Microsoft wants you to stop trusting AI vendors. Including, awkwardly, the ones it has invested in. That’s the pitch behind its latest security launch, and it deserves both credit and suspicion.
Microsoft announced a set of enterprise security features on Monday, led by Guardian Agents, which monitor the AI agents a company already runs. Guardian Agents belongs to Project Perception, introduced in June as Microsoft’s answer to Anthropic’s Mythos and Fable and OpenAI’s Daybreak vulnerability scanner. Perception started with three agent classes: a red team that attacks, a blue team that detects and assesses, and a green team that fixes.
That design assumed the hackers would be outside the building. Microsoft now says the threat may be inside, and that you’re paying for it. CEO Satya Nadella has been framing agents as something like a rogue employee, an insider threat. In a blog post earlier this month he wrote that “a model provider’s assurances do not relieve us of that responsibility,” and that enterprises must “separate the supply of intelligence from the authority over it.”
Security chief Hayete Gallot was blunter: “frontier models, regardless of their origin, cannot be trusted.” Her reasoning isn’t that models are malicious or easy to hack. They’re unpredictable, trained to finish tasks rather than respect organizational norms or judgment. And they often get broad access to sensitive data and tools.
For privacy, that’s the important part. An agent with access to your email, documents and customer records doesn’t need to be compromised to cause a breach. It only needs to misjudge a task. Vendor safety promises are marketing until someone independent can verify them.
Here’s what Microsoft is shipping:
- Guardian Agents, which watch the behavior of the agents a company deploys.
- Agent detection in Microsoft Defender that can spot up to 60 types of agents employees bring in, including Claude Code, Codex and OpenClaw.
- Controls that limit agent access to data and systems, and adjust permissions to the task.
- Human approval requirements when an agent appears to be making risky decisions.
Pricing and availability weren’t part of the announcement as reported, so ask before you budget.
The move is both surprising and self-serving. Microsoft is a major investor in OpenAI and Anthropic, counts OpenAI among its biggest cloud customers, and runs its own AI lab. Casting doubt on frontier models cuts against some of its own interests. But the payoff is obvious: it wants you to buy agent oversight from the cloud provider, not from the labs.
Still, the argument is sound. Auditors shouldn’t work for the companies they audit, and the software watching agents shouldn’t come from the agent makers. The catch is that the new overseer is another vendor with deep access to your environment, and it will see what your agents see. Monitoring tools become data collectors. Ask where that telemetry goes, how long it’s kept and who can read it.
The idea is spreading. Microsoft is an inaugural member of Nvidia’s Open Agent Safety Platform, backed by more than 100 other companies. It isolates agents in secure environments and can monitor and stop behavior at the hardware level, essentially a kill switch. Microsoft’s new Surface Laptop Ultra PCs, built for agents on Nvidia chips, ship with agent controls baked in.
The takeaway: agents are being treated as untrusted insiders by the same companies selling them. That’s a healthy shift, as long as the guards face the same scrutiny as the agents.