Microsoft Says It Can't Trust Any AI Model — Including the Ones It Sells

Microsoft wants enterprises to stop trusting AI models to police themselves, and it's building a business around that distrust. On Monday, the company introduced a set of security features aimed at treating AI agents less like helpful software and more like employees who might go rogue.

The centerpiece is Guardian Agents, a new monitoring layer built on top of Project Perception, the agent-security product Microsoft launched in June. Guardian Agents watches the AI agents a company has deployed and flags behavior that looks off.

Project Perception started as Microsoft's answer to a wave of AI-powered hacking tools, including Anthropic's Mythos and Fable and OpenAI's vulnerability-scanning system Daybreak. It works in three layers: a "red team" of agents that simulate attacks, a "blue team" that spots the red team's intrusions and assesses the damage, and a "green team" that patches what's broken. The original framing assumed the threat would come from outside the company, hackers using AI to break in.

That framing has shifted. Microsoft CEO Satya Nadella has increasingly argued that the real risk may be the agents a company already owns and pays for, misbehaving from the inside. Earlier this month, in his private blog, Nadella wrote that enterprises should stop taking safety assurances from AI model providers at face value, and instead build independent systems, ones not controlled by the AI labs themselves, to watch and constrain those agents.

"We are deploying these complex agentic systems and models, with access to our most sensitive data and giving them the ability to take mission-critical actions on our behalf!" Nadella wrote. "We simply can't outsource responsibility for what intelligence does on our behalf. A model provider's assurances do not relieve us of that responsibility. … In other words, we need to separate the supply of intelligence from the authority over it."

Hayete Gallot, who leads Microsoft's security business, put it more bluntly when announcing Guardian Agents: "Unfortunately, frontier models, regardless of their origin, cannot be trusted." Her point isn't that these models are malicious or easily compromised. It's that they're unpredictable, trained to complete tasks rather than to follow the unwritten rules and judgment calls that govern a workplace. And because many of these agents are handed broad access to sensitive data and systems, that unpredictability carries real stakes.

A convenient kind of skepticism

There's an obvious tension here. Microsoft has deep financial ties to both OpenAI and Anthropic, having invested in each, and OpenAI remains one of the biggest customers of Microsoft's cloud business. Microsoft also runs its own AI lab. By telling enterprises not to trust frontier models "regardless of their origin," Microsoft is casting doubt on products tied to its own partners and its own research arm.

It's also, not coincidentally, a pitch for Microsoft's own security products. If enterprises shouldn't trust OpenAI or Anthropic to police their own agents, the logical buyer for that oversight layer is a neutral third party, and Microsoft, as the cloud provider sitting underneath most of this infrastructure, is positioning itself as exactly that. The reasoning still holds up on its own merits: a system that audits agent behavior arguably should be independent from the company that built the agent, the same logic that keeps financial auditors separate from the companies they review.

Nadella summed up the strategy himself: "We need to separate the supply of intelligence from the authority over it."

What Microsoft is actually shipping

Beyond Guardian Agents, Microsoft has added an agent-detection capability to Microsoft Defender that can identify up to 60 different types of agents employees bring into their workplace on their own, including tools like Claude Code, Codex, and OpenClaw, often without IT ever approving them. Microsoft is also rolling out controls that restrict what data and systems an agent can touch, and that adjust an agent's permissions dynamically depending on the task it's performing. If an agent starts making decisions that look risky, the system can require a human to sign off before it proceeds.

This isn't just a Microsoft talking point. Microsoft was a founding member of Nvidia's new Open Agent Safety Platform, an effort that has already drawn backing from more than 100 other tech companies. That platform isolates agents inside secure environments and gives administrators a way to monitor and halt agent behavior at the hardware level, essentially a kill switch for misbehaving AI. It arrives alongside Microsoft's recently announced Surface Laptop Ultra PCs, which run on Nvidia chips and come with agent security and controls built in from the start.

Together, these moves suggest the industry consensus around agentic AI is shifting. The early pitch for AI agents was about autonomy, giving them access and letting them act on a company's behalf. The emerging pitch is about containment: assume the agent might go wrong, and build the guardrails before it does. Microsoft is betting that enterprises will pay for that containment, and that it, not the labs building the models, is who they'll pay.