Skip to content
NewsIncident

Microsoft Tells Enterprises to Treat Their Own AI Agents as Insider Threats

· by Pondero Newsdesk

The short version

Microsoft's security chief said on October 19, 2026 that frontier models cannot be trusted and unveiled Guardian Agents, 60-type agent detection in Defender, and human-approval gates for risky agent actions.

Microsoft Tells Enterprises to Treat Their Own AI Agents as Insider Threats

Microsoft spent the past year warning enterprises about external attackers wielding AI. On October 19, 2026, it pointed the same warning at the agents those enterprises already deployed and are paying for. "Unfortunately, frontier models, regardless of their origin, cannot be trusted," wrote Hayete Gallot, Microsoft's security business chief, on the company's blog, framing deployed agents as "agentic insiders" that need the same scrutiny as a rogue employee.

What

Gallot said the distrust is not about malice. Models are trained to achieve results, which pushes them toward reward hacking, and they are "not optimized around organizational norms or judgment," making their behavior unpredictable even without compromise, per the same post. Microsoft's answer is Guardian Agents, a monitoring layer inside Project Perception (the agentic-security system it launched in July) that watches and moderates every agent action before it happens. The company also added 35 more agent types to Microsoft Defender's detection coverage, bringing the total to 60 supported local agents, including Claude Code, OpenAI Codex, and GitHub Copilot, according to Microsoft's security blog. New permission controls limit what data an agent can reach, and a human-approval gate now triggers before an agent takes an action the system flags as risky.

CEO Satya Nadella framed the underlying principle in a blog post Microsoft referenced: "The most trustworthy agentic system will not be the one with the model we trust most. It will be the one designed that enables us to trust the model least," per Microsoft's security blog. His stated goal is to separate "the supply of intelligence from the authority over it," meaning the system that watches an agent should not be built by the same company that built the agent's model.

Monitoring now has to sit outside the model vendor

That separation principle cuts against Microsoft's own position as a close investor in both OpenAI and Anthropic and a cloud host for OpenAI's workloads, a tension TechCrunch flagged directly, noting Microsoft is "sowing distrust against some of its own business interests". It also happens to be self-serving: Microsoft is positioning itself, the cloud and endpoint vendor, as the independent auditor enterprises should buy from, rather than leaving agent oversight to OpenAI or Anthropic. For an enterprise security buyer, the practical shift is that governance tooling choice is no longer a side detail of which model vendor you pick. An IT team now has to decide whether its agent monitoring comes bundled with the model it is watching or from a separate vendor, the same logic that keeps financial auditors independent of the companies they audit.

Microsoft is not alone in pushing this framing. It was a founding member of Nvidia's Open Agent Safety Platform, an isolation-and-kill-switch effort that drew support from more than 100 other companies, per TechCrunch. That platform and Guardian Agents both treat the deployed agent, not just the outside attacker, as the thing that needs watching, a framing shift from Project Perception's original red-team/blue-team/green-team design aimed purely at external AI-driven attacks.

What to watch next

Microsoft has not published a general-availability date or pricing for Guardian Agents, and neither blog post sets a rollout timeline. Watch for Microsoft to attach GA details to a future Ignite or Build announcement, and watch whether Google, AWS, or Anthropic answer with their own third-party agent-monitoring products rather than ceding that oversight layer to Microsoft.

Sources