Microsoft on Monday unveiled Guardian Agents, a new security feature that treats the AI agents running inside companies as potential insider threats. The announcement, made in a blog post by Microsoft Security chief Hayete Gallot, is one of the bluntest statements yet from a major AI vendor about the risks of the technology it sells.
“Unfortunately, frontier models, regardless of their origin, cannot be trusted,” Gallot wrote. The problem, she argued, is not that models are malicious or easily hacked. It is that they are unpredictable: trained to achieve tasks rather than to follow “organizational norms or judgment.”
What Was Announced?
Guardian Agents is part of Project Perception, the agentic security system Microsoft introduced in July. Perception originally fielded red, blue and green agent teams to defend against AI attacks coming from outside the enterprise. Guardian Agents extends the same cyber stack inward, to the agents companies themselves deployed and implicitly trusted.
According to Microsoft, the new agents “watch and moderate every action of every agent, before it happens, 24/7.” They pull signals from identity, data, cloud, endpoint, network and runtime sensors, compute a dynamic risk score for each attempted action, then respond by scaling permissions back, blocking the action, or requiring human approval for risky decisions. Microsoft calls this applying “deterministic controls on non-deterministic intelligence.”
Defender Now Detects 60 Agent Types
Alongside Guardian Agents, Microsoft expanded agent detection in Microsoft Defender from 25 to 60 agent types, including Claude Code, OpenAI’s Codex, GitHub Copilot and OpenClaw. The move targets “shadow AI”: agents employees bring into the workplace without IT approval, which Gallot’s post describes as frequently overprivileged, with access to data, tools and systems that could do serious harm.
Why It Matters
The framing is striking because Microsoft is deeply entangled with the labs it is now telling customers to distrust. The company has invested in both OpenAI and Anthropic, counts OpenAI as a major cloud customer, and runs its own AI lab. As TechCrunch noted, Microsoft is effectively sowing distrust against some of its own business interests, while positioning itself, the independent cloud provider, as the watcher enterprises should buy instead.
CEO Satya Nadella has been making the same argument in blunter terms. Earlier this month he wrote that enterprises must stop outsourcing responsibility for what intelligence does on their behalf: “We need to separate the supply of intelligence from the authority over it.”
The industry appears to be converging on the idea. Microsoft was an inaugural member of Nvidia’s Open Agent Safety Platform, backed by more than 100 companies, which isolates agents in secure environments with hardware-level monitoring. Microsoft also recently announced Surface Laptop Ultra PCs with agent security controls baked in.
What remains unclear is packaging and pricing. Press reports suggest the controls may ship as part of a Microsoft 365 tier in private preview, with broader details expected at Ignite in November. Microsoft itself has not confirmed those details in the announcement.
