Microsoft says AI agents are like insider threats and launches Guardian Agents

Microsoft announced on Monday (19) a batch of security features to address a problem the company itself helped create: AI agents with access to sensitive data and the autonomy to act on their own inside companies. The highlight is Guardian Agents, a continuous monitoring system that treats agents as potential malicious insiders, not as trustworthy tools by default. The information comes from TechCrunch.

Guardian Agents is part of Project Perception, a product Microsoft launched in June in response to offensive hacking models such as Anthropic's Mythos and Fable, and OpenAI's Daybreak, a vulnerability-scanning system. In its original conception, Project Perception had three classes of agents: a "red" team that attacked like an external intruder, a "blue" team that detected the attacks and assessed the flaws found, and a "green" team tasked with fixing them.

From external threat to internal threat

Project Perception's initial design started from a classic security premise: the enemy comes from outside. But Microsoft's own messaging has shifted. In a recent post on his personal blog, CEO Satya Nadella argued that the most urgent risk now is the agent that the company itself hired and is paying to run, with access granted to critical systems.

We are deploying these complex agentic systems and models, with access to our most sensitive data and giving them the ability to take mission-critical actions on our behalf! We simply can't outsource responsibility for what intelligence does on our behalf. A model provider's assurances do not relieve us of that responsibility. … In other words, we need to separate the supply of intelligence from the authority over it.

Satya Nadella, CEO of Microsoft

Hayete Gallot, head of Microsoft's security business, was direct when announcing Guardian Agents: the problem isn't that cutting-edge models are malicious or easy to hack, it's that they're unpredictable. Trained to complete tasks, not to follow organizational rules or exercise judgment, and yet they're given the keys to entire systems.

Unfortunately, frontier models, regardless of their origin, cannot be trusted,

Hayete Gallot, head of Microsoft's security business

What Guardian Agents does in practice

In addition to continuous monitoring via Guardian Agents, Microsoft added a detection feature to Defender that identifies up to 60 types of AI agents employees bring into the company without going through IT, including names familiar to developers' daily lives, such as Claude Code, Codex, and OpenClaw. The idea is to provide visibility into what is already running on the infrastructure even before discussing governance.

The package also includes dynamic access controls: agent permissions change according to the task, and actions classified as risky now require explicit human approval before execution. It's a shift in mental model: instead of giving the agent a broad token all at once, the system restricts and expands the scope of access in real time.

Why the logic is uncomfortable for Microsoft itself

The move is odd from a business standpoint. Microsoft is an investor in OpenAI and Anthropic, OpenAI is one of Microsoft's biggest cloud clients, and Microsoft itself runs its own AI lab. By publicly stating that no frontier model, "regardless of its origin," deserves trust, the company is sowing distrust against partners it commercially depends on.

At the same time, there's a clear interest at play: Microsoft wants to sell the enterprise the software that audits the agents, rather than leave that slice to OpenAI and Anthropic. Still, the principle behind the move is sound and applies to any stack, regardless of vendor: whoever oversees an agent's behavior shouldn't be the same company that builds it, just as an auditor shouldn't answer to the organization being audited.

The industry is converging on the same diagnosis

Microsoft joined as a founding member of the Open Agent Safety Platform, an Nvidia initiative that already brings together more than 100 technology companies. The platform isolates agents in secure environments and can monitor and interrupt behaviors at the hardware level, functioning as a physical kill switch, not just a logical one.

The move coincides with the launch of the new Surface Laptop Ultra notebooks, equipped with Nvidia chips and agent security controls built in from the factory. The takeaway is that the industry is shifting from "trust and monitor later" to "isolate by default and release on demand."

What changes for those running agents in production

For engineering teams, the practical takeaway doesn't depend on which AI vendor you use. A few concrete actions are worth taking today, even before any contract with Microsoft:

• Separate identity from authority: the agent should have its own identity, distinct from the service account used by the human, with dedicated audit logs that don't go through the model provider.
• Monitor outside the vendor: if the system watching the agent is operated by the same company that sells the model, you're trusting the defendant to do the forensics. It's worth evaluating independent observability tools, not just the provider's native dashboard.
• Minimum scope per task: instead of a broad API token valid for an entire session, prefer permissions that expire and adjust according to the action the agent is attempting to execute.
• Human approval at risk points: actions such as writing to production, deleting data, or calling payment APIs deserve a manual gate, even if that makes the flow less "autonomous."
• Inventory of what's already running: before buying any detection tool, it's worth a manual survey of which agents (Claude Code, Codex, Copilot, internal scripts with LangChain or CrewAI) already have access to the company's repositories and credentials.

What remains an open question is whether this wave of "zero trust for AI" products will produce an open standard, auditable by any security team, or whether each cloud will package its own proprietary version of the same problem, swapping model vendor lock-in for monitoring vendor lock-in. For those outside the Azure ecosystem, the practical question is: who audits the agent when the auditing vendor is also the cloud vendor?