Microsoft Warns AI Agents Act Like Insider Threats, Launches Guardian AgentsMicrosoft Warns AI Agents Act Like Insider Threats, Launches Guardian AgentsMicrosoft Warns AI Agents Act Like Insider Threats, Launches Guardian AgentsMicrosoft Warns AI Agents Act Like Insider Threats, Launches Guardian Agents
October 20, 2026
Microsoft on Monday, October 19, 2026, introduced Guardian Agents, a feature that monitors the AI agents a company runs, and its security business chief Hayete Gallot justified it in blunt terms: "Unfortunately, frontier models, regardless of their origin, cannot be trusted."
Microsoft on Monday, October 19, 2026, introduced Guardian Agents, a feature that monitors the AI agents a company runs, and its security business chief Hayete Gallot justified it in blunt terms: "Unfortunately, frontier models, regardless of their origin, cannot be trusted." The announcement matters less for the product than for who is saying it, since Microsoft has invested in both Anthropic and OpenAI, the two labs whose models it is now warning customers about. The practical consequence for security teams is a new threat model, in which the agent a company deployed itself is treated like a privileged employee who might act unpredictably.
What Happened
Gallot announced Guardian Agents (software agents that watch other AI agents operating inside a company) as part of Project Perception, Microsoft's agent-driven security effort. Alongside it, Microsoft added a detection capability to Microsoft Defender, its enterprise security suite, that can find up to 60 types of agents employees bring into the workplace, including Claude Code, Codex, and OpenClaw.
Microsoft also added controls that limit what agents can reach. The listed features are:
- Limits on agent access to data and systems.
- Permissions that adjust dynamically based on the task an agent is performing.
- A human approval step when an agent appears to be making risky decisions.
Gallot's stated reasoning is that the danger comes from unpredictability, not from malice or from models being easy to hack. Agents are trained to complete tasks rather than to follow "organizational norms or judgment," she wrote, and they are often granted broad access to data and tools. Project Perception was originally built on the assumption that AI-powered attackers would come from outside the company. The insider-threat framing moves the concern to agents the enterprise itself chose to deploy.
Why It Matters
The framing was set at the top. Earlier in October 2026, CEO Satya Nadella posted a warning on his private blog: "We are deploying these complex agentic systems and models, with access to our most sensitive data and giving them the ability to take mission-critical actions on our behalf!"
He then drew a line on accountability: "We simply can't outsource responsibility for what intelligence does on our behalf. A model provider's assurances do not relieve us of that responsibility. ... In other words, we need to separate the supply of intelligence from the authority over it."
That last sentence is the architectural claim. The company that supplies a model should not also be the party that decides what the model is allowed to do inside a customer's network. The insider-threat label (a risk category normally reserved for employees and contractors who already hold legitimate access) fits because an agent holds credentials, reads sensitive data, and takes actions, yet lacks the judgment a human employee is expected to exercise.
Treating an agent as an insider changes the questions a security team asks. They are the same ones asked about a contractor: what can it read, what can it change, and who signs off when it does something unusual. The three controls Microsoft listed map onto those questions directly, with access limits for the first, task-based permissions for the second, and a human approval step for the third. The shift is from defending the perimeter against outsiders to supervising actors that are already inside it.
Competitive Landscape
Microsoft's position is awkward by its own account. It invested in Anthropic, whose Mythos and Fable models are capable of hacking, and in OpenAI, which makes the Daybreak security scanner and is also one of Microsoft's biggest cloud customers. Project Perception was reportedly introduced as Microsoft's answer to Mythos, Fable and Daybreak, and Guardian Agents extends that answer to the argument that enterprises should buy agent security from their cloud provider rather than from the labs themselves.
Nvidia is the second pole. Its Open Agent Safety Platform isolates agents in secure environments and can monitor and stop their behavior through hardware, "functioning something like a kill switch." More than 100 other tech companies back it, and Microsoft joined as an inaugural member. Microsoft's new Surface Laptop Ultra PCs, built for agents with security controls baked in, run on Nvidia chips.
TechCrunch, which first reported the announcement, called Microsoft's stance both surprising and self-serving: surprising given its investments, self-serving because it creates a market for Microsoft's own security products. The same analysis compared the logic to auditors, who should be independent of the organizations they audit.
The Bigger Picture
The announcement shifts trust from model providers to the customer's own controls. Project Perception runs on three classes of agent: a red team that attacks, a blue team that detects and assesses, and a green team that fixes. The security stack is itself agentic, with agents policing agents.
Microsoft's argument is that supply and authority must be separate, but a monitor built by a company with a stake in the outcome is not independent in the auditor sense. The red, blue and green design hands more work to software, which makes the question of who checks that software harder to dodge, not easier.
The Defender detection feature points at a quieter problem. Employees are bringing in agents like Claude Code, Codex and OpenClaw on their own, and a tool that can find up to 60 types of them suggests Microsoft expects unsanctioned agents to be common. That resembles the governance gap shadow IT (software staff adopt without IT approval) created, with one difference: the unsanctioned tool can now take actions on company data, not just store it.
What's Next
The first test is adoption.
The second is convergence. Microsoft's Defender-centered approach and the Nvidia-led platform, with its hardware kill switch and 100-plus backers, could interlock or compete.
The sharpest point in the announcement is one Microsoft makes against itself. If model providers' assurances cannot be accepted, the same standard applies to a vendor that sells both the models' cloud and the cop. Nadella's principle of separating supply from authority is sound; whether Microsoft can be on the authority side while profiting from the supply side is the question customers should put in writing.
For IT decision-makers and procurement leads, the near-term step is an inventory: Defender's claim of finding up to 60 agent types means a count of which agents already run on employee machines, and under what permissions, before any new licenses are bought.
-- Aria Lin, Enterprise Technology Analyst
Sources: SEC · U.S. Department of Energy · TechCrunch · Microsoft Build 2025: the age of AI agents