Microsoft has launched Guardian Agents to monitor the software its own customers deploy, marking a shift from viewing AI risks as external hacks to treating them as internal threats.
The new tool is part of Project Perception, introduced in June to counter powerful hacking models like Anthropic’s Mythos and Fable and OpenAI’s Daybreak. The original system ran three roles: a red team that attacked, a blue team that found vulnerabilities, and a green team that fixed them.
That setup assumed the danger came from outside the company. Now, Microsoft CEO Satya Nadella argues the enemy is the agents enterprises have already paid for. He compares them to rogue employees, an insider threat.
In a private blog post earlier this month, Nadella urged companies to stop trusting AI model providers entirely, even when they promise safety. He wants firms to build separate systems to watch and control the agents those labs supply.
“We are deploying these complex agentic systems and models, with access to our most sensitive data and giving them the ability to take mission-critical actions on our behalf!” he wrote. “We simply can’t outsource responsibility for what intelligence does on our behalf. A model provider’s assurances do not relieve us of that responsibility. … In other words, we need to separate the supply of intelligence from the authority over it.”
Hayete Gallot, head of Microsoft’s security business, was more direct during the launch. “Unfortunately, frontier models, regardless of their origin, cannot be trusted,” she wrote. She explained this was not because the models were malicious or easily hacked, but because they were unpredictable. They are trained to finish tasks, not follow organisational norms or use judgment.
These systems often hold the keys to critical data and tools, creating a risk of serious harm.
The move is both surprising and self-serving. Microsoft has invested in OpenAI and Anthropic, and OpenAI is one of its largest cloud customers. The company also runs its own AI lab. By sowing distrust in these partners, it positions itself as the necessary guardian.
The business logic is clear: enterprises should buy agent security from Microsoft, the cloud provider, rather than from its competitors. The principle remains sound. Software that watches agent behaviour must be separate from the suppliers of those agents, just as auditors must be independent of the organisations they audit.
Microsoft is capitalising on this opportunity across its portfolio. Beyond Guardian Agents, the company added an agent detection feature to Microsoft Defender. This scans for up to 60 types of agents employees bring into the workplace, including Claude Code, Codex, and OpenClaw.
It also includes controls that limit agent access to data and systems. Permissions adjust dynamically based on the task at hand. If an agent appears to make risky decisions, the system requires human approval before allowing the action.
This view of agents as untrustworthy insiders is spreading through the wider industry. Microsoft joined Nvidia’s new Open Agent Safety Platform as an inaugural member. More than 100 other tech firms have supported the initiative.
The platform isolates agents in secure environments and stops bad behaviour through hardware, acting like a kill switch. This follows Microsoft’s announcement of the Surface Laptop Ultra PCs, built for agents and running on Nvidia chips. These devices have security and controls baked in.
What it means
For businesses, the era of trusting an AI vendor to police their own tools is over. Companies must now assume that any agent with access to sensitive data or the ability to take action is a potential liability until proven otherwise. The practical result is a split in responsibility: the supplier builds the intelligence, but the company must hold the authority to decide how it is used.
