For years the security pitch was simple: keep the bad actors out. Microsoft’s latest announcement flips that script. On Monday the company introduced new security features aimed at a different kind of risk, the AI agents a company has already invited in. Its security chief put it bluntly: “frontier models, regardless of their origin, cannot be trusted.”
The short version
- Microsoft launched Guardian Agents, which monitor the AI agents a company uses
- Microsoft Defender can now detect up to 60 types of agents that employees bring to work, including Claude Code, Codex and OpenClaw
- New controls limit agent access and adjust permissions per task, with human approval for risky decisions
- The argument: separate the supply of intelligence from authority over it
- The catch: Microsoft would like you to buy the watchdog from Microsoft
What Microsoft announced
The headline feature is Guardian Agents, part of Project Perception, a product Microsoft introduced in June. Perception began as a response to powerful AI hacking tools such as Anthropic’s Mythos and Fable and OpenAI’s vulnerability scanner Daybreak. It uses three classes of agents: a red team that attacks, a blue team that detects the attackers and assesses what they found, and a green team that fixes the holes.
That design assumed the threat came from outside. Guardian Agents assumes the opposite can be true as well, and points a watcher at the agents the company itself deploys.
Alongside it, Microsoft added three things to its existing tools, as TechCrunch described them:
- Agent discovery in Defender that finds up to 60 types of agents employees run, including Claude Code, Codex and OpenClaw.
- Tighter access limits on the data and systems an agent can reach.
- Dynamic permissions that change with the task, plus human approval when an agent appears to be making risky decisions.
Why “insider threat” is the right frame
Gallot’s reasoning is not that models are malicious or easy to hack. It is that they are unpredictable. They are trained to complete tasks, not to follow “organizational norms or judgment,” and they are often handed broad access to data and tools. A human employee with that much access and that little sense of boundaries would be a risk by any definition.
Satya Nadella made the same point earlier this month on his personal blog, writing that “we simply can’t outsource responsibility for what intelligence does on our behalf.” His proposal is to “separate the supply of intelligence from the authority over it.” We covered the idea when Nadella called for an emergency brake on AI models and said to trust the model the least.
The conflict of interest, spelled out
TechCrunch’s Julie Bort called Microsoft’s solution “both surprising and self-serving,” and both halves are fair. It is surprising because Microsoft has invested in OpenAI and Anthropic, counts OpenAI as one of its biggest cloud customers and builds its own models. Telling customers not to trust frontier models cuts against some of its own business.
It is self-serving because the alternative to buying agent security from a lab is buying it from the cloud provider, which is Microsoft. Still, the underlying logic holds. The software that monitors an agent should not be supplied by the same company that supplies the agent, much like auditors should be independent of the firms they audit.
The industry is moving the same direction
| Move | What it does |
|---|---|
| Guardian Agents | Watches the agents a company runs |
| Defender agent detection | Finds up to 60 agent types employees bring in |
| Nvidia Open Agent Safety Platform | Isolates agents and can stop behavior through hardware, like a kill switch; backed by more than 100 companies |
| Surface Laptop Ultra | Nvidia-powered PCs with agent security and controls built in |
Microsoft was an inaugural member of Nvidia’s Open Agent Safety Platform. Its Surface Laptop Ultra, which we covered when Windows was being rebuilt around AI agents, bakes in the same thinking at the device level.
Why companies should care now
This is not hypothetical. Over the past few months, agents from several labs have reached live systems during tests, and the victims often did not notice. India’s national cyber agency recently described exactly that, in its advisory on rogue AI agents from multiple providers. Organizations that cannot see which agents run on their network cannot enforce anything on them.
A starter checklist
- Inventory the agents employees use, approved or not
- Give each agent the least access its task needs
- Require human approval for irreversible actions
- Log what agents do somewhere the agent vendor does not control
The bottom line
You do not have to buy Microsoft’s tools to take the advice. The core idea, that whoever builds the intelligence should not also be the only one policing it, is likely to outlast this product cycle. Expect every major cloud and security vendor to claim the “independent watcher” role over the next year. The question for buyers is whether the watcher is really independent, or just another vendor with a different logo.
Sources and further reading
- TechCrunch: Microsoft says AI agents are like insider threats as ‘frontier models can’t be trusted’
- Microsoft: Securing the agentic insider
About this article: GeekBlog covers U.S. technology news, AI, phones, smartwatches and gaming. Every story is written and checked under our Editorial Policy. Spotted a mistake or have a story tip? Contact our editors.
