Microsoft Warns: Your AI Agents Could Be Insider Threats

Microsoft has launched a suite of enterprise AI agent security features, headlined by Guardian Agents, designed to monitor the very AI agents that companies deploy and pay for. The move reflects a shift in threat modeling: the risk is no longer only external hackers, but also the agents themselves acting as unpredictable insiders.

Guardian Agents and Project Perception

Guardian Agents are part of Project Perception, introduced by Microsoft in June 2024 to counter increasingly powerful AI attack capabilities. The project originally assumed attackers came from outside the organization and deployed three agent roles: a red team that simulates attacks, a blue team that detects red-team activity and assesses discovered vulnerabilities, and a green team that patches those vulnerabilities. This architecture was prompted by models such as Anthropic's Mythos and Fable, which demonstrate strong hacking abilities, and OpenAI's Daybreak vulnerability scanning system.

Why Frontier Models Cannot Be Trusted

CEO Satya Nadella recently argued on his personal blog that enterprises cannot rely solely on safety assurances from AI model providers. He advocates for independent oversight and control systems that are not controlled by the labs supplying the models. His reasoning: enterprises are handing their most sensitive data and mission-critical operations to complex agent systems, and a vendor's promise does not absolve the enterprise of its own responsibility.

Microsoft security chief Hayete Gallot put it more bluntly: "Frontier models cannot be trusted, regardless of origin." She clarified this is not about malice or ease of compromise, but about unpredictability. Models are trained to complete tasks, not to follow organizational norms or exercise the judgment enterprises require. Compounding the problem, companies often grant these agents high-level permissions to access data and tools where misuse could cause severe damage. As Nadella summarized: "We need to separate the supply of intelligence from the control over intelligence."

Business Tension and Independent Oversight

Microsoft's stance carries commercial tension. The company has deep ties to and investments in both OpenAI and Anthropic; OpenAI is also one of Microsoft's largest cloud customers, and Microsoft runs its own model research lab. Yet Microsoft is now questioning the trustworthiness of products from those same partners while positioning its own security tools as the independent oversight layer — analogous to an auditor being independent from the audited entity.

Detection, Dynamic Permissions, and Human-in-the-Loop

Beyond Guardian Agents, Microsoft Defender now includes agent detection capable of identifying up to 60 different agents that employees may bring into the workplace, including Claude Code, Codex, and OpenClaw. This gives enterprises visibility into what agents are actually in use. Microsoft also added dynamic permission controls that adjust an agent's access to data and systems based on the specific task, and can require human approval before an agent executes a high-risk decision.

Industry-Wide Move Toward Hardware-Level Controls

Treating agents as untrusted internal actors is becoming a broader industry direction. Microsoft is a founding member of Nvidia's newly announced Open Agent Safety Platform , which is backed by over 100 technology companies . The platform isolates agents in secure environments and uses hardware monitoring to block or stop their actions — effectively a hardware kill switch. Prior to this, Microsoft unveiled the Surface Laptop Ultra, built with Nvidia chips and embedded agent security and control features.

From independent oversight and dynamic permissions to hardware-level kill switches, these developments point to a single conclusion: as enterprises delegate more actions to AI, they must retain control. The stronger the agent's capabilities, the less that control can depend on the model provider's promises alone.

Editor's observation: Microsoft is raising a genuine governance challenge while also creating a growth avenue for its security business. When procuring agents, enterprises should evaluate permission boundaries, independent oversight, and human takeover capabilities on the same scorecard as task completion ability. The independence and effectiveness of the oversight systems themselves will also require verification.

Source: TechCrunch, original article: https://techcrunch.com/2026/10/19/microsoft-says-ai-agents-are-like-insider-threats-as-frontier-models-cant-be-trusted/