Microsoft launches Guardian Agents to treat AI agents as insider threats

Microsoft on Monday introduced a set of security features aimed at protecting enterprises from the agents they have already deployed, led by a capability called Guardian Agents. The feature monitors the AI agents a company uses and sits inside Project Perception, the agentic security product Microsoft launched earlier this year.

Project Perception was built on the assumption that AI attackers would come from outside. It originally shipped three classes of agents: a red team that attacked systems like a hacker, a blue team that detected the intrusion and assessed vulnerabilities, and a green team that fixed what the blue team found.

That framing has shifted. Microsoft CEO Satya Nadella has spent recent weeks warning that the most dangerous agent may be one the company is paying for. In a private blog post, he argued that enterprises must stop outsourcing responsibility to model providers, even when those providers promise safety and security.

“We simply can’t outsource responsibility for what intelligence does on our behalf,” Nadella wrote, adding that companies need to “separate the supply of intelligence from the authority over it.”

Hayete Gallot, who leads Microsoft’s security business, put it more bluntly: “Unfortunately, frontier models, regardless of their origin, cannot be trusted.” She said the problem is not malice or easy compromise but unpredictability. Models are trained to complete tasks, not to follow organizational norms or exercise judgment.

Alongside Guardian Agents, Microsoft added agent discovery to Defender, which can identify up to 60 types of agents employees bring into the workplace, including Claude Code, Codex and OpenClaw. It also added controls that limit which data and systems an agent can reach, adjust permissions based on the task, and require human approval when an agent appears to be making a risky decision.

The position is awkward for Microsoft, which has invested in both OpenAI and Anthropic and counts OpenAI as a major cloud customer. TechCrunch notes that the advice is also a sales pitch: Microsoft would rather enterprises buy agent security from the cloud provider than from the labs supplying the agents.

The logic still holds. Software that audits agent behavior should be independent of the vendor that supplies the agent, much as an auditor should be independent of the company being audited. Microsoft is also an inaugural member of Nvidia’s new Open Agent Safety Platform, which isolates agents and can stop their behavior through hardware, and it has announced Surface Laptop Ultra PCs with agent controls built in.