Microsoft says AI agents resemble insider threats because frontier models cannot be trusted

Meta description: Microsoft launches Guardian Agents within Project Perception to monitor enterprise AI agents, separate authority from model suppliers, and address insider risk.
Tags: Microsoft, Guardian Agents, Project Perception, AI agents, enterprise security
Featured image: abstract AI agent security dashboard, no people, no logos, no text

Microsoft Guardian Agents, announced Monday, mark the clearest change yet in how Microsoft wants enterprises to think about AI agents: not as tools that might be attacked from outside, but as inside actors that may need independent oversight. The launch arrives as Microsoft keeps warning enterprises about the dangers of AI and agents.

June: Project Perception started with outside AI hackers in mind

In June, Microsoft introduced Project Perception as a response to powerful hacking models such as Anthropic’s Mythos and Fable and OpenAI’s security vulnerability scanning system Daybreak. The product originally launched three classes of agents. A red team acted like hackers and carried out attacks. A blue team detected the red team and assessed the vulnerabilities it found. A green team was tasked with fixing them. The design assumed that AI-powered attackers would come from outside the company.

Earlier this month: Nadella turned the warning inward

Earlier this month, Microsoft CEO Satya Nadella warned in his private blog that it is time to stop trusting AI model providers, even when those providers offer safety and security assurances around agentic products. He said the AI enemy may be the agents enterprises have already deployed and are paying for, much like a rogue human employee, otherwise known as an insider threat.

In his view, companies are running complex agentic systems and models with access to sensitive data and the ability to take mission-critical actions. “We simply can’t outsource responsibility for what intelligence does on our behalf,” he wrote, adding that model providers’ assurances do not relieve enterprises of responsibility. He wants enterprises to use separate systems, not controlled by AI labs, to watch and control the agents those labs’ products launch.

Monday: Guardian Agents tied monitoring to enterprise authority

On Monday, Microsoft unveiled security features aimed at shielding enterprises from the expanding threat posed by AI agents. The standout addition was Guardian Agents, a capability meant to watch the AI agents an enterprise has deployed. Guardian Agents sits inside Project Perception.

Microsoft security business chief Hayete Gallot said, “Unfortunately, frontier models, regardless of their origin, cannot be trusted.” She said the concern is not always malice or easy hacking; it is unpredictability. Frontier models are trained to achieve tasks rather than follow organizational norms or judgment, and they are often given the keys to the kingdom, with access to data and tools that could do serious harm.

The move is surprising on one level and self-serving on another. Microsoft is famously close to OpenAI and Anthropic, having invested in both, and OpenAI is one of its biggest cloud customers. Microsoft also has its own AI lab developing models, so its warning cuts against some of its own business interests. At the same time, Microsoft wants enterprises to buy agent security products from it, the cloud provider, rather than from Anthropic and OpenAI.

Even with those conflicts, the logic rests on separation: software that monitors agent behavior should be independent from the suppliers of agents, just as auditors should be independent of the organizations they audit.

Latest controls: detection, permissions, hardware kill switches

Microsoft is turning that business opportunity into a product line in several ways. Beyond Guardian Agents, Microsoft Defender gained an agent detection feature that can find up to 60 types of agents that employees bring into the workplace, including Claude Code, Codex, and OpenClaw. Microsoft also added features that limit agents’ access to data and systems, dynamically adjust agent permissions based on the task, and require human approval if an agent appears to be making risky decisions.

The insider framing is spreading beyond Microsoft. Microsoft joined Nvidia’s new Open Agent Safety Platform as an inaugural member, and the platform has gathered support from more than 100 other tech companies. It isolates agents in secure environments and can monitor and stop behavior through hardware, functioning something like a kill switch. This follows Microsoft’s announcement of the new Surface Laptop Ultra PCs built for agents, which run on Nvidia chips and have agent security and controls baked in.

The current stage of Microsoft’s timeline is a shift from external detection to internal authority. In June, the question was how to defend against AI hackers. By Monday, the question had become whether an organization can safely let agents use its most sensitive data and take critical actions.