On Monday, Microsoft unveiled a suite of new security features designed to protect enterprises from the growing threats posed by AI agents. This launch comes as Microsoft continues to warn businesses about the risks associated with artificial intelligence and the agents powered by it.
Perhaps the most notable addition is “Guardian Agents”—a new capability designed to monitor the AI agents employed by a company. Guardian Agents are part of “Project Perception,” an initiative introduced in June.
Project Perception is Microsoft’s response to powerful “hacker” models—such as Anthropic’s “Mythos” and “Fable,” or OpenAI’s “Daybreak.” The project initially introduced three categories of agents: “Red Teams” that simulate cyberattacks; “Blue Teams” tasked with detecting these attacks and assessing the resulting vulnerabilities; and “Green Teams” responsible for remediating those vulnerabilities.
The product was originally conceived with the assumption that AI-driven cyber threats would originate from outside an organization. However, Microsoft CEO Satya Nadella recently warned that the adversaries could, in fact, be the very AI agents that companies have already deployed and are paying to use—akin to a malicious employee, or what is known as an “insider threat.”
Earlier this month, in a personal blog post, Nadella cautioned that it is time to stop blindly trusting AI model providers, even when they offer assurances that their agents are safe and secure. He advocates for enterprises to deploy systems—independent of the AI labs themselves—to monitor and control the agents created by those labs.
“We are deploying these complex agentic systems and models, giving them access to our most sensitive data and allowing them to execute critical tasks on our behalf!” he wrote. “We cannot outsource the responsibility for the tasks these intelligent systems perform for us. Assurances from model providers do not absolve us of our own responsibility… In other words, we need to decouple the provision of intelligence from the governance of that intelligence.”
In announcing the launch of Guardian Agents, Hayete Gallot, a leader within Microsoft’s security division, put it even more bluntly.
She writes: “Unfortunately, frontier models—regardless of their origin—cannot be trusted.” She adds that this is not because they are malicious or vulnerable to hacking, but because their behavior is difficult to predict. They are trained to complete tasks, not to adhere to “organizational norms or judgment.”
Furthermore, they are often granted broad control, with access to data and tools that could cause significant harm.
Microsoft’s solution is both surprising and self-serving. It is surprising because Microsoft maintains close ties with—and has invested in—both OpenAI and Anthropic. OpenAI is also one of Microsoft’s largest cloud customers, and Microsoft itself operates AI laboratories dedicated to developing AI models. Consequently, this move by Microsoft effectively sows discord, potentially undermining some of its own commercial interests.
From the perspective of its own interests, Microsoft would prefer that enterprises purchase agent-security products from their cloud service provider rather than from companies like Anthropic or OpenAI. Yet, setting aside any potential conflicts of interest, the underlying logic is sound: software designed to monitor the behavior of AI agents should be independent of the agents’ own providers—much as an auditor must remain independent of the entity being audited.
Or, as Satya Nadella put it: “We need to decouple the provision of intelligence from the authority over that intelligence.”
Microsoft is seizing this market opportunity on several fronts. In addition to “Guardian Agents,” the company has integrated agent-detection capabilities into its Microsoft Defender suite, enabling it to identify up to 60 different types of AI agents—such as Claude Code, Codex, and OpenClaw—that employees might bring into the workplace. Furthermore, Microsoft has introduced features to restrict agents’ access to data and systems, with permissions that adjust dynamically based on the task at hand. For instance, if an agent appears to be making a high-risk decision, the system can trigger a requirement for human review.
This perspective—viewing AI agents as potentially untrustworthy “insiders”—is gaining traction across the broader industry.
Microsoft is a founding member of a new open platform for agent security, spearheaded by NVIDIA and backed by over 100 other technology companies. The platform isolates agents within a secure environment, using hardware-level monitoring to track—and, if necessary, block—their actions, effectively functioning as a “kill switch.” Previously, Microsoft unveiled the “Surface Laptop Ultra”—a new laptop designed specifically for AI agents, powered by NVIDIA chips and featuring built-in security and control mechanisms for these agents.