Microsoft’s argument has shifted in a matter of months. Project Perception was introduced in June to simulate and counter outside AI-powered attackers: red-team agents attacked, blue-team agents detected vulnerabilities and green-team agents fixed them.¹

Now the company says the greater danger may already be inside the perimeter. Satya Nadella has likened deployed agents to insider threats — systems with access to sensitive data and permission to take consequential actions. In a recent post, he argued that a vendor’s security promises cannot transfer accountability: “We simply can’t outsource responsibility for what intelligence does on our behalf.”¹

On Monday, Microsoft translated that principle into product strategy, expanding Project Perception with Guardian Agents designed to monitor other agents continuously. Nadella described the move as putting controls “outside the model itself,” rather than trusting the system being supervised to police its own conduct.Satya Nadella (satyanadella)²

Hayete Gallot, Microsoft Security’s executive vice president, made the company’s stance still plainer: “Unfortunately, frontier models, regardless of their origin, cannot be trusted.”³ The point, Microsoft says, is not necessarily that models are malicious or compromised; they are unpredictable systems trained to complete tasks, not to exercise an organisation’s judgment.

The proposed answer is separation: AI labs can supply intelligence, but enterprises should control access, permissions and high-risk actions. Microsoft Defender can now detect dozens of workplace agents, while new controls can restrict access, alter permissions by task and require human approval for risky decisions.¹

There is an obvious commercial tension. Microsoft is closely tied to OpenAI and Anthropic while also developing its own models — yet it is urging customers not to take any model provider at its word. Its remedy is an independent watchdog, sold by Microsoft. The logic resembles external auditing; the business opportunity is unmistakably closer to home.

[1] Microsoft says AI agents are like insider threats as 'frontier models can't be trusted' — Microsoft says Guardian Agents and related controls are meant to oversee deployed AI agents as potential insider risks.

[2] @satyanadella on X — Nadella says security controls should sit outside AI models as Project Perception expands.

[3] Microsoft: Frontier Models Cannot Be Trusted — Hayete Gallot says frontier models cannot be trusted regardless of their origin.