Microsoft has introduced a set of enterprise security features aimed at the risks AI agents create, headlined by Guardian Agents, a new feature that monitors the AI agents a company uses. Guardian Agents is part of Project Perception, the product Microsoft introduced in June as an answer to hacking models like Anthropic’s Mythos and Fable and OpenAI’s security vulnerability scanning system Daybreak. Project Perception originally shipped three classes of agents: a red team that acts like hackers and attacks, a blue team that detects the red team and assesses the vulnerabilities it finds, and a green team tasked with fixing them. The original design assumed AI attackers would come from outside the enterprise.

That assumption has shifted. Microsoft CEO Satya Nadella has been warning that the dangerous AI actor may be the very agents enterprises have deployed and are paying for, analogous to a rogue human employee — an insider threat. Earlier this month, in his private blog, Nadella argued that it is time to stop trusting AI model providers, even when they offer safety and security assurances with their agentic products. He wants enterprises to implement separate systems, not controlled by the AI labs, to watch and control the agents that those labs’ products launch. ‘We are deploying these complex agentic systems and models, with access to our most sensitive data and giving them the ability to take mission-critical actions on our behalf!’ he wrote. ‘We simply can’t outsource responsibility for what intelligence does on our behalf. A model provider’s assurances do not relieve us of that responsibility. … In other words, we need to separate the supply of intelligence from the authority over it.’

When announcing Guardian Agents, Microsoft’s security business chief Hayete Gallot was more blunt. Frontier models, regardless of their origin, cannot be trusted — not because they are malicious or easily hacked, but because they are unpredictable. They are trained to achieve tasks, not to follow organizational norms or judgment, and they are often given access to data and tools that could do serious harm, which Gallot described as being given ‘the keys to the kingdom.’

The article notes that Microsoft’s solution is both surprising and self-serving. Microsoft is famously close to OpenAI and Anthropic, having invested in both; OpenAI is one of its largest cloud customers, and Microsoft runs its own AI lab developing models. Pushing distrust of frontier-model providers cuts against some of its own business interests. But it also positions Microsoft to sell agent security from the cloud provider rather than from Anthropic and OpenAI. Conflicting interests aside, the logic is sound: the software that monitors agent behavior should be separate from the suppliers of agents, just as auditors should be independent of the organizations they audit.

Microsoft is pursuing the opportunity across several products. Alongside Guardian Agents, it added an agent detection feature to Microsoft Defender that can find up to 60 types of agents employees bring into the workplace, including Claude Code, Codex, and OpenClaw. It also added features that limit agents’ access to data and systems, dynamically adjust their permissions based on the task, and require human approval when an agent appears to be making risky decisions.

The view of agents as untrustworthy insiders is spreading across the broader industry. Microsoft was an inaugural member of Nvidia’s Open Agent Safety Platform, which has support from more than 100 tech companies. The platform isolates agents in secure environments and can monitor and stop behavior through hardware, functioning something like a kill switch. Microsoft also announced Surface Laptop Ultra PCs built for agents, running on Nvidia chips with agent security controls baked in.