Microsoft adds Guardian Agents as it warns against trusting AI models

From attackers to insiders

Microsoft introduced Project Perception in June as a response to powerful models for hacking, including Anthropic’s Mythos and Fable, and OpenAI’s Daybreak vulnerability-finding system. Its original agents had three roles:

The project assumed AI hackers would target companies from outside. CEO Satya Nadella has recently warned about a different risk: agents that companies deploy and pay to use could themselves become a threat, much like a rogue employee.

Earlier this month, Nadella wrote on his personal blog that companies should stop trusting model providers, even when those providers promise their agent products are safe. He called for separate systems to monitor and manage agents—systems not controlled by the labs that built them.

Companies are giving complex agent systems access to sensitive data and assigning them critical work, Nadella argued. A model provider’s assurances do not transfer responsibility for what an agent does on an organization’s behalf. AI supply, in his view, should be separate from the authority to control its actions.

What Microsoft says models cannot guarantee

Microsoft security chief Hayete Gallo put the case more bluntly: frontier models cannot be trusted, regardless of who built them. Her point was not that models are malicious or easy to hack. They are unpredictable because they were trained to complete tasks, not to follow an organization’s rules or make decisions according to its norms.

Agents may also receive broad access to data and tools that can cause serious damage.

The controls—and the commercial interest

Microsoft is building several products around that argument. Guardian Agents is part of Project Perception. Microsoft has also added agent detection to Defender, which can recognize up to 60 types of software employees bring to work, including Claude Code, Codex and OpenClaw.

Other controls limit agents’ access to data and systems, adjust permissions to fit the task, and can require human approval when an agent is about to make a risky decision.

There is a business tension here. Microsoft works closely with OpenAI and Anthropic and has invested in both. OpenAI is one of its largest cloud customers; Microsoft also runs its own AI lab and builds models. Telling customers not to rely on model providers therefore puts pressure on some of Microsoft’s own interests.

At the same time, Microsoft wants companies to buy agent-security tools from it as a cloud provider rather than from Anthropic or OpenAI. I think that conflict makes independence the central test of the pitch: a monitoring system is more credible when it is separate from the company supplying the agent, much as an auditor should be independent of the organization being audited.

A wider push for agent oversight

Microsoft is not alone in treating agents as untrusted users. It has joined Nvidia’s new Open Agent Safety Platform, backed by more than 100 other technology companies. The platform isolates agents in secure environments, tracks their behavior and can stop them at the hardware level, like an emergency shutoff.

Microsoft has also introduced new Surface Laptop Ultra computers designed for agent workloads. They run on Nvidia chips, with agent-security and management tools built into the system.

What I’d want to know is who sets the limits when the monitoring system and the agent come from the same provider. Microsoft’s case depends on separating supply from control; the product’s value will turn on whether that separation is real in practice.