Microsoft has introduced new security tools designed to protect enterprise customers from the growing threat posed by AI agents.
The most notable addition is Guardian Agents, a feature intended to monitor the AI agents a company uses. Guardian Agents is part of Project Perception, a product introduced in June. Project Perception was originally positioned as Microsoft’s response to powerful hacking models such as Anthropic’s Mythos and Fable, as well as OpenAI’s vulnerability scanning system Daybreak.
The product initially included three classes of agents: a “red team” that acted like hackers and attacked systems, a “blue team” that detected the red team’s actions and assessed the vulnerabilities they found, and a “green team” tasked with fixing them. The project was built on the assumption that threats from AI hackers would come from outside the company.
However, recently Microsoft CEO Satya Nadella has increasingly warned that the “enemy” may turn out to be the very agents that enterprises themselves have deployed and are paying for. In essence, this resembles a disloyal employee, a classic “insider threat.”
Earlier this month, in his private blog, Nadella stated that it is time to stop blindly trusting AI model providers, even if they offer assurances of safety and security for their agentic products. In his view, enterprises should implement separate control systems that are not controlled by AI labs to monitor and manage the agents.
“We are deploying these complex agentic systems and models, with access to our most sensitive data and giving them the ability to take mission-critical actions on our behalf! We simply can’t outsource responsibility for what intelligence does on our behalf. A model provider’s assurances do not relieve us of that responsibility. … In other words, we need to separate the supply of intelligence from the authority over it,” Nadella wrote.
When announcing Guardian Agents, Microsoft’s security business chief Hayete Gallot was even more straightforward.
“Unfortunately, frontier models, regardless of their origin, cannot be trusted,” she said, explaining that this is not because they are malicious or easily hacked, but because they are unpredictable. These models have been trained to achieve tasks, not to follow “organizational norms or judgment.”
At the same time, agents are often given near-unlimited access to data and tools that, in the event of erroneous or undesirable actions, could cause serious harm.
Microsoft’s solution appears both unexpected and advantageous for the company itself. On one hand, Microsoft is closely tied to OpenAI and Anthropic; it has invested in both companies. OpenAI is one of its largest cloud customers, and Microsoft has its AI lab developing models. Thus, the company is sowing distrust toward some of its own business interests.
On the other hand, Microsoft is offering enterprises the chance to buy agent security tools from it as a cloud provider, rather than from Anthropic or OpenAI. Despite the conflict of interest, the logic is sound: the software that monitors agent behavior should be separate from the suppliers of the agents themselves, much as auditors should be independent of the organizations they audit.
Or, as Nadella puts it:
“We need to separate the supply of intelligence from the authority over it.”
Microsoft is already implementing this capability in several ways. In addition to Guardian Agents, an agent detection feature has been added to Microsoft Defender that can identify up to 60 types of agents that employees bring into the workplace, including Claude Code, Codex, and OpenClaw. Tools have also been introduced that limit agents’ access to data and systems and dynamically adjust their permissions based on the task at hand. In particular, if the system determines that an agent is making risky decisions, human approval is required.
The idea that agents should be treated as untrustworthy insiders is gaining traction across the broader industry as well. Microsoft was a founding member of Nvidia’s new Open Agent Safety Platform, which has received support from more than 100 technology companies. The platform isolates agents in secure environments and can monitor and stop their behavior at the hardware level, essentially functioning as a kind of “kill switch.”
