Microsoft’s AI security argument has sharpened in stages. Earlier this month, chief executive Satya Nadella urged enterprises to assume the systems acting on their behalf require controls beyond the model provider’s promises. “We need to separate the supply of intelligence from the authority over it,” he wrote, arguing that companies remain accountable when agents are given sensitive data and mission-critical tasks.¹

Nadella then cast the issue in more pointed terms on X: models should be treated as “insider risks,” with security controls located outside the model itself.Satya Nadella (satyanadella)² The analogy matters. Microsoft is no longer focusing only on hostile AI tools attacking from outside a company; it is warning that an enterprise’s own approved agents can become unpredictable actors once they have access to data and systems.

On Monday, Microsoft turned that warning into product policy, expanding Project Perception with Guardian Agents. The company’s security chief, Hayete Gallot, said “frontier models, regardless of their origin, cannot be trusted” — not necessarily because they are malicious, but because systems trained to complete tasks do not reliably exercise organisational judgment.³

Project Perception began with AI red-team, blue-team and remediation agents aimed at finding and fixing weaknesses. Its new emphasis is on continuously assessing the risk posed by deployed agents themselves. Microsoft is also adding detection in Defender for dozens of workplace agents, including Claude Code, Codex and OpenClaw, alongside controls that restrict access, adjust permissions by task and require human approval for risky actions.¹

The stance carries an obvious commercial tension. Microsoft is closely tied to OpenAI and Anthropic, while also developing its own models, yet it is telling customers not to rely solely on any model supplier for safety. Its answer is an independent control layer — one that enterprises will, conveniently, be able to buy from Microsoft.¹