mehrnoosh Sameki, Mike Shi, Katelyn Rothney and Ahmed Magooda, published 2026.09.24, read from the alert time snapshot captured 2026-09-25T20:39:24Z.)
- The skill reuses the cached systematization and test set from the baseline run, so the governed agent is evaluated against the same behavior definition, the same test cases, and the same judging approach, with the policy as the only variable.(Microsoft (commandline.microsoft.com), first party announcement titled "Introducing run-assert-eval: Find the risk, fix it, prove it" by Alex Ngo, Chang Liu, Mehrnoosh Sameki, Mike Shi, Katelyn Rothney and Ahmed Magooda, published 2026.09.24, read from the alert time snapshot captured 2026-09-25T20:39:24Z.)
- Permissible violations fell to zero on all four splits, which means the policy blocked access to other customers' accounts and prevented unverified changes while leaving the agent's legitimate work fully intact.(Microsoft (commandline.microsoft.com), first party announcement titled "Introducing run-assert-eval: Find the risk, fix it, prove it" by Alex Ngo, Chang Liu, Mehrnoosh Sameki, Mike Shi, Katelyn Rothney and Ahmed Magooda, published 2026.09.24, read from the alert time snapshot captured 2026-09-25T20:39:24Z.)
- Impermissible behavior violations declined on every split, and on the cross-customer scenario split, they fell from 43.8% to 0.0%. The remaining violations on two of the splits are real, and they represent the starting point for the next iteration of the loop.(Microsoft (commandline.microsoft.com), first party announcement titled "Introducing run-assert-eval: Find the risk, fix it, prove it" by Alex Ngo, Chang Liu, Mehrnoosh Sameki, Mike Shi, Katelyn Rothney and Ahmed Magooda, published 2026.09.24, read from the alert time snapshot captured 2026-09-25T20:39:24Z.)
- The skill ships in the ASSERT repository with seven worked domains and 14 risk suites. ASSERT and ACS are open source under the MIT license and available today. The best way to understand the loop is to see it applied to a real agent, so the rest of this post follows run-assert-eval as it evaluates and governs a billing support agent from start to finish.(Microsoft (commandline.microsoft.com), first party announcement titled "Introducing run-assert-eval: Find the risk, fix it, prove it" by Alex Ngo, Chang Liu, Mehrnoosh Sameki, Mike Shi, Katelyn Rothney and Ahmed Magooda, published 2026.09.24, read from the alert time snapshot captured 2026-09-25T20:39:24Z.)
- Verified absence. The announcement contains no pricing figures of any kind, no adoption, customer or user numbers, and no third-party or independent verification of any result. Every measurement reported comes from Microsoft's own run of its own example billing support agent, judged by Microsoft's own automated judge, and the only reliability figure given is Microsoft's statement that in earlier ASSERT evaluations agreement between the automated judge and human reviewers ranged from 80% to 90%. No external auditor, benchmark organisation or customer is cited. The YouTube transcript pull returned zero of five transcripts, so no video corroboration was available for any claim in this script.(Microsoft (commandline.microsoft.com), first party announcement titled "Introducing run-assert-eval: Find the risk, fix it, prove it" by Alex Ngo, Chang Liu, Mehrnoosh Sameki, Mike Shi, Katelyn Rothney and Ahmed Magooda, published 2026.09.24, read from the alert time snapshot captured 2026-09-25T20:39:24Z.)