Microsoft Says 'Frontier Models Can't Be Trusted' and Launches Guardian Agents to Police AI

Microsoft just told its enterprise customers something startling: the AI agents they pay for may be the threat. On Monday, the company rolled out new security features headlined by Guardian Agents — systems built to monitor the AI agents an enterprise itself deploys.

From outside threat to insider threat

Microsoft's security thinking flipped. Its predecessor effort, Project Perception, launched in June and assumed problematic AI comes from outside — pitting red, blue and green teams against each other to attack and defend. The new Guardian Agents approach assumes the danger may already be inside the building.

CEO Satya Nadella wrote in his personal blog earlier this month that enterprises need to "separate the supply of intelligence from the authority over it," and that a model provider's assurances do not relieve companies of responsibility for what their agents do.

Microsoft's security business chief Hayete Gallot was blunter: "frontier models, regardless of their origin, cannot be trusted." The reasoning isn't that models are malicious — it's that they're unpredictable: trained to complete tasks, with no grasp of organizational norms. That makes a deployed AI agent less like a tool and more like a rogue employee — an insider threat.

The irony that makes the point

The twist: Microsoft is an investor in and cloud supplier to both OpenAI and Anthropic — and is now advising customers to keep a close watch on its allies' products. The new Defender feature polices more than 60 agent types, including rivals' Claude Code and Codex. Microsoft also joined Nvidia's Open Agent Safety Platform, a 100-plus-company effort.

This marks a structural shift. A year ago, enterprises adopting AI agents mostly relied on safeguards the labs built into their own products: permission prompts, sandboxing, safety evals that Anthropic and OpenAI ran and graded themselves. Microsoft's move says that model is over — policing AI agents becomes a business sold by whoever doesn't make the model, not a feature the vendor bundles in.

What this means for your business

If Microsoft — which has more to gain from AI-agent adoption than almost anyone — is telling you to treat agents as insider threats, take agent governance seriously now.

Three concrete steps. First, inventory every AI agent running inside your company today, including coding agents, inbox assistants and customer-facing bots — most companies have more than they think. Second, enforce least-capability access: an agent should only touch the systems and data its task requires, with egress controls that stop it from sending data out. Third, require audit logs and human approval gates for consequential actions (refunds, database writes, external sends) — Microsoft's own messaging says vendor assurances are not enough.

This also reframes buying decisions: evaluate agent platforms on their monitoring and control plane, not just their capabilities. Security for AI agents is becoming its own budget line, sold by infrastructure and security vendors — plan for it in 2026 the way you plan for endpoint security today.