Microsoft rolled out new security tools on Monday designed to shield businesses from threats posed by AI agents, declaring that "frontier models, regardless of their origin, cannot be trusted," according to Hayete Gallot, the company's security business chief. The most prominent addition is Guardian Agents, a feature built to watch over the AI agents that organizations deploy. The launch marks a significant shift in Microsoft's messaging, with CEO Satya Nadella now cautioning that the real danger may come from the very agents companies have purchased and put to work—treating them as insider threats similar to rogue human employees.
Guardian Agents is part of Project Perception, a product Microsoft introduced in June as its response to powerful hacking models like Anthropic's Mythos and Fable and OpenAI's Daybreak security vulnerability scanning system. Project Perception originally featured three classes of agents: a red team that mimicked hackers and launched attacks, a blue team that spotted the red team and evaluated the vulnerabilities they uncovered, and a green team assigned to repair those weaknesses. The product was initially built around the premise that AI hackers would originate from outside the organization. Microsoft has also expanded its Microsoft Defender product with agent detection capabilities that can identify up to 60 types of agents employees bring into the workplace, including Claude Code, Codex, and OpenClaw. Additional features now limit agents' access to data and systems, and dynamically modify their permissions depending on the task, including mandating human approval when an agent seems to be making risky choices.
Gallot explained that frontier models can't be trusted not because they're malicious or easily compromised, but because they're unpredictable—they've been trained to accomplish tasks, not to follow "organizational norms or judgment." In a private blog post earlier this month, Nadella argued that enterprises must stop relying on AI model providers' safety and security assurances, writing that "we simply can't outsource responsibility for what intelligence does on our behalf." He called for separate systems, not controlled by the AI labs themselves, to monitor and govern the agents those labs' products create. "In other words, we need to separate the supply of intelligence from the authority over it," Nadella wrote, emphasizing that companies are deploying complex agentic systems with access to their most sensitive data and the ability to take mission-critical actions.
Microsoft's position is both unexpected and strategic. The company has invested heavily in OpenAI and Anthropic, OpenAI is one of its largest cloud customers, and Microsoft operates its own AI lab developing models—so the company is essentially undermining some of its own business interests. At the same time, Microsoft stands to gain by persuading enterprises to purchase agent security products from it, the cloud provider, rather than from the AI labs themselves. But the underlying logic holds: the software that monitors agent behavior should be independent from the suppliers of those agents, just as auditors should be separate from the organizations they audit. The concept of agents as untrustworthy insiders is gaining traction across the industry. Microsoft joined Nvidia's new Open Agent Safety Platform as an inaugural member, alongside more than 100 other tech companies, which isolates agents in secure environments and can monitor and halt behavior through hardware, functioning like a kill switch. This followed Microsoft's announcement of the new Surface Laptop Ultra PCs built for agents, which run on Nvidia chips and have agent security and controls embedded.
The shift toward treating AI agents as potential insider threats reflects a broader reckoning about the limits of model providers' guarantees and the risks of giving autonomous systems wide-ranging access to corporate data and operations. Microsoft's approach suggests that enterprises will need layered defenses and independent oversight, rather than simply trusting that the labs building the models have safety covered. The company's bet is that organizations will prioritize control and accountability over convenience, even if it means adding complexity and cost to their AI deployments. The scramble to secure agent ecosystems may reshape competitive dynamics among cloud providers, who now compete not just on model performance but on their ability to constrain and audit the very intelligence they sell. For enterprises weighing whether to deploy agents at scale, the message is clear: the more powerful and autonomous the agent, the more essential it becomes to watch it closely.