Microsoft on Monday launched Guardian Agents, a feature that monitors the AI agents a company runs, and warned that frontier models “cannot be trusted” — treating deployed agents like insider threats inside the business. Why it matters: the company selling enterprises much of their AI stack now says the safety layer has to come from someone other than the model maker.
October 19, 2026 — Microsoft introduced the new security features on October 19 as part of Project Perception, its agent-security product first introduced in June.
What did Microsoft launch?
Guardian Agents is designed to monitor the AI agents a company uses. It sits inside Project Perception, which originally fielded three classes of agents — a red team that attacked like hackers, a blue team that detected attacks and assessed vulnerabilities, and a green team that fixed them — on the assumption that AI-driven attacks would come from outside the company. Microsoft has also added agent detection to Microsoft Defender that can find up to 60 types of agents employees bring into the workplace, including Claude Code, Codex and OpenClaw, plus controls that limit agents’ access to data and systems, dynamically adjust their permissions by task, and require human approval when an agent appears to be making a risky decision.
Why does Microsoft call agents insider threats?
CEO Satya Nadella has argued that the risk may be the agents enterprises have deployed and are paying for — much like a rogue employee. In a blog post earlier this month he wrote that enterprises cannot outsource responsibility for what intelligence does on their behalf, and need to separate the supply of intelligence from the authority over it. Announcing Guardian Agents, Microsoft’s security business chief Hayete Gallot put it more bluntly: frontier models, regardless of origin, cannot be trusted — not because they are malicious or easily hacked, but because they are unpredictable, trained to achieve tasks rather than follow organizational norms or judgment, and often given access to sensitive data and powerful tools.
Is this just Microsoft selling security?
Partly, and TechCrunch noted the tension: Microsoft is invested in both OpenAI and Anthropic, and OpenAI is one of its biggest cloud customers, so warning customers not to trust those labs’ agents cuts against its own interests. The counter-argument is the auditor principle — the software that monitors agent behavior should be independent of the suppliers of the agents. Microsoft was also an inaugural member of NVIDIA’s Open Agent Safety Platform, which has support from more than 100 other tech companies and can isolate agents and stop behavior through hardware.
Why it matters
Every enterprise rolling out agents now faces the same question: who watches them? Microsoft’s answer — independent monitoring, least-privilege access that changes by task, and a human sign-off on risky actions — is quickly becoming the default checklist, whoever sells it. For readers testing AI tools for real work, the practical takeaway is simple: an agent’s capability is only half the product; its permissions and oversight are the other half.
Frequently asked questions
What are Microsoft Guardian Agents?
A Microsoft security feature, part of Project Perception, that monitors the AI agents a company uses and can intervene as risk rises.
What does Microsoft Defender’s agent detection do?
It can find up to 60 types of AI agents employees bring into the workplace, including Claude Code, Codex and OpenClaw, according to Microsoft via TechCrunch.
Why does Microsoft say frontier models cannot be trusted?
Its security chief argues the models are unpredictable — trained to complete tasks, not to follow an organization’s norms or judgment — while often holding access to sensitive data and tools.
Sources: TechCrunch, Microsoft