Microsoft on Monday rolled out a set of security features aimed at containing the AI agents enterprises are increasingly deploying, and its framing of the problem is unusually blunt: the agents a company pays for should be treated less like trusted software and more like potential insider threats.

The centerpiece is Guardian Agents, a feature that monitors the AI agents operating inside a company. It sits within Project Perception, the product Microsoft introduced in June as its answer to offensive security models such as Anthropic's Mythos and Fable and OpenAI's vulnerability-scanning system Daybreak. Project Perception originally shipped three classes of agents: a red team that attacked systems like a hacker, a blue team that detected the red team and assessed the vulnerabilities it found, and a green team responsible for fixing them. That design assumed the adversary would come from outside. Microsoft's latest message is that the adversary may already be inside, running on the company's own budget.

From perimeter defense to insider risk

The change in posture has been building for weeks. Earlier this month, CEO Satya Nadella used his private blog to argue that enterprises should stop trusting AI model providers, even when those providers offer assurances about the safety of their agentic products. He called for separate systems, not controlled by the AI labs, to watch and govern the agents those labs' products launch. "We are deploying these complex agentic systems and models, with access to our most sensitive data and giving them the ability to take mission-critical actions on our behalf!" he wrote, adding that responsibility for what intelligence does on an organization's behalf cannot be outsourced. His formulation: separate the supply of intelligence from the authority over it.

Hayete Gallot, who leads Microsoft's security business, was more direct still. "Unfortunately, frontier models, regardless of their origin, cannot be trusted," she wrote. The problem is not malice or easy compromise, she argued, but unpredictability: models are trained to complete tasks, not to follow organizational norms or exercise judgment. Combine that with the broad access agents are routinely granted — to data and to tools capable of doing serious damage — and the result is an actor with the keys to the kingdom and no real accountability.

What Microsoft is shipping

Guardian Agents is only part of the package. Microsoft Defender now includes an agent detection capability that can identify up to 60 types of agents employees bring into the workplace, including Claude Code, Codex and OpenClaw. Microsoft has also added controls that limit what agents can reach, adjust permissions dynamically according to the task at hand, and require human approval when an agent appears to be heading toward a risky decision.

The stance is notable given Microsoft's commercial position. The company is famously close to OpenAI and Anthropic, having invested in both; OpenAI is also among its largest cloud customers, and Microsoft runs its own AI lab developing models. Warning enterprises away from trusting model providers therefore cuts against some of Microsoft's own business interests — while simultaneously creating a market for agent security bought from the cloud provider rather than from the labs supplying the agents. The conflict is real, but the underlying logic holds: the software that audits agent behavior should be independent of the party supplying the agents, much as auditors are independent of the organizations they examine.

An industry consensus forms

Microsoft is not alone in treating agents as untrustworthy insiders. It was an inaugural member of Nvidia's new Open Agent Safety Platform, which launched with backing from more than 100 other technology companies. The platform isolates agents in secure environments and can monitor and halt their behavior through hardware, functioning something like a kill switch. The move follows Microsoft's announcement of Surface Laptop Ultra PCs built for agents, running on Nvidia chips with agent security and controls built in.

For engineering teams, the practical implication is that agent governance is becoming an infrastructure concern rather than a policy document. Detection of shadow agents, least-privilege permissioning, task-scoped access and human-in-the-loop approval for high-risk actions are converging into a distinct product category — one Microsoft clearly intends to own. The harder question is whether monitoring can keep pace with models whose behavior is, by Microsoft's own admission, unpredictable by design.