Microsoft is adding security tools for companies that use AI agents, including a system called Guardian Agents to monitor their behavior. The move reflects a shift in how the company describes the risk: an agent may be a threat inside an organization, even when it was introduced as a work tool.
From outside attacks to risks inside the company
Microsoft introduced Project Perception in June to address threats from AI-powered hacking. Its original approach divided the work among three kinds of agents: a red team that attacked, a blue team that detected attacks and assessed vulnerabilities, and a green team that worked to fix them.
That design assumed the danger would come from outside an enterprise. Microsoft now says companies also need to consider the agents they deploy themselves. An agent given access to sensitive information or business tools could make harmful decisions, in a way the company compares to an insider threat.
Guardian Agents, part of Project Perception, are meant to watch the AI agents a company uses. The goal is to place a monitoring layer around systems that can act on behalf of employees and organizations.
Why Microsoft says models need oversight
Microsoft CEO Satya Nadella has called for enterprises to stop relying solely on assurances from AI model providers. In a private blog earlier this month, he argued that companies should use separate systems to watch and control agents, especially when those agents can access sensitive data and take mission-critical actions.
Microsoft security business chief Hayete Gallot made the concern explicit when announcing Guardian Agents: “Unfortunately, frontier models, regardless of their origin, cannot be trusted,” she wrote. Her stated reason was unpredictability, rather than a claim that the models are malicious or easy to hack.
Gallot said models are trained to complete tasks, not to follow an organization’s norms or exercise its judgment. The risk grows when those models are also given broad access to information and tools. In that setting, a system intended to help can still act in ways its employer did not expect.
Keeping control separate from supply
Microsoft’s argument is that the company providing an AI agent should not be the only one responsible for overseeing it. Nadella described the principle as separating “the supply of intelligence from the authority over it.” In practical terms, companies would use independent controls to decide what agents can do and monitor whether they stay within bounds.
The proposal carries a business interest for Microsoft. The company wants enterprises to buy security products from it, while it also has close ties to OpenAI and Anthropic, has invested in both, and runs its own AI lab. OpenAI is also one of Microsoft’s largest cloud customers.
Those interests do not remove the underlying question of independence. If the same organization supplies an agent and controls the system that evaluates it, the oversight may not be independent. Microsoft likens separate monitoring to auditors operating independently of the organizations they audit.
Controls for detecting and limiting agents
Guardian Agents are one part of Microsoft’s broader push into agent security. The company has added agent detection to Microsoft Defender, which can identify up to 60 types of agents employees bring into the workplace. Examples named by Microsoft include Claude Code, Codex, and OpenClaw.
Other new features are designed to restrict agents’ access to data and systems and adjust permissions based on the task. If an agent appears to be making a risky decision, the system can require human approval. Together, these measures are intended to give organizations a way to see what agents are present, limit their reach, and intervene when needed.
The idea of treating agents as potentially untrustworthy insiders is also appearing elsewhere in the industry. Microsoft is an inaugural member of Nvidia’s Open Agent Safety Platform, which has support from more than 100 other tech companies. The platform is designed to isolate agents in secure environments and use hardware to monitor and stop their behavior, in a way the source describes as something like a kill switch.
Microsoft’s new controls point to a broader tension in enterprise AI: agents can be useful precisely because they can reach data and take actions, but those same abilities make oversight necessary. The company’s approach puts monitoring and permission decisions in a separate layer around the agent, with human review available when its actions appear risky.