Microsoft says AI agents are like insider threats as 'frontier models can't be trusted'

Microsoft introduced new security features aimed at protecting enterprises from the risks posed by AI agents. The most notable is Guardian Agents, part of the Project Perception product launched in June. Project Perception originally assumed AI attackers would come from outside the company, deploying "red team," "blue team," and "green team" agents to attack, detect, and fix vulnerabilities. However, Microsoft CEO Satya Nadella has warned that the real danger may be the AI agents enterprises themselves deploy, comparing them to rogue employees or "insider threats." In a private blog post, Nadella argued that model providers' safety assurances do not remove enterprises' responsibility, and that intelligence supply must be separated from authority over it. Microsoft security chief Hayete Gallot added that "frontier models, regardless of their origin, cannot be trusted" because they are unpredictable and trained to complete tasks rather than follow organizational norms, yet they are often granted broad access to sensitive data and tools.

Microsoft's solution is both surprising and self-serving: it is close to and has invested in OpenAI and Anthropic, yet it is now sowing distrust against them to sell its own agent security products. Its logic is that monitoring software should be independent of agent suppliers, just as auditors must be independent of the organizations they audit. Microsoft has also added agent detection to Microsoft Defender, covering up to 60 types of agents including Claude Code, Codex, and OpenClaw, along with features that limit agent access, dynamically adjust permissions, and require human approval for risky decisions. The industry-wide trend includes Microsoft joining Nvidia's new Open Agent Safety Platform, which isolates agents in secure environments and can stop behavior via a hardware-like kill switch, plus new Surface Laptop Ultra PCs built for agents on Nvidia chips with agent security built in.

(Source：TechCrunch)