Microsoft says AI agents are like insider threats as ‘frontier models can’t be trusted’

Microsoft rolled out a set of new security features on Monday aimed at a problem it now says looks a lot like an insider threat: the AI agents companies deploy themselves. The headline feature is Guardian Agents, which is meant to monitor those agents and sits inside Project Perception, a system Microsoft introduced in June.

That earlier project was built around a different fear. It was Microsoft’s answer to hostile AI systems such as Anthropic’s Mythos and Fable, and OpenAI’s Daybreak vulnerability scanner. It started with three kinds of agents: a red team that attacks, a blue team that spots weaknesses, and a green team that fixes them. The assumption was that the bad actor would come from outside.

Satya Nadella has been pushing Microsoft toward a less comfortable idea. In a private blog post earlier this month, he said enterprises should stop trusting model providers’ assurances and set up separate systems to watch the agents those providers launch. He argued that companies cannot outsource responsibility for what their AI does, especially when those systems can touch sensitive data and carry out mission-critical actions.

Hayete Gallot, who runs Microsoft’s security business, put the point even more bluntly. She said frontier models can’t be trusted, not because they are necessarily malicious or easy to break, but because they are unpredictable and trained to complete tasks rather than follow company norms or judgment. Microsoft is also adding agent detection to Defender, which can spot up to 60 types of agents employees bring in, including Claude Code, Codex, and OpenClaw.

The company is making the same point across more than one product line. It now has controls that narrow agent access to data and systems, change permissions based on the task, and ask for human approval when an agent seems to be making risky decisions. And Microsoft is not alone: Nvidia’s Open Agent Safety Platform has support from more than 100 tech companies and uses secure environments plus hardware-level monitoring to isolate and stop agent behavior.