Guardian Agents is Microsoft’s new tool for watching the AI agents businesses already use, rather than focusing only on attackers outside their networks. The feature joins several security measures unveiled on Monday, alongside the company’s continuing warnings to enterprises about AI risks.
Microsoft argues that an agent can pose a security risk without anyone hacking it. A company may pay for software and willingly let it into its systems, only for that software to become an insider threat comparable to an employee who goes rogue.
For Hayete Gallot, who leads Microsoft’s security business, the concern is unpredictable behavior, not malicious motives or how easily a model can be hacked. In her introduction to Guardian Agents, she wrote: “Unfortunately, frontier models, regardless of their origin, cannot be trusted.” Models are trained to get tasks done rather than observe “organizational norms or judgment.” When they can use powerful tools and reach sensitive data, the consequences of their choices can be severe.
Earlier this month, CEO Satya Nadella used his private blog to argue for oversight independent of AI suppliers. Businesses, he said, should no longer depend on providers’ promises about safety and security. Instead, separate systems should supervise agents and control their actions, without being controlled by the AI labs that supply them.
“We are deploying these complex agentic systems and models, with access to our most sensitive data and giving them the ability to take mission-critical actions on our behalf!” he wrote. “We simply can’t outsource responsibility for what intelligence does on our behalf. A model provider’s assurances do not relieve us of that responsibility. … In other words, we need to separate the supply of intelligence from the authority over it.”
Looking for threats inside a business broadens the role of Project Perception, which now houses Guardian Agents. When Microsoft introduced Project Perception in June, its starting assumption was that AI attacks would originate outside the company. The product answered hacking models including Anthropic’s Mythos and Fable, as well as Daybreak, OpenAI’s system for scanning for vulnerabilities.
At launch, three classes of agents divided the work: a “red team” attacked as hackers would, a “blue team” detected the attacks and assessed the weaknesses they revealed, and a “green team” fixed them. Guardian Agents extends that scrutiny to AI already working inside the business.
Other Microsoft updates address identifying agents and setting boundaries on their actions. Microsoft Defender can now detect up to 60 types of agents that employees bring into the workplace, including Claude Code, Codex, and OpenClaw. Added access controls restrict the data and systems available to agents while changing their permissions according to the task. Decisions that appear risky can require a human to approve them.
The source report calls Microsoft’s stance both surprising and self-serving, pointing to its competing interests. OpenAI and Anthropic have both received Microsoft investment. Microsoft also develops models through its own lab, while OpenAI is one of its largest cloud customers. Urging businesses not to trust model providers thus works against several of Microsoft’s own commercial ties.
There’s also a sales opportunity for Microsoft: it wants companies to purchase agent monitoring from their cloud provider, Microsoft, rather than from Anthropic or OpenAI. Even so, the report considers the reasoning valid despite those conflicting interests. Software overseeing agents should operate independently of their supplier, in the same way that auditors need independence from the organizations they examine.
Concern about agents becoming insider threats extends beyond Microsoft. The company was an inaugural member of Nvidia’s Open Agent Safety Platform, which received backing from more than 100 other tech companies. The platform keeps agents in secure environments, with hardware monitoring that can halt their behavior, acting somewhat like a kill switch.
This comes after Microsoft announced its Surface Laptop Ultra PCs built for agents. Those PCs run on Nvidia chips and incorporate security and controls for agents.
