Microsoft rolled out new security capabilities on Monday aimed at shielding businesses from the rising risk posed by AI agents. The announcement follows the company’s ongoing warnings to enterprises about the perils of AI and autonomous agents.
The headline feature is Guardian Agents, a monitoring tool that tracks the AI agents a firm employs. Guardian Agents is part of Project Perception, a suite first unveiled in June as Microsoft’s response to powerful hacking models such as Anthropic’s Mythos and Fable and OpenAI’s vulnerability‑scanning system Daybreak. Project Perception originally offered three categories of agents: a “red team” that simulated hackers, a “blue team” that detected the red team’s activities and evaluated discovered weaknesses, and a “green team” tasked with remediation. The framework was built on the premise that AI hackers would originate outside an organization.
Recent statements from CEO Satya Nadella, however, suggest the threat may come from the agents companies have already deployed, likening them to rogue employees or “insider threats.” In a private blog post earlier this month, Nadella urged firms to stop relying solely on assurances from AI model providers, even when those providers claim their agentic products are safe. He called for separate, independent systems to oversee and control the agents launched by AI labs. “We are deploying these complex agentic systems and models, with access to our most sensitive data and giving them the ability to take mission‑critical actions on our behalf!” he wrote. “We simply can’t outsource responsibility for what intelligence does on our behalf. A model provider’s assurances do not relieve us of that responsibility. … In other words, we need to separate the supply of intelligence from the authority over it.”
Hayete Gallot, Microsoft’s head of security business, echoed the sentiment when introducing Guardian Agents. “Unfortunately, frontier models, regardless of their origin, cannot be trusted,” she said, noting that the lack of trust stems not from malicious intent or easy hackability but from unpredictability. She added that these models are trained to achieve tasks rather than to follow organizational norms or judgment, and they often hold “the keys to the kingdom,” with access to data and tools that could cause serious damage.
Microsoft’s move is notable because the company maintains close ties with both OpenAI and Anthropic, having invested in each and hosting OpenAI as a major cloud customer while also developing its own AI models. By casting doubt on the reliability of these partners’ agents, Microsoft is simultaneously promoting its own security solutions. The logic, however, is straightforward: monitoring software should be independent of the agents’ suppliers, much like auditors operate independently of the firms they audit. As Nadella put it, “We need to separate the supply of intelligence from the authority over it.”
Beyond Guardian Agents, Microsoft added an agent‑detection capability to its Microsoft Defender suite, capable of identifying up to 60 different agents that employees might introduce into the workplace, including Claude Code, Codex and OpenClaw. The company also introduced controls that limit agents’ access to data and systems, dynamically adjusting permissions based on the task at hand and requiring human approval for risky decisions.
The notion of AI agents as untrustworthy insiders is gaining traction across the industry. Microsoft was a founding member of Nvidia’s Open Agent Safety Platform, a coalition backed by more than 100 technology firms. The platform isolates agents in secure environments and can halt undesirable behavior through hardware mechanisms, effectively acting as a kill switch. This follows Microsoft’s earlier reveal of Surface Laptop Ultra PCs built for agents, which run on Nvidia chips and embed agent security and controls from the ground up.