Microsoft rolled out a set of security features on Monday that treat enterprise AI agents as possible insider threats. TechCrunch AI reports that the main addition is Guardian Agents, a tool that watches the AI agents a company already runs. Microsoft’s security chief also gave a blunt reason for building it: “Unfortunately, frontier models, regardless of their origin, cannot be trusted.”
That’s an unusual thing to hear from a company that has invested in both OpenAI and Anthropic.
What Microsoft Shipped
Guardian Agents is part of Project Perception, which Microsoft introduced in June as its answer to offensive security tools like Anthropic’s Mythos and Fable and OpenAI’s vulnerability scanner Daybreak. Project Perception started with three types of agents:
- Red team: agents that act like hackers and attack
- Blue team: agents that catch the red team and assess the holes it finds
- Green team: agents that fix those holes
That first version assumed the attackers would come from outside the company. The new release looks inward. Here’s what’s in it:
- Guardian Agents. A monitoring layer that watches the AI agents your company has deployed and pays for. Think of it as a supervisor for software that has access to sensitive data and can take real actions.
- Agent detection in Microsoft Defender. Defender can now spot up to 60 kinds of agents that employees bring to work on their own, including Claude Code, Codex and OpenClaw. It’s shadow IT all over again, except these tools can act on their own.
- Tighter access controls. New features limit which data and systems an agent can reach. This applies least-privilege thinking (giving each user or tool only the access it needs) to non-human workers.
- Permissions that change with the task. Agent permissions now shift based on what the agent is doing. If an agent seems to be making a risky decision, a human has to approve it first.
TechCrunch AI’s report doesn’t include pricing or a detailed availability timeline.
Why Microsoft Says Models Can’t Be Trusted
Gallot was careful about the reasoning. She says the problem isn’t that models are malicious or easy to hack. It’s that they’re unpredictable. They’re trained to finish tasks, not to follow “organizational norms or judgment.” And companies often give them the keys to the kingdom, meaning broad access to data and tools that could do serious damage.
CEO Satya Nadella made the same case earlier this month on his private blog. He told enterprises to stop relying on assurances from model providers and to put agents under separate systems that the AI labs don’t control. “We simply can’t outsource responsibility for what intelligence does on our behalf,” he wrote. “We need to separate the supply of intelligence from the authority over it.”
The Self-Interest Behind It
This pitch is surprising and convenient for Microsoft at the same time. It’s surprising because OpenAI is one of Microsoft’s largest cloud customers, Microsoft has backed both OpenAI and Anthropic, and it runs its own model lab. So it’s raising doubts about its own partners and products.
It’s convenient because Microsoft wants companies to buy agent security from their cloud provider rather than from the labs. Calling the labs untrustworthy makes that sale easier.
Still, the argument holds up. You don’t let a company audit itself, and the same logic applies to the software that polices AI agents. It should be independent of whoever supplies the agents, and that’s true no matter who’s selling.
The Industry Is Heading the Same Way
Microsoft isn’t the only one thinking this way. It was a founding member of Nvidia’s new Open Agent Safety Platform, which more than 100 tech companies now support. The platform runs agents in isolated environments and can stop them at the hardware level, which works a lot like a kill switch. Microsoft’s new Surface Laptop Ultra PCs, which run on Nvidia chips, also ship with built-in agent security and controls.
What stands out is how fast the conversation has shifted. A year ago, the big question was how to get agents to do useful work. Now it’s how to stop them from doing the wrong work with full access. If you’re deploying agents at scale, expect agent monitoring to become a standard line item in your budget, much like endpoint security did.
The next question is whether OpenAI and Anthropic answer with their own independent oversight tools, or whether “separate supply from authority” becomes the industry’s default rule. TechCrunch AI’s original report has the full story.