Microsoft launches Guardian Agents to police the AI agents it frames as insider threats

What Microsoft announced

Microsoft introduced a set of security features on Monday designed to help enterprises defend themselves against the AI agents they run, according to TechCrunch. The headline addition is Guardian Agents, a capability that monitors the agents a company has deployed. It sits inside Project Perception, a product Microsoft first unveiled in June.

Project Perception was originally positioned as Microsoft's answer to offensive AI tooling, including Anthropic's Mythos and Fable hacking models and OpenAI's Daybreak vulnerability scanning system, TechCrunch reports. At launch it offered three classes of agents: a red team that attacked systems the way a hacker would, a blue team that detected those attacks and assessed the vulnerabilities they surfaced, and a green team tasked with fixing them.

From external attackers to insiders

That original design assumed the threat would come from outside the company. Microsoft's thinking has since shifted. CEO Satya Nadella has been warning that the more immediate danger may be the agents enterprises have already deployed and are paying for — behaving much like a rogue employee, what security teams call an insider threat.

Earlier this month, in a post on his private blog, Nadella urged enterprises to stop trusting AI model providers, even when those providers offer safety assurances for their agentic products. Companies are handing complex agentic systems access to their most sensitive data and the ability to take mission-critical actions on their behalf, he wrote, and a provider's assurances do not transfer that responsibility away. His proposed principle is that whoever supplies the intelligence should not also hold the authority over it.

The case against trusting agents

Hayete Gallot, who leads Microsoft's security business, was more direct in announcing Guardian Agents. In her words, frontier models cannot be trusted regardless of their origin — not because they are malicious or easily compromised, but because they are unpredictable. As TechCrunch summarizes her argument, such models are trained to accomplish tasks, not to respect organizational norms or exercise judgment, and they are frequently handed sweeping access to data and tools capable of causing serious harm.

TechCrunch points out the awkwardness of this stance. Microsoft has invested in both OpenAI and Anthropic, OpenAI is among its largest cloud customers, and Microsoft operates its own AI lab — so the company is sowing distrust of its own partners and, in part, its own products. There is also a clear commercial angle: Microsoft would prefer enterprises buy agent oversight from it rather than from the AI labs. Even so, TechCrunch judges the underlying logic sound. The software monitoring agent behavior should be independent of the vendors supplying those agents, much as auditors must be independent of the organizations they audit.

Defender gains agent detection

Beyond Guardian Agents, Microsoft added an agent detection feature to Microsoft Defender that can identify up to 60 types of agents employees bring into the workplace, including Claude Code, Codex and OpenClaw. New controls also restrict agents' access to data and systems, adjust their permissions dynamically based on the task at hand, and require human approval when an agent appears to be making a risky decision.

An industry-wide shift

The idea of agents as untrusted insiders is spreading beyond Microsoft. The company was an inaugural member of Nvidia's Open Agent Safety Platform, which has drawn support from more than 100 other technology companies, according to TechCrunch. The platform isolates agents in secure environments and can monitor and stop their behavior through hardware, functioning something like a kill switch. Microsoft has also announced Surface Laptop Ultra PCs built for agents, running on Nvidia chips with agent security and controls built in.

Why it matters

Most enterprise security programs still assume the adversary is external. If agents holding broad credentials become a standing insider risk, that model inverts: continuous monitoring, least-privilege access, task-scoped permissions and reliable kill switches become baseline requirements for any agent deployment, not optional extras.

Microsoft's argument that oversight must sit outside the AI labs also establishes a governance principle — and a new product category — that will shape how enterprises buy and operate agents. The tension is unavoidable, though: the vendor making this case profits from the concern it is raising, which makes independent scrutiny of these very controls the obvious next question.