Microsoft ships Guardian Agents, saying frontier models ‘can’t be trusted’

Microsoft added new agent security features led by Guardian Agents, a tool that watches the AI agents a company has deployed, TechCrunch reports. It sits inside Project Perception, the red, blue and green team security agents Microsoft introduced in June. Defender can now detect up to 60 kinds of agents employees bring to work, including Claude Code, Codex and OpenClaw. Microsoft also added controls that limit agent access to data and systems, adjust permissions by task and require human sign-off when an agent appears to be making a risky call.

The framing drew attention. Microsoft security chief Hayete Gallot wrote that frontier models, whatever their origin, cannot be trusted, not because they are malicious but because they are unpredictable and trained to finish tasks rather than respect organizational norms. It is a blunt message from a company that has invested in both OpenAI and Anthropic and builds its own models.

The idea is not new. Satya Nadella argued earlier this month that models should be treated as insider risks, with controls outside the model and an emergency brake an authorized person can pull mid-task (Nadella on compromised models). What is new is that Microsoft is shipping against that thesis and sharpening the language from ‘assume compromised’ to ‘cannot be trusted.’ Microsoft was also an inaugural member of Nvidia’s Open Agent Safety Platform, backed by more than 100 companies, which isolates agents and can halt them at the hardware level. Microsoft has also published a code of conduct for its own models (MAI code of conduct).

The core argument holds: what watches an agent should be separate from what supplies it, as auditors are independent of the firms they audit. Nadella’s phrase about separating the supply of intelligence from authority over it is a sound design principle.

Microsoft wants enterprises to buy agent security from their cloud provider rather than the labs. That is self-interested and raises its own independence question: Microsoft is a model builder, a major investor in two frontier labs and the host of OpenAI’s workloads. Agent governance consolidating into a few platform owners could become lock-in dressed as safety, and a watcher with broad visibility into every agent’s actions is a high-value target for attackers.

Still, the direction is healthy. Agent discovery alone is valuable, since many companies do not know how many coding agents staff run, and task-scoped permissions with human approval for risky actions are the kind of controls that prevent incidents. Whether the features work across vendors as advertised, and whether open standards emerge, remain open. Related concerns surfaced in evaluator debates (embedded evaluators). More in our Microsoft coverage, cybersecurity coverage and AI agents coverage.