Microsoft treats AI agents as internal threats: ‘State-of-the-art models cannot be trusted’

Microsoft is expanding Project Perception with ‘Guardian Agents’ and a Defender capable of identifying more than 60 types of agents, restricting their access rights and requiring human validation.

On 19 October, Microsoft unveiled a series of controls designed for organisations that allow AI agents to operate on their systems. At the heart of the system are ‘Guardian Agents’, tasked with monitoring internally deployed agents. These are integrated into Project Perception, the initiative launched in June which already divides its agents into red (attack), blue (vulnerability detection) and green (remediation) teams.

Identify, restrict, validate

Microsoft Defender can now identify more than 60 types of agents, including Claude Code, Codex and OpenClaw. Administrators can restrict their permissions, adjust them according to the task at hand and require human approval before any decision deemed risky is taken. On the hardware side, the new Surface Laptop Ultra, equipped with Nvidia chips, utilises Nvidia’s Open Agent Safety Platform – backed by over 100 companies – to monitor agents at the silicon level.

The message accompanying these announcements is unequivocal. Hayete Gallot, Head of Security at Microsoft, believes that state-of-the-art models, regardless of their origin, cannot be considered reliable: they are unpredictable and optimised to achieve a specific objective, not to comply with an organisation’s rules. Satya Nadella argues for separating the provision of intelligence from decision-making power, and urges companies not to be satisfied with assurances from model providers.