Microsoft Launches Guardian Agents to Treat AI as Insider Threats

On October 20, Microsoft announced a suite of new security features on Monday (local time) designed to help enterprises defend against the growing security threats posed by AI agents. This release comes as Microsoft continues to warn businesses about the various risks associated with artificial intelligence and autonomous agents.

"960x480"

IT Home noted that the most prominent addition in this update is Guardian Agents, a new feature designed to monitor the various AI agents currently deployed within enterprise environments. Guardian Agents are part of Project Perception, a product launched by Microsoft in June.

Project Perception serves as Microsoft’s countermeasure to powerful hacking models from Anthropic, such as Mythos and Fable, as well as OpenAI’s vulnerability scanning system, Daybreak. Initially, Project Perception introduced three types of agents:

• Red Team Agents: Simulate hackers to launch attacks.
• Blue Team Agents: Detect red team attacks and assess vulnerabilities.
• Green Team Agents: Specialize in remediating identified vulnerabilities.

The original design premise assumed that AI-driven hackers would originate from outside the enterprise. However, Microsoft CEO Satya Nadella recently warned that the source of AI-level threats could be the very agents that companies deploy and pay for—behaving like rogue employees, commonly referred to as "insider threats."

Earlier this month, Nadella issued a warning in his personal blog stating that it is time to stop trusting AI model providers, even when vendors make security assurances for their autonomous agent products. He advised enterprises to build independent systems, not controlled by AI labs, to supervise and manage the agents corresponding to products released by these AI laboratories.

He wrote: “We are deploying complex agentic systems and models that have access to our most sensitive data and can perform critical business operations on our behalf! We cannot outsource the responsibility for what these agents do on our behalf. Assurances from model providers do not absolve us of this responsibility… In other words, we need to separate the supply of intelligence from the control over it.”

In introducing Guardian Agents, Hayete Gallot, head of Microsoft Security, was more direct.

She stated: “Unfortunately, frontier models cannot be fully trusted, regardless of their origin.” She added that this is not because the models are inherently malicious or easily hacked, but because their behavior is unpredictable. The training objective of these models is to complete tasks, not to adhere to “organizational norms or judgment criteria.”

Furthermore, these agents often possess high privileges, with access to various data and tools, meaning they can cause severe damage if they go rogue.

Microsoft’s proposed solution is both surprising and driven by its own commercial interests. The surprise lies in the fact that Microsoft has close ties with—and investments in—both OpenAI and Anthropic. OpenAI is also a major customer of Microsoft’s cloud business, and Microsoft itself operates an AI lab developing large models. Essentially, Microsoft is encouraging customers to be wary of products from some of its own business partners.

From a commercial perspective, Microsoft wants enterprises to purchase agent security products from them as a cloud service provider, rather than sourcing them directly from Anthropic or OpenAI. Setting aside conflicts of interest, the logic holds up: software monitoring agent behavior should be independent of the agent provider, much like how audit firms must remain independent of the organizations they audit.

As Nadella put it: “We need to separate the supply of intelligence from the control over it.”

Microsoft is pursuing this business opportunity through multiple avenues. In addition to Guardian Agents, Microsoft has added agent detection capabilities within Microsoft Defender. This feature can identify up to 60 types of agents brought into work environments by employees, including Claude Code, Codex, and OpenClaw. The product also includes new functionality to restrict agent access to data and systems, dynamically adjusting permissions based on tasks. If an agent attempts a high-risk operation, the system requires human approval.

The concept of treating agents as untrusted insider threats is gradually becoming industry consensus.

Microsoft is a founding member of NVIDIA’s new Open Agent Safety Platform, which has already garnered support from over 100 tech companies. This platform isolates agents in secure environments, leveraging hardware to monitor and terminate anomalous behaviors, functioning similarly to an emergency kill switch. Prior to this, Microsoft had already released the Surface Laptop Ultra, a new laptop designed specifically for agents. Equipped with NVIDIA chips, the device features built-in agent security management modules.