Microsoft says frontier models can’t be trusted, ships Guardian Agents

Microsoft has shipped Guardian Agents, a monitoring layer that watches the AI agents a company runs, assesses them for risk and lets administrators restrict, gate or shut them down. Alongside the launch, Microsoft’s security chief wrote that “frontier models, regardless of their origin, cannot be trusted.” If you run agents in production, oversight is now a design requirement rather than a nice-to-have. The open decision is who owns that layer.

What happened

According to TechCrunch’s report on Microsoft treating AI agents as insider threats, Microsoft introduced Guardian Agents on Monday as part of Project Perception, a product it launched in June. Project Perception originally shipped three classes of agents. A red team attacks like a hacker, a blue team detects the red team and assesses what it found, and a green team fixes the problems. TechCrunch describes it as Microsoft’s answer to hacking-capable systems such as Anthropic’s Mythos and Fable and OpenAI’s Daybreak vulnerability scanner.

That design assumed the attacker was outside the building. Guardian Agents points the other way. Hayete Gallot, who runs Microsoft’s security business, wrote that frontier models cannot be trusted. Her reason was not that they are malicious or easily hacked. She said they are unpredictable, trained to achieve tasks rather than follow “organizational norms or judgment.” Satya Nadella made the same case on his private blog earlier this month. He argued that a model provider’s assurances do not relieve enterprises of responsibility and that “we need to separate the supply of intelligence from the authority over it.”

Guardian Agents is not the only new control. Microsoft Defender gains agent detection that can find up to 60 types of agents that employees bring into work, including Claude Code, Codex and OpenClaw. Other new features limit agents’ access to data and systems, adjust permissions dynamically based on the task, and require human approval when an agent appears to be making risky decisions. The Neuron’s daily AI digest notes that the controls span Microsoft 365 E7 and Project Perception. Administrators can stop an agent from making changes, require approval, or shut it down.

The Neuron ran the story next to a Reuters report on a Chinese-speaking hacker. According to that report, the hacker broke into websites belonging to more than 100 companies after handing much of the work to AI agents. Human involvement was limited, and the campaign reportedly cost only a few thousand dollars.

What it means

Strip away the framing and this is a vendor telling you that the product category it sells needs a supervisor. TechCrunch calls the move “both surprising and self-serving.” It is surprising because Microsoft has invested in both OpenAI and Anthropic, counts OpenAI among its biggest cloud customers and runs its own AI lab. It is self-serving because Microsoft wants enterprises to buy agent security from the cloud provider rather than from the model labs. TechCrunch still concludes the logic is sound: monitoring should be independent of the agent supplier, in the same way auditors are independent of the companies they audit.

We agree with the principle, but we think the more consequential part is the business model. Guardian Agents is a platform wedge as much as a safety feature. Over time your agent inventory, permission policies, approval flows and kill switches will all live inside one vendor’s stack. Swapping the underlying model will stay fairly easy. Moving the oversight layer will not, so the monitoring becomes the sticky part of the stack. “Independent” is also relative when the monitor’s vendor builds its own frontier models and hosts one of the major labs on its cloud.

The Reuters report sharpens the other half of the problem. Cheap, mostly automated intrusion changes the scale defenders have to plan for. Your own agents already hold legitimate credentials, which is exactly why the insider-threat framing fits. We have covered adjacent failures, from OpenAI test models affecting third-party websites to agents moving money that banks cannot yet attribute.

What it means for builders

The industry pattern is converging. TechCrunch reports that Microsoft was an inaugural member of Nvidia’s Open Agent Safety Platform, which more than 100 other tech companies have backed. That platform isolates agents in secure environments and can stop their behaviour through hardware, which works much like a kill switch. Microsoft’s software controls and Nvidia’s hardware approach rest on the same primitives. Each agent gets an inventory entry, scoped permissions, an approval gate on risky actions and a hard stop. Build these primitives into your systems whether or not you buy anyone’s product.

What to do now

• Inventory every agent, including the coding assistants and desktop tools staff installed themselves. You cannot gate what you cannot see.
• Give each agent its own scoped credentials per task. Shared admin tokens turn a misbehaving agent into a full insider.
• Put human approval on irreversible actions such as payments, deletions, outbound customer email and production deploys. A lightweight approval channel works; ours runs on self-hosted Zulip and ntfy.
• Log every tool call somewhere the agent cannot write to, and test your kill switch before you need it.
• Keep policy portable. Define permissions and approval rules in your own configuration and enforce them at a gateway you control. Then a vendor’s monitor becomes an implementation detail rather than the place your rules live.

If your estate is already deep in Microsoft 365, Guardian Agents may well be the pragmatic choice. If you run several models across several clouds, think hard before letting one supplier own both the intelligence and the authority over it. Either way, put one question to your security team this week: when did they sign off on trusting the agents you already have in production?

Frequently Asked Questions

What are Microsoft Guardian Agents?

Guardian Agents is a feature within Microsoft's Project Perception that monitors the AI agents a company uses and assesses them for risk. According to reporting on the launch, related controls let administrators restrict an agent from making changes, require human approval, or shut it down.

Why did Microsoft say frontier models cannot be trusted?

Microsoft's security chief Hayete Gallot wrote that frontier models are not malicious or easily hacked but are unpredictable. They are trained to achieve tasks rather than follow organisational norms or judgment, and they often have broad access to data and tools.

Do we need Microsoft's product to monitor our agents?

No. The underlying controls are agent inventory, scoped credentials, human approval on risky actions, independent logging and a tested kill switch. You can build these yourself or buy them. The trade-off is that putting monitoring inside one vendor's stack raises the cost of switching later.