Microsoft is telling enterprises not to trust frontier AI models, including the ones it has invested billions in. That is a strange message from the company most tied to OpenAI, and it is also a smart sales pitch. Microsoft announced new agent security features on Monday, led by Guardian Agents, a tool that monitors the AI agents a company already runs.
Guardian Agents is part of Project Perception, which Microsoft introduced in June. That product was Microsoft’s answer to offensive security models like Anthropic’s Mythos and Fable and OpenAI’s vulnerability scanner Daybreak. It uses three kinds of agents: a red team that attacks, a blue team that detects the attacks and assesses the vulnerabilities, and a green team that fixes them. The original design assumed the hackers would come from outside.
That assumption has shifted. Satya Nadella has been arguing that the risky agent may be the one you deployed and pay for, behaving like a rogue employee. In a blog post earlier this month, he said enterprises should stop relying on model providers’ safety assurances and build separate systems, not controlled by the AI labs, to watch and control agents. His line: “We need to separate the supply of intelligence from the authority over it.”
Hayete Gallot, who runs Microsoft’s security business, was blunter. “Unfortunately, frontier models, regardless of their origin, cannot be trusted,” she wrote. Her reasoning is not that models are malicious or easy to hack. They are unpredictable, trained to finish tasks rather than follow organizational norms or judgment. And they often hold the keys to sensitive data and tools.
The rest of the release is practical. Microsoft Defender can now detect up to 60 types of agents that employees bring into the workplace, including Claude Code, Codex, and OpenClaw. That matters because shadow AI is the agent version of shadow IT, and most security teams cannot yet see what is running. Microsoft has also added controls that limit agent access to data and systems, adjust permissions based on the task, and require human approval when an agent seems to be making risky decisions. Pricing and rollout details were not part of the announcement.
The conflict of interest is obvious. Microsoft has stakes in both OpenAI and Anthropic, OpenAI is one of its biggest cloud customers, and it builds its own models. It also wants you to buy agent security from the cloud provider, not from the labs. But the logic holds up. Auditors should be independent of the organizations they audit, and the software watching agents should be independent of the companies selling them. Expect Google, AWS, and security vendors like CrowdStrike and Palo Alto Networks to make a similar argument, each with themselves as the neutral party.
This is no longer a Microsoft-only view. Microsoft is an inaugural member of Nvidia’s Open Agent Safety Platform, backed by more than 100 other tech companies. It isolates agents in secure environments and can monitor and stop their behavior through hardware, something like a kill switch. Microsoft’s new Surface Laptop Ultra PCs, built for agents on Nvidia chips, also ship with agent security and controls built in.
So is this noise? Not really. The product details are incremental, and Guardian Agents will need real-world testing before anyone should trust it. But the framing is the story. If agents are insiders, then identity, least privilege, and audit trails become the core of enterprise AI, and a new security category forms around them. Microsoft just staked an early claim.
