Microsoft rolled out new security capabilities on Monday aimed at shielding enterprises from the escalating risks posed by AI agents. The release arrives as Microsoft keeps sounding alarms about the hazards of AI and agentic systems.

The headline addition is Guardian Agents, a feature built to keep watch over the AI agents a company deploys. It sits within Project Perception, a product that debuted in June. Project Perception was Microsoft's response to potent hacking models such as Anthropic's Mythos and Fable, along with OpenAI's vulnerability-scanning system Daybreak. The original version launched three categories of agents: a "red team" that behaved like attackers, a "blue team" that spotted the red team and evaluated the weaknesses it uncovered, and a "green team" assigned to patch them. The design assumed AI attackers would originate outside the company. Yet lately, Microsoft CEO Satya Nadella has been cautioning that the AI adversary might be the very agents enterprises have deployed and are paying for—much like a rogue human employee, otherwise known as an "insider threat."

Earlier this month, writing on his private blog, Nadella warned that the time has come to stop trusting AI model providers, even when they offer assurances of safety and security for their agentic products. He wants enterprises to adopt separate systems—ones not controlled by the AI labs—to watch over and govern the agents those labs' products launch. "We are deploying these complex agentic systems and models, with access to our most sensitive data and giving them the ability to take mission-critical actions on our behalf," he wrote. "We simply can't outsource responsibility for what intelligence does on our behalf. A model provider's assurances do not relieve us of that responsibility. … In other words, we need to separate the supply of intelligence from the authority over it."

Announcing Guardian Agents, Microsoft's security business chief Hayete Gallot put it even more bluntly. "Unfortunately, frontier models, regardless of their origin, cannot be trusted," she wrote, noting that this isn't because they are malicious or easily hacked, but because they are unpredictable. They have been trained to accomplish tasks, not to follow "organizational norms or judgment."

On top of that, they frequently receive the keys to the kingdom, with access to data and tools capable of causing serious harm. Microsoft's answer is both surprising and self-serving. The surprising part is that Microsoft is famously close to OpenAI and Anthropic, having invested in both. OpenAI is also one of its biggest cloud customers, and Microsoft runs its own AI lab developing models. So Microsoft is cultivating distrust against some of its own business interests. The self-serving part is that Microsoft wants enterprises to purchase agent security products from it—the cloud provider—rather than from Anthropic and OpenAI. Yet setting conflicting interests aside, its reasoning holds up. The software monitoring agent behavior ought to be separate from the suppliers of agents, just as auditors should be independent of the organizations they audit. Or, as Nadella frames it: "We need to separate the supply of intelligence from the authority over it."

Microsoft is now pursuing that business opportunity on multiple fronts. Beyond Guardian Agents, it has added an agent detection capability to its Microsoft Defender product that can identify up to 60 types of agents employees bring into the workplace, including Claude Code, Codex, and OpenClaw. It has also introduced features that restrict agents' access to data and systems and dynamically adjust their permissions based on the task at hand—including requiring human approval when an agent appears to be making risky decisions. The notion of agents as untrustworthy insiders is gaining traction across the wider industry as well. Microsoft was a founding member of Nvidia's new Open Agent Safety Platform, which drew backing from more than 100 other tech companies. The platform isolates agents in secure environments and can monitor and halt behavior through hardware, operating much like a kill switch. This follows Microsoft's unveiling of new Surface Laptop Ultra PCs built for agents, which run on Nvidia chips and ship with agent security and controls built in.