Microsoft says AI agents are like insider threats as ‘frontier models can’t be trusted’

On Monday Microsoft added new agent security features, led by Guardian Agents, a tool that watches the AI agents a company has deployed. It sits inside Project Perception, the red, blue, and green team security agents Microsoft introduced in June. Defender can now detect up to 60 kinds of agents that employees bring to work, including Claude Code, Codex, and OpenClaw. Microsoft also added controls that limit agent access to data and systems, adjust permissions by task, and require a human sign-off when an agent seems to be making a risky call.

The framing is the headline. Microsoft's security chief, Hayete Gallot, wrote that frontier models, whatever their origin, cannot be trusted, not because they are malicious but because they are unpredictable and trained to finish tasks rather than respect organizational norms. That is a blunt message from a company that has invested in both OpenAI and Anthropic and builds its own models.

Is this new, or a rerun of what Satya Nadella said earlier this month? Both. The idea is not new. Nadella already argued that models should be treated as insider risks, that controls belong outside the model, and that someone must always be able to stop an agent mid-task. What is new is that Microsoft is now shipping against that thesis. A philosophy post became a product launch with specific features, and the security chief sharpened the language from assume-compromised to cannot be trusted.

We think the core argument is correct. The thing that watches an agent should not be built by the same company that supplies the agent, for the same reason auditors should be independent of the firms they audit. Nadella's phrase about separating the supply of intelligence from authority over it is the right design principle, and it is good to see a major vendor building around it instead of asking customers to take model makers at their word.

But we should be clear-eyed about the business here. Microsoft wants enterprises to buy agent security from their cloud provider rather than from the labs. That is self-interested, and it raises its own independence question: Microsoft is also a model builder, a major investor in two frontier labs, and the host of OpenAI's workloads. An auditor with stakes in the audited is not fully independent either.

The practical risk is that this becomes a new layer of vendor lock-in dressed as safety. If agent governance consolidates into a few platform owners, enterprises trade one dependency for another, and the oversight layer itself becomes a high-value target. A watcher with broad visibility into every agent's actions is precisely what an attacker would want to compromise.

Still, the direction is healthy. Agent discovery alone is valuable; many companies have no idea how many coding agents their staff are running. Permissions that shrink to the task and human approval for risky actions are the kind of boring controls that prevent bad days. I'm watching whether these features work across vendors as advertised, and whether the industry builds open standards for agent oversight before a few platforms define them by default.

Nadella laid out his insider-risk view of frontier models earlier this month, calling for controls outside the model and an emergency brake an authorized person can pull mid-task. Microsoft was also an inaugural member of Nvidia's Open Agent Safety Platform, backed by more than 100 companies, which isolates agents and can halt their behavior at the hardware level.