Microsoft calls AI agents insider threats and ships Guardian Agents

Microsoft on Monday launched Guardian Agents, a new security feature built to monitor the AI agents that enterprises deploy — because, in the company's own words, "frontier models, regardless of their origin, cannot be trusted."

That quote comes from Hayete Gallot, Microsoft's security business chief, in her announcement of the new product. It's a striking statement from a company that has invested heavily in OpenAI and Anthropic, and it marks a shift in how the industry talks about AI risk. The threat isn't just outside hackers anymore. It's the agents companies have already bought, paid for, and given access to their most sensitive data.

Guardian Agents is part of Project Perception, a security product Microsoft introduced in June as its answer to offensive AI tools like Anthropic's hacking models Mythos and Fable, and OpenAI's security vulnerability scanning system Daybreak. The logic of that first release was simple: the attackers are out there, so let's simulate them.

What did Project Perception originally do?

The product shipped with three classes of agents, structured like a military exercise:

• A "red team" that behaved like hackers and attacked
• A "blue team" that detected the red team and assessed the vulnerabilities it found
• A "green team" tasked with fixing those vulnerabilities

The design assumed AI hackers would come from outside the company. That assumption has changed.

The takeaway: Microsoft built a sparring partner, and now it's saying the real opponent may already be on payroll.

Who raised the alarm about agents as insider threats?

Microsoft CEO Satya Nadella has been making the case in increasingly blunt terms. Earlier this month, in his private blog, he argued it's time to stop trusting AI model providers — even when they offer assurances of safety and security with their agentic products. Enterprises need separate systems, not controlled by the AI labs, to watch and control the agents those labs' products launch.

"We are deploying these complex agentic systems and models, with access to our most sensitive data and giving them the ability to take mission-critical actions on our behalf!" Nadella wrote. "We simply can't outsource responsibility for what intelligence does on our behalf. A model provider's assurances do not relieve us of that responsibility. … In other words, we need to separate the supply of intelligence from the authority over it."

That last line — separating the supply of intelligence from authority over it — is the design principle behind everything Microsoft announced on Monday. Nadella has repeated it publicly, and it does the work of an entire security architecture in one sentence.

The takeaway: Nadella is telling enterprises that vendor promises don't count as governance.

Why can't frontier models be trusted?

Gallot's reasoning isn't that the models are malicious or easily hacked. It's that they are unpredictable. They have been trained to achieve tasks, she wrote, not to follow "organizational norms or judgment."

On top of that, agents are often handed the keys to the kingdom — access to data and tools that could do serious harm if used the wrong way. Combine an unpredictable optimizer with broad permissions, and you get something that behaves less like a tool and more like an employee nobody vetted.

The takeaway: the failure mode isn't evil, it's misaligned incentives plus excessive access.

Isn't this a conflict of interest for Microsoft?

Yes, and it's worth naming plainly. Microsoft is famously close to OpenAI and Anthropic, having invested in both. OpenAI is also one of its biggest cloud customers, and Microsoft runs its own AI lab developing models. In effect, the company is sowing distrust of some of its own business interests.

The self-serving side is equally clear: Microsoft wants enterprises to buy agent security from the cloud provider rather than from Anthropic or OpenAI. That's a new revenue line built on a fear Microsoft itself is articulating.

But strip away the conflicts, and the logic holds. The software that monitors agent behavior should be independent of the suppliers of agents, for the same reason auditors should be independent of the organizations they audit. You don't let the vendor grade its own homework.

Or, as Nadella puts it: "We need to separate the supply of intelligence from the authority over it."

The takeaway: Microsoft is selling the watchdog, but the argument for having one stands on its own.

What else shipped alongside Guardian Agents?

Monday's launch went beyond monitoring. Microsoft also announced:

• An agent detection feature in Microsoft Defender that can find up to 60 types of agents employees bring into the workplace, including Claude Code, Codex, and OpenClaw
• Features that limit agents' access to data and systems
• Dynamic permission adjustments that change what an agent can do based on the task at hand
• A requirement for human approval when an agent appears to be making risky decisions

The Defender capability is notable because it targets shadow AI — the agents employees install themselves, without security review. Sixty detected agent types suggests this is already a widespread pattern inside companies, not a hypothetical.

The takeaway: Microsoft is covering both the agents enterprises buy officially and the ones workers bring in on their own.

Is the rest of the industry following?

The idea of agents as untrustworthy insiders is taking hold beyond Redmond. Microsoft was an inaugural member of Nvidia's new Open Agent Safety Platform, which has drawn support from more than 100 other tech companies. The platform isolates agents in secure environments and can monitor and stop their behavior through hardware — functioning, in effect, like a kill switch.

This follows Microsoft's announcement of the new Surface Laptop Ultra PCs built for agents, which run on Nvidia chips and ship with agent security and controls baked in. The message across all of it is consistent: containment belongs in the infrastructure, not in the model's good behavior.

The takeaway: over 100 companies are now standardizing on the premise that agents need external oversight at the hardware and platform level.

Why this matters now

The stakes are straightforward. Enterprises are handing agents access to sensitive data and mission-critical actions at speed, while the models driving them are, by Microsoft's own assessment, unpredictable. Monday's launch turns that admission into a product category — oversight systems sold separately from the intelligence they watch.

Whether that category is genuinely independent or just another Microsoft silo depends on execution. But with Nadella framing trust in model providers as a liability and Nvidia's platform pulling in a hundred-plus backers, the industry default has shifted: agents get monitored, not believed.