Microsoft on Monday, October 19, introduced new security features meant to protect enterprises from the AI agents they deploy themselves. The centerpiece is Guardian Agents, which monitor the agents a company uses. In announcing it, Microsoft’s security business chief Hayete Gallot said that “frontier models, regardless of their origin, cannot be trusted”, not because they are malicious, but because they are unpredictable.

What Guardian Agents are

Guardian Agents are part of Project Perception, a product Microsoft introduced in June as its answer to powerful hacking models such as Anthropic’s Mythos and Fable and OpenAI’s vulnerability-scanning system Daybreak. Project Perception originally launched three classes of agents: a red team that acted like hackers, a blue team that detected the red team and assessed the vulnerabilities, and a green team that fixed them. It was designed around the assumption that AI-driven attackers would come from outside the company. Guardian Agents turn the lens inward, watching the agents an organization has bought or built.

The insider-threat argument

Microsoft CEO Satya Nadella has recently argued that the enemy may be the very agents enterprises have deployed, much like a rogue employee. In a post on his private blog earlier this month he warned that it is time to stop trusting AI model providers, even when they offer assurances about safety and security. “We simply can’t outsource responsibility for what intelligence does on our behalf,” he wrote, adding: “we need to separate the supply of intelligence from the authority over it.”

Gallot’s reasoning is that models are trained to achieve tasks, not to follow organizational norms or judgment, and that they are often given broad access to data and tools. TechCrunch’s assessment is that the position is both surprising and self-serving: Microsoft is a major investor in, and cloud partner of, OpenAI and Anthropic, yet it is encouraging enterprises to buy agent security from the cloud provider rather than from the labs. The logic, it adds, is sound: the software that monitors agents should be separate from their suppliers, just as auditors are independent of the organizations they audit.

Other features announced

Microsoft added an agent detection capability to Microsoft Defender that can find up to 60 types of agents employees bring into the workplace, including Claude Code, Codex and OpenClaw. It also added controls that limit agents’ access to data and systems and dynamically adjust permissions based on the task, including requiring human approval when an agent appears to be making risky decisions. These are the practical equivalents of least-privilege access and change approval for software that acts autonomously. For an introduction to the risks, see our explainers on what AI agents are and prompt injection.

An industry pattern

The framing is spreading. Microsoft was an inaugural member of Nvidia’s new Open Agent Safety Platform, which TechCrunch says gained the support of more than 100 other tech companies. The platform isolates agents in secure environments and can monitor and stop behavior through hardware, functioning something like a kill switch. It follows Microsoft’s announcement of new Surface Laptop Ultra PCs built for agents, which run on Nvidia chips and have agent security and controls baked in. Related reporting on small models that could self-replicate across devices shows why vendors are treating agent containment as a priority.

What it means for buyers

Security teams now have a vendor argument, and a product, for keeping monitoring independent of the model supplier. But the same company sells the cloud, the security layer and the Copilot agents, so buyers should ask how independent Guardian Agents really are from the platforms they watch, how they log decisions, and what happens when two vendors’ agents disagree. No performance data on detection rates was published in the coverage we reviewed.

What to watch next

  • Pricing, packaging and general availability for Guardian Agents.
  • Independent tests of Defender’s agent detection beyond the 60 listed types.
  • Whether Anthropic and OpenAI respond with their own oversight tooling or cooperate.
  • Adoption of Nvidia’s Open Agent Safety Platform.
  • Early incidents that show whether external monitors catch agent misbehavior.

Key takeaways

  • Guardian Agents monitor enterprise AI agents and sit inside Microsoft’s Project Perception.
  • Microsoft says frontier models cannot be trusted because they are unpredictable, not malicious.
  • Defender can now detect up to 60 types of workplace agents.
  • Permissions can adjust dynamically, with human approval for risky actions.
  • The pitch benefits Microsoft commercially, even if the oversight logic is widely shared.

Frequently asked questions

Does Microsoft say AI models are malicious?

No. Gallot said the issue is unpredictability and over-broad access, not malice.

What agents can Defender find?

Up to 60 types, including Claude Code, Codex and OpenClaw, according to the report.

Why monitor agents separately from their makers?

For the same reason auditors are independent of the companies they audit, in the words of TechCrunch’s analysis, and in Nadella’s phrase, to separate the supply of intelligence from authority over it.