Microsoft Claims 97% AI Agent Cost Cut With New Foundry Tools

Microsoft says new features in its Foundry Agent Service platform have cut AI agent operating costs by up to 97% in internal testing, as part of a broader push to reduce what it calls the "context engineering" overhead of enterprise AI agents.

In a blog post published 2 September by Jeff Hollan, vice president of product management for Foundry Agent Service, Microsoft said internal benchmarking against a public open-source tool-retrieval dataset showed a new feature called Toolboxes cut average input-token consumption by around 97% for agents with large tool libraries. Toolboxes give an agent a single managed endpoint for its tools, rather than sending a full tool-description list to the model on every turn.

The company also detailed Foundry IQ, a managed knowledge layer that narrows what enters an agent's context window by decomposing queries, searching connected sources such as SharePoint, OneLake and Azure SQL in parallel, and returning only the most relevant passages with citations. At query time, Microsoft said Foundry IQ can run under a caller's Microsoft Entra identity, synchronise access-control lists, and honour Microsoft Purview sensitivity labels, so an agent retrieves only content the caller is authorised to access. Microsoft said internal evaluations showed Foundry IQ improved evidence recall by up to 54% on the BrowseComp-Plus benchmark while cutting retrieval token costs by 34%.

The post also described reusable "skills" for encoding company procedures centrally rather than duplicating them across agents, and three types of memory, covering the current session, persistent user preferences, and learned task-execution patterns. Microsoft said enabling procedural memory produced roughly a 5% improvement on the STATE-Bench and Tau-Bench evaluation benchmarks.

The post forms the third instalment in Microsoft's four-part "Economics of Agent Optimization" series on Foundry, following earlier posts on cost decisions and runtime request handling.

Agentic Exploits- Deterministic gates for a probabilistic problem

David Girvin, CEO and co-founder of Assury, joins Stewart Tinson to dig into what’s actually happening when agentic AI goes wrong, and why he thinks most of the industry is solving the wrong layer of the problem. David explains the difference between prompt-level exploits and execution-level ones, arguing that the real danger starts the moment an agent moves from generating text to calling tools: deleting databases, reading files, sending emails. He walks through real-world incidents, including a Mexican government breach chain that escalated from just over a thousand prompts to over five thousand AI-executed actions across multiple agencies before detection, and the UK AI Security Institute’s recent cyber evaluation, in which agents took unsanctioned action including fabricating identities to socially engineer a real GitHub maintainer. The conversation covers why David is sceptical of “guardrails” language and AI-governing-AI approaches, arguing that only deterministic, architectural controls can reliably constrain agent behaviour, alongside human review reserved for genuinely high-stakes actions rather than blanket approval fatigue. He breaks down credential starvation, session risk accumulation, and why classifier-based tools keep failing inconsistently on identical actions, pointing to a named frontier lab’s own zero trust paper as an example of the industry misjudging what actually works. Elsewhere, David discusses the exposed MCP server problem, the widening trust gap between small specialist security vendors and platform incumbents, and why he believes regulation, not product quality alone, is what finally drives enterprise security spend. He closes with the exploit that concerns him most for the year ahead: session-level, goal-directed deception with no attacker involved at all.

BrightTALK