Microsoft Says AI Agents Are an Insider Threat, Unveils Guardian Agents
Satya Nadella urges enterprises to stop trusting AI model providers' safety assurances and to monitor agents with separate oversight systems
By AXY AI Desk ·
Key points
- Microsoft introduced Guardian Agents on Monday, a feature to monitor AI agents that companies use, part of its Project Perception security product.
- Satya Nadella warned enterprises to stop trusting AI model providers' safety assurances and to build separate oversight systems.
- Microsoft security chief Hayete Gallot said frontier models, regardless of origin, cannot be trusted because they are unpredictable.
- Microsoft's stance is complicated by its close ties to OpenAI and Anthropic, and its own AI lab.
Microsoft on Monday introduced new security features designed to protect enterprises from the growing threat posed by AI agents, the software systems that carry out tasks on a user's behalf. The most notable addition is Guardian Agents, a feature intended to monitor the AI agents a company uses. Microsoft wants businesses to watch closely the agents their employees use with systems not controlled by leading AI labs such as OpenAI and Anthropic. The company's leaders are now describing those agents as a potential insider threat, the kind of risk normally associated with a rogue employee.
What Microsoft announced
Guardian Agents is part of Project Perception, a security product Microsoft introduced in June. The launch shows how quickly Microsoft has moved from warning about AI security risks to building tools that monitor AI itself. Microsoft has repeatedly warned enterprises about the dangers of AI and agents, and the new features extend that message into products that companies can deploy.
Analysts following enterprise security note that the announcement is aimed at a specific buyer: companies that already use AI models in their business operations and need a way to supervise what those models do when they act on their behalf. The move suggests Microsoft expects that demand to grow as AI agents gain access to more data and more software tools.
How Project Perception was designed
Project Perception was Microsoft's response to a new category of powerful AI models with strong hacking abilities. The source material cites Anthropic's Mythos and Fable models, along with OpenAI's security vulnerability scanning system, Daybreak, as examples of the tools that prompted the product. These systems can find weaknesses in software, which makes them useful to defenders but also potentially dangerous if misused by attackers.
Project Perception originally launched with three classes of agents, each modelled on a familiar part of cybersecurity practice. A red team acts like a hacker and attacks systems to expose weaknesses. A blue team detects the red team's activity and assesses the vulnerabilities it found. A green team is tasked with fixing those vulnerabilities. This three-colour framing is a common way security organisations divide responsibilities, and it reflects an approach in which the main danger is an outside attacker trying to break in.
That assumption is now being questioned. The original design treated AI hackers as coming from outside the company. Guardian Agents reflects a different concern, namely that a company's own AI tools could create risk from the inside.
From external attackers to the insider threat
An insider threat, in security terms, is a risk posed by someone who already has legitimate access to an organisation's systems. That person might act maliciously, or simply make a mistake that causes harm. Security teams usually manage this risk through controls on who can access what, logging of activity, and regular review of permissions.
Microsoft CEO Satya Nadella has been warning that the AI threat may come from the agents enterprises have deployed and are paying for. In a private blog post earlier this month, he argued that companies should stop trusting AI model providers, even when those providers offer assurances of safety and security for their agentic products. He wants enterprises to build separate systems, not controlled by the AI labs, to watch and control the agents those labs' products launch.
“We are deploying these complex agentic systems and models, with access to our most sensitive data and giving them the ability to take mission-critical actions on our behalf!” Nadella wrote. “We simply can’t outsource responsibility for what intelligence does on our behalf. A model provider’s assurances do not relieve us of that responsibility. … In other words, we need to separate the supply of intelligence from the authority over it.”
The argument in that quote is that a company cannot hand off accountability to the company that built the model. Even if the model maker says its product is safe, the business using the product remains responsible for what the product does with company data and systems. Separating the source of intelligence from the authority that governs it is a way of saying that oversight should sit with the customer, not the vendor.
Why Microsoft says frontier models cannot be trusted
When announcing Guardian Agents, Microsoft's security business chief, Hayete Gallot, was more direct. “Unfortunately, frontier models, regardless of their origin, cannot be trusted,” she wrote. She added that this is not because the models are malicious or easily hacked, but because they are unpredictable. Frontier models is a term used for the most advanced, general-purpose AI systems being built by leading developers.
Gallot's explanation focuses on how these models are trained. According to her account, they have been trained to achieve tasks rather than to follow organisational norms or judgment. A model optimised to complete a job may take actions that a human employee would recognise as inappropriate, even without any intent to cause harm. That unpredictability becomes a bigger problem when agents are given wide reach.
The source material notes that these agents are often given what it describes as the keys to the kingdom, meaning access to data and tools that could cause serious harm if misused. In practice, an AI agent might be able to read internal files, send messages, or change systems. If it acts unexpectedly, the damage could spread quickly across a company's infrastructure. This is why Microsoft is arguing that monitoring and limits on access matter as much as the quality of the model itself.
Microsoft's business ties and the question of self-interest
TechCrunch's reporting describes Microsoft's solution as both surprising and self-serving. The surprise comes from Microsoft's close relationship with OpenAI and Anthropic. Microsoft has invested in both companies. OpenAI is also one of Microsoft's biggest cloud customers, and Microsoft has its own AI lab developing models. Urging enterprises to distrust AI labs therefore runs against some of Microsoft's own commercial interests.
The tension is worth understanding. Microsoft benefits when customers use AI models through its cloud and software platforms, so any message that makes buyers more cautious about model providers could slow some of that business. At the same time, Microsoft can position its own monitoring products as the answer to that caution. Whether customers see that as sound security advice or as a sales pitch is likely to depend on how well the tools perform in practice.
The source material does not provide information on pricing, customer adoption, or independent testing of Guardian Agents, so those questions remain open.
What to watch next
Several questions will determine whether Microsoft's approach becomes a standard for enterprise AI. The first is whether companies accept the principle that AI providers cannot be the sole judges of their own safety. If enterprises adopt that view, demand for independent oversight tools could grow across the industry, not just for Microsoft's products.
The second question is how monitoring agents will work in practice. Watching an AI agent requires logging its actions, setting boundaries on what it can access, and deciding when a human must step in. Companies will want evidence that these controls catch real problems without slowing their operations to a crawl.
The third is how rival AI labs and security vendors respond. OpenAI and Anthropic are central to the debate, and their answers to Microsoft's argument could shape how customers judge the safety of agentic products. Analysts may also watch whether other large cloud providers follow Microsoft's lead in offering separate oversight systems.
For ordinary workers, the practical effect may be felt in the tools their employers approve and the rules that govern how AI agents can be used. For security teams, the message is that AI agents need to be treated like privileged users, with defined limits and continuous review. Microsoft's warning is that trust in a model cannot replace that work.
Questions and answers
What are Microsoft's Guardian Agents?
Guardian Agents is a new feature Microsoft introduced on Monday to monitor the AI agents a company uses. It is part of Project Perception, a security product Microsoft launched in June.
Why does Microsoft say AI agents are like insider threats?
Microsoft says AI agents with access to sensitive data and tools can act unpredictably, much like a rogue employee. Satya Nadella has warned that the risk may come from agents enterprises deploy, not only from outside hackers.
Why does Microsoft say frontier models cannot be trusted?
Microsoft security chief Hayete Gallot said frontier models cannot be trusted because they are unpredictable, not because they are malicious or easily hacked. She said they have been trained to achieve tasks rather than follow organisational norms or judgment.
Does this conflict with Microsoft's ties to OpenAI and Anthropic?
TechCrunch notes that Microsoft has invested in both OpenAI and Anthropic, and OpenAI is one of its biggest cloud customers. The source describes Microsoft's message as running against some of its own business interests.
Topics: Microsoft, AI agents, Satya Nadella, Guardian Agents, Project Perception, Insider threat, Frontier models, Enterprise cybersecurity
Sources: TechCrunch AI