On Monday, Microsoft launched new security features designed to protect enterprises from the growing threat of AI agents. This release comes as Microsoft continues to warn businesses about the risks posed by AI and agents.
The most notable new feature is Guardian Agents, a new tool for monitoring AI agents used by enterprises. Guardian Agents is part of Project Perception, a product launched by Microsoft in June.
Project Perception is Microsoft’s response to powerful hacking models like Anthropic’s Mythos and Fable, as well as OpenAI’s security vulnerability scanning system, Daybreak. Project Perception initially launched with three types of agents: “Red Teams” that act as hackers and launch attacks, “Blue Teams” that detect the Red Teams and assess the vulnerabilities they uncover, and “Green Teams” responsible for patching those vulnerabilities.
The design of this product is based on the assumption that AI hackers will come from outside the company. However, recently, Microsoft CEO Satya Nadella has been warning that AI adversaries could be the very agents the company has already deployed and paid for—like rogue human employees, known as “insider threats.”
Earlier this month, Nadella warned on his personal blog that it is time to stop trusting AI model providers, even if they offer assurances regarding the security and protection of their agent products. He advocates for enterprises to build independent systems, free from the control of AI labs, to monitor and govern the agents initiated by these AI lab products.
He wrote: “We are deploying these complex agent systems and models, giving them access to our most sensitive data and empowering them to take critical mission actions on our behalf! We cannot outsource responsibility for the intelligent actions performed on our behalf. … In other words, we need to separate intelligence from authority.”
When announcing Guardian Agents, Hayete Gallot, head of Microsoft Security, was more direct.
She wrote, "Unfortunately, frontier models cannot be trusted, regardless of their source." She added that this is not because they are malicious or vulnerable to hacking, but because they are unpredictable. Their training objective is to complete tasks, not to adhere to "organizational norms or judgment."
In addition, these models are often granted permissions akin to a "key to the kingdom," allowing them to access data and tools that could cause significant harm.
Microsoft’s solution is both surprising and self-serving. The surprise lies in the fact that Microsoft is well known to have close relationships with OpenAI and Anthropic, and has invested in both companies. OpenAI is also one of Microsoft’s largest cloud customers, and Microsoft itself operates an AI lab dedicated to developing models. Thus, Microsoft is effectively sowing distrust in parts of its own business interests.
The self-interest lies in Microsoft’s desire for enterprises to purchase proxy security products from it as a cloud provider, rather than from Anthropic and OpenAI. However, setting aside the conflict of interest, its logic is sound: software that monitors proxy behavior should be independent of the proxy provider, just as auditors should be independent of the organizations they audit.
As Nadella said: "We need to separate the supply of intelligence from its authority."
Microsoft is now seizing this business opportunity in multiple ways. In addition to Guardian Agents, it has integrated proxy detection into its Microsoft Defender products, enabling the identification of up to 60 different proxies brought into the workplace by employees, including Claude Code, Codex, and OpenClaw. Microsoft has also added features to restrict proxies’ access to data and systems, dynamically adjusting proxy permissions based on tasks—including requiring human approval when a proxy appears to be making high-risk decisions.
The idea of treating proxies as untrusted insiders is also gaining traction across the broader industry.
Microsoft is one of the founding members of NVIDIA’s newly launched Open Agent Safety Platform, which has received support from over 100 other technology companies. The platform isolates agents in secure environments and can monitor and block their actions through hardware-level controls, functioning somewhat like a “kill switch.” This follows Microsoft’s earlier announcement of the new Surface Laptop Ultra PC designed for agents, featuring NVIDIA chips and built-in agent security and control capabilities.