By Hamza Faisal

Microsoft has a new message for the world's biggest companies: stop trusting the AI agents you've already deployed. On October 19, the company unveiled "Guardian Agents," a set of security features that treats enterprise AI agents as potential insider threats — watching what they do at machine speed and cutting their access when their behavior looks risky.

The launch marks a sharp philosophical turn. Microsoft itself is one of the biggest sellers of AI agents, yet its leadership now says frontier models, "regardless of their origin, cannot be trusted," in the words of Microsoft security business chief Hayete Gallot. The new capabilities expand Project Perception, the AI security platform Microsoft introduced in June with red, blue, and green agent teams designed to defend against AI-powered attacks from outside the company. The October update turns that machinery inward.

The enemy may already be inside the company

The shift follows warnings from CEO Satya Nadella that the AI threat may not come from an outside hacker at all, but from the very agents enterprises have deployed and are paying for — much like a rogue human employee. Earlier this month, Nadella wrote that companies should stop relying on assurances from AI model providers and build separate systems, independent of the AI labs, to watch and control the agents those products launch.

"We simply can't outsource responsibility for what intelligence does on our behalf," Nadella wrote. "In other words, we need to separate the supply of intelligence from the authority over it."

Microsoft's argument is that agents are not like chatbots that merely answer questions. They access applications, tools, and company data, make decisions, and take actions — often continuously and at machine speed. Nadim Abdo, corporate vice president for identity and network access, noted that the same access that makes agents useful also creates insider risk: agents can be manipulated, make mistakes, or be compromised, and Gallot warned that many are overprivileged, holding access to systems and data far beyond what their tasks require.

How the containment layer works

Guardian Agents provide continuous supervision of every agent action, investigating risk changes and recommending — or directly applying — containment. The system adds three controls on top: Dynamic Agent Risk, a continuously updated risk score built from identity, data, endpoint, cloud, network, and runtime signals, including analysis of the agent's chain-of-thought for signs of intent drift; Dynamic Conditional Access, which extends Microsoft Entra so a risk change triggers graduated responses, such as preserving read access while blocking writes or demanding provable human approval for a consequential step; and Dynamic Permissions, which ensures agents start with zero authority and receive only task-scoped, time-bound access.

Alongside the launch, Microsoft updated Defender to detect up to 60 types of AI agents that employees bring into the workplace, including Claude Code, Codex, and OpenClaw. The company also said it joined more than 100 tech firms backing Nvidia's Open Agent Safety Platform, an effort to isolate and stop rogue agents at the hardware level, and pointed to new Nvidia-powered Surface Laptop Ultra PCs with built-in agent security controls.

Watching the watchers

Microsoft is also pushing for more visibility into how agents reason, arguing that security teams need to see an agent's thinking, not just its outputs, to catch manipulation early. Whether enterprises will accept AI guards policing AI workers — a "watching the watchers" architecture — is an open question, but Microsoft is betting the alternative is worse: an army of overprivileged agents operating inside corporate networks with nobody checking their work.

By Hamza Faisal