Microsoft launches Guardian Agents to watch AI agents, says frontier models can't be trusted

On Monday, Microsoft introduced new security features meant to protect enterprises from the growing threat of AI agents. The most notable is Guardian Agents, a feature intended to monitor the AI agents a company uses. It is part of Project Perception, a product Microsoft introduced in June.

Project Perception was Microsoft's answer to powerful hacking models such as Anthropic's Mythos and Fable and OpenAI's security vulnerability scanning system Daybreak. It originally launched three classes of agents: a red team that acted like hackers and attacked, a blue team that detected the red team and assessed the vulnerabilities it found, and a green team tasked with fixing them. The product was designed around the assumption that AI hackers would come from outside the company.

Lately, though, CEO Satya Nadella has been warning that the enemy may be the agents enterprises have deployed and are paying for, much like a rogue employee, an 'insider threat'. Earlier this month, in his private blog, Nadella warned that it is time to stop trusting AI model providers, even when they offer assurances of safety and security with their agentic products. He wants enterprises to run separate systems, not controlled by the AI labs, to watch and control the agents those labs' products launch. He wrote: 'We are deploying these complex agentic systems and models, with access to our most sensitive data and giving them the ability to take mission-critical actions on our behalf! We simply can't outsource responsibility for what intelligence does on our behalf.' His conclusion: 'we need to separate the supply of intelligence from the authority over it.'

When announcing Guardian Agents, Hayete Gallot, Microsoft's security business chief, went further. She wrote: 'Unfortunately, frontier models, regardless of their origin, cannot be trusted.' She added that this is not because the models are malicious or easily hacked, but because they are unpredictable. They have been trained to achieve tasks, not to follow 'organizational norms or judgment'. They are also often given broad access to data and tools that could do serious harm.

Beyond Guardian Agents, Microsoft added an agent detection feature to Microsoft Defender that can find up to 60 types of agents employees bring into the workplace, including Claude Code, Codex and OpenClaw. It also added features that limit agents' access to data and systems and dynamically adjust their permissions based on the task, including requiring human approval if an agent appears to be making risky decisions.

The idea is spreading across the industry. Microsoft was an inaugural member of Nvidia's new Open Agent Safety Platform, which drew support from more than 100 other tech companies. The platform isolates agents in secure environments and can monitor and stop behavior through hardware, functioning something like a kill switch. This follows Microsoft's announcement of Surface Laptop Ultra PCs built for agents, which run on Nvidia chips with agent security and controls built in.

The TechCrunch author calls Microsoft's approach both surprising and self-serving. It is surprising because Microsoft is famously close to OpenAI and Anthropic and has invested in both; OpenAI is also one of its biggest cloud customers, and Microsoft has its own AI lab developing models. It is self-serving because Microsoft wants enterprises to buy agent security from it, the cloud provider, rather than from Anthropic and OpenAI. Even so, the author judges the logic sound: software that monitors agent behavior should be separate from the suppliers of agents, just as auditors should be independent of the organizations they audit.

Key facts

Microsoft introduced Guardian Agents, a feature that monitors the AI agents a company uses, as part of Project Perception (introduced in June).
Microsoft Defender gains agent detection that can find up to 60 types of agents employees bring to work, including Claude Code, Codex and OpenClaw.
New controls limit agents' access to data and systems and adjust permissions per task, including human approval when an agent appears to make risky decisions.
Nadella wrote that enterprises should separate the supply of intelligence from the authority over it; Hayete Gallot wrote that frontier models, regardless of origin, cannot be trusted because they are unpredictable.
Microsoft was an inaugural member of Nvidia's Open Agent Safety Platform, backed by more than 100 other tech companies.

Why it matters

Project Perception was built on the assumption that AI hackers would come from outside the company. Microsoft's leadership now says the threat may be the agents a company has deployed and pays for, behaving like a rogue employee. That is a notable shift from a company that is close to OpenAI and Anthropic, has invested in both and counts OpenAI among its biggest cloud customers. The same view is spreading: Nvidia's Open Agent Safety Platform, backed by more than 100 other companies, rests on the same idea of treating agents as untrustworthy insiders.

Who it affects

Enterprises that deploy AI agents, and security teams that must keep track of agents employees bring into the workplace. It also affects AI labs such as Anthropic and OpenAI, whose agent products (the article names Claude Code and Codex among those Defender can detect) would be watched by systems the labs do not control. The author notes Microsoft would prefer enterprises buy agent security from it rather than from those labs.

How to use it

The announced pieces are Guardian Agents for monitoring a company's agents, an agent detection feature in Microsoft Defender covering up to 60 agent types, and controls that limit agent access to data and systems and adjust permissions to the task, with human approval for risky decisions. No pricing, availability date or licensing details for these features are given. The practical principle Nadella describes, and the TechCrunch author endorses, is to keep oversight of agents separate from the vendors that supply them.

How solid is it

The account comes from TechCrunch, which quotes Nadella's private blog and Gallot's written statement at the Guardian Agents announcement. The quotes are direct. The source does not say how Guardian Agents works technically, gives no figures on how many enterprises use Project Perception or the new features, and reports no reaction from Anthropic, OpenAI or Nvidia. The judgment that Microsoft's move is self-serving yet logically sound is the TechCrunch author's own view, not Microsoft's.

Risks and caveats

Gallot's argument is that frontier models are unpredictable rather than malicious or easily hacked: they were trained to achieve tasks, not follow organizational norms, and are often given access to sensitive data and tools. The source does not say which labs or models Nadella or Gallot had in mind; Gallot says 'regardless of their origin'. Microsoft has a commercial interest in selling the oversight it recommends, as the author points out. Mythos, Fable and Daybreak are named only as hacking or vulnerability-scanning systems and are not described further.

“In other words, we need to separate the supply of intelligence from the authority over it.”

— Satya Nadella, Microsoft CEO, in his private blog