Microsoft says AI agents are like insider threats as ‘frontier models can’t be trusted’

Buy One Founder Summit Ticket, Get a Second for Free. Register now.

Disrupt doors open Oct. 13. Get your pass and bring someone with you at 50% off. REGISTER NOW.

TechCrunch Desktop Logo TechCrunch Mobile Logo Latest Startups Venture Apple Security AI Apps Disrupt 2026 Events Podcasts Newsletters Search Submit Site Search Toggle Mega Menu Toggle Topics Latest

Microsoft says AI agents are like insider threats as ‘frontier models can’t be trusted’ Julie Bort 3:04 PM PDT · October 19, 2026 Microsoft on Monday introduced new security features designed to protect enterprises from the growing threat of AI agents. The launch comes at Microsoft continues to warn enterprises about the dangers of AI and agents.

Perhaps the most notable addition is Guardian Agents, a new feature intended to monitor the AI agents a company uses. Guardian Agents is part of Project Perception, a product introduced in June.

Project Perception was Microsoft’s answer to powerful hacking models like Anthropic’s Mythos and Fable and OpenAI’s security vulnerability scanning system Daybreak. Project Perception originally launched three classes of agents: a “red team” that acted like hackers and attacked, a “blue team” that detected the red team and assessed the vulnerabilities they found, and a “green team” tasked with fixing them.

The product was designed around the assumption that AI hackers would come from outside the company. But lately, Microsoft CEO Satya Nadella has been warning that the AI enemy may be the very agents enterprises have deployed and are paying for, much like a rogue human employee, otherwise known as an “insider threat.”

Earlier this month, in his private blog, Nadella warned that it’s time to stop trusting AI model providers, even if they offer assurances of safety and security with their agentic products. He wants enterprises to implement separate systems, not controlled by the AI labs, to watch and control the agents that those AI labs’ products launch.

“We are deploying these complex agentic systems and models, with access to our most sensitive data and giving them the ability to take mission-critical actions on our behalf!” he wrote. “We simply can’t outsource responsibility for what intelligence does on our behalf. A model provider’s assurances do not relieve us of that responsibility. … In other words, we need to separate the supply of intelligence from the authority over it.”

When announcing Guardian Agents, Microsoft’s security business chief Hayete Gallot was even more straightforward.

“Unfortunately, frontier models, regardless of their origin, cannot be trusted,” she wrote, adding that this isn’t because they are malicious or easily hacked, but because they are unpredictable. They have been trained to achieve tasks, not follow “organizational norms or judgment.”

On top of that, they are often given the keys to the kingdom, with access to data and tools that could do serious harm.

Microsoft’s solution is both surprising and self-serving. The surprising side is that Microsoft is famously close to OpenAI and Anthropic, having invested in both. OpenAI is also one of its biggest cloud customers, and Microsoft has its own AI lab developing models. So, Microsoft is sowing distrust against some of its own business interests.

The self-serving side is that Microsoft wants enterprises to buy agent security products from it, the cloud provider, rather than from Anthropic and OpenAI. But conflicting interests aside, its logic is sound. The software that monitors agent behavior should be separate from the suppliers of agents, just as auditors should be independent of the organizations they audit.

Or as Nadella puts it: “We need to separate the supply of intelligence from the authority over it.”

Microsoft is now seizing that business opportunity in a variety of ways. In addition to Guardian Agents, it has added an agent detection feature to its Microsoft Defender product that can find up to 60 types of agents that employees bring into the workplace, including Claude Code, Codex, and OpenClaw. It has also added features that limit agents’ access to data and systems, and dynamically adjust their agent permissions based on the task. That includes requiring human approval if an agent appears to be making risky decisions.

This idea of agents as untrustworthy insiders is taking hold across the broader industry, too.

Microsoft was an inaugural member of Nvidia’s new Open Agent Safety Platform, which garnered the support of more than 100 other tech companies. The platform isolates agents in secure environments and can monitor and stop behavior through hardware, functioning something like a kill switch. This follows Microsoft’s announcement of the new Surface Laptop Ultra PCs built for agents, which run on Nvidia chips and have agent security and controls baked in.

When you purchase through links in our articles, we may earn a small commission. This doesn’t affect our editorial independence.

November 4 Boston Buy One Pass, Get a Second Free Cover more ground at TechCrunch’s ultimate founder bootcamp of the year by bringing your co-founder or partner for free Book before the BOGO deal expires

Anthropic says its workforce has become less junior and is spending more time in meetings Anthony Ha

Replit makes OpenAI its default over Anthropic, CEO says Kirsten Korosec Lucas Ropek Rebecca Bellan

Mark Wahlberg wants to take on the longevity-startup crowd with an affordable gym concept Connie Loizos

Tesla reveals SpaceX-powered Roadster that flies and falls with style Sean O'Kane

FBI arrests OpenAI employee accused of planting hidden recording device in conference room Zack Whittaker

Bumble agrees to a $1.3B acquisition deal as online dating faces a reset Lauren Forristal

Just 5 years in, interactive chatbot platform Character.AI files for bankruptcy Ivan Mehta

X LinkedIn Facebook Instagram youTube Mastodon Threads Bluesky TechCrunch Staff Contact Us Advertise Site Map Terms of Service Privacy Policy RSS Terms of Use Code of Conduct Voice AI Anthropic Flock Startup Battlefield Disrupt 2026 Tech Layoffs ChatGPT © 2026 TechCrunch Media LLC.