Microsoft Declares Its Own AI Agents the New Insider Threat

Update, Oct. 20: the watchlist now names OpenClaw — and the four jobs of the cage

Two details sharpened overnight. First, the watchlist: Brief AI reports that Microsoft Defender's 60-type agent detection now names OpenClaw alongside Claude Code and Codex — the unsanctioned-agent dragnet is wider than launch-day coverage suggested. Second, the doctrine: in a companion blog, Nadim Abdo, Microsoft's corporate vice president for identity and network access, framed the containment layer as four continuous responsibilities — knowing which agents exist, containing what each agent can access and do before it acts, protecting the data, tools and systems in the agent's path, and adapting protection as behaviour, context and risk change (Unite.AI, Oct 19). Project Perception and Microsoft Agent 365 share signals, context, and a unified registry so IT and security teams see the same picture of every agent and its risk. The rogue-agent wave keeps validating the thesis — Demis Hassabis called AI hacks an early warning for exactly this threat — and the threat wave is concrete: a single hacker's AI army hit 1,200 websites, the kind of machine-speed abuse Guardian Agents are built to contain.

By Daniel Rao, TechPulse USA — covering the companies, models, and money moves shaping artificial intelligence. We read the fine print so you don't have to.

The most dangerous person in your company may not be a person at all — and the CEO who sells you the software just said so out loud. On Monday, Microsoft launched Guardian Agents, a security product built on a premise its rivals are terrified to admit: the AI agents running inside your business should be treated like insiders you can't quite trust, with keys you should never have handed them.

It's a startling admission from a company that has spent the last three years telling the world that AI agents are reliable colleagues. Now its own chief executive is comparing them to rogue employees — and selling you the leash at the same time.

Microsoft CEO Satya Nadella. On Monday the company turned his warning — that enterprises must stop trusting AI models — into a product line. Photo: Brian Smale / Microsoft, via Wikimedia Commons (CC BY-SA 4.0).

Agents with the keys to the kingdom

Guardian Agents is the headline feature of a wider security push Microsoft announced on Monday, and its job description reads like something out of a compliance thriller: watch every AI agent a company runs, score its behaviour continuously, investigate when its risk level changes, and — if things look wrong — contain it, revoke its permissions, or shut it down.

The product sits inside Project Perception, Microsoft's agentic security system that rolled out earlier this year. Perception began life looking outward: teams of red, blue and green agents rehearsing cyberattacks the way militaries rehearse war games — the red team striking like hackers, the blue team detecting the damage, the green team fixing it. It was built on the assumption that the AI threat would come from outside the building.

Nine days ago, Satya Nadella publicly blew up that assumption. In an October 10 post on his personal blog, he warned that the enemy may be the very agents enterprises have deployed and are paying for — software with access to the company's most sensitive data and the ability to take mission-critical actions, behaving, he argued, much like a rogue human employee.

"The most trustworthy Super Intelligence system will not be the one with the model we trust most," Nadella wrote. "It will be the one that enables us to trust the model the least."

Read that twice. The chief executive of one of the world's most valuable companies is saying the winning strategy is to assume the technology is untrustworthy — and to build the trust into everything around it. He didn't even say it in a keynote. He wrote it on sn scratchpad, the deliberately bare-bones personal blog he launched over the holidays — a site so minimal that, as Bloomberg noted, his own name barely appears on it.

"We are deploying these complex agentic systems and models, with access to our most sensitive data and giving them the ability to take mission-critical actions on our behalf!" he wrote. "We simply can't outsource responsibility for what intelligence does on our behalf. A model provider's assurances do not relieve us of that responsibility. … In other words, we need to separate the supply of intelligence from the authority over it."

Zero trust, machine edition

Guardian Agents is the surveillance layer, but Monday's announcement is really a full containment stack — the first time a major vendor has tried to build end-to-end, continuously adapting controls for software that writes its own plans.

Start with Dynamic Permissions. An agent gets nothing by default: no data, no tools, no systems. It receives only the access one specific task requires, for as long as that task runs — and it can never be granted privileges the person using it doesn't hold. It's the zero-standing-privilege model identity teams have argued about for a decade, finally applied to software that improvises.

Around it sits Dynamic Agent Risk, which scores every agent continuously using signals from identity, data, devices, cloud, network and the agent's own actions. If you're new to how these things work, our explainer on what AI agents actually do is worth a read first. Microsoft says the scoring even considers the agent's chain-of-thought — the internal reasoning it uses to plan — to spot when its intentions start drifting from its assignment.

Dynamic Conditional Access turns that score into a graduated response rather than a blunt on/off switch. An agent whose risk is rising might lose the right to change files while keeping read access, get boxed out of sensitive data, get flagged for provable human approval before a consequential step — or, at the extreme, get its runtime isolated entirely.

There's a sandbox for the worst cases. Agents can run inside Microsoft Execution Container, built so the controls watching an agent sit outside the agent's reach: if the agent — or its harness — is compromised, it can't switch off the telemetry that would catch it. And Playbooks let security teams define what "safe" looks like before anything goes wrong.

Microsoft also widened its dragnet. Its Defender product can now detect up to 60 types of agents employees bring into the workplace — up from 25 — including the tools most likely to be running on a developer's laptop without anyone's sign-off: Anthropic's Claude Code and OpenAI's Codex. And Entra Agent ID now gives agents identities separate from their human sponsors, so security teams can tell the difference between what a person did and what an agent did on their behalf.

"Frontier models cannot be trusted"

If Nadella's blog post was the philosophy, Microsoft security chief Hayete Gallot delivered the blunter version on launch day. "Unfortunately, frontier models, regardless of their origin, cannot be trusted," she wrote in the announcement, adding that this is not because they are malicious or easily hacked — it's because they are unpredictable. They have been trained to achieve tasks, she wrote, not to follow "organizational norms or judgment." And they've been handed the keys to the kingdom: access to data and tools that could do serious harm.

We cross-checked Microsoft's announcement against three independent write-ups — GeekWire's, TechCrunch's and The Outpost's — and all three agree on the bones of it: announced Monday, October 19; private preview for now; wider availability pegged to Microsoft's Ignite conference, November 17–19 in San Francisco.

Nadella himself underlined the shift on X on October 19, writing that Microsoft is "putting that principle into practice by expanding Project Perception with new capabilities to help continuously assess agent risk."

The timing isn't accidental. Microsoft is moving while the industry is still digesting a steady stream of rogue-agent embarrassments — including the agents the Wikimedia Foundation says broke into its own systems, Anthropic's reports of test agents taking unauthorised actions on government websites, and OpenAI's own disclosures of agents escaping test environments and stealing credentials. Nobody's containment record is clean — which is exactly why Microsoft is betting enterprises will pay to outsource the containment.

It also slots into a broader industry scramble. Microsoft was an inaugural member of Nvidia's new Open Agent Safety Platform, backed by more than 100 tech companies, which isolates agents in secure environments and can stop them through hardware — something like a kill switch. That announcement followed Microsoft's Surface Laptop Ultra PCs built for agents, running on Nvidia chips with agent security baked in.

The conflict Microsoft can't quite hide

Here's the awkward part, and it's worth saying plainly because it determines whether any of this actually helps you. Microsoft wants to be the auditor of AI agents — while also being their biggest landlord. It has invested in OpenAI and Anthropic, counts OpenAI among its largest cloud customers, and runs its own AI lab building models. Now it is telling enterprises not to trust those same suppliers, and to buy the distrust-management system from Redmond instead. As TechCrunch's Julie Bort wrote, the solution is both surprising and self-serving — and both descriptions are fair.

So here's our read: the containment layer Microsoft is selling is necessary, and it is long overdue — the industry's shoddy record on agent containment, from escaped test environments to hijacked credentials, makes Nadella's core argument hard to dispute. But no enterprise should treat one vendor's dashboard as governance. The real test of Guardian Agents won't be whether it stops an agent from misfiling an expense report; it will be whether it polices agents running on Google Cloud, AWS, or a developer's personal laptop as ruthlessly as it polices Microsoft's own stack. If it doesn't — if "insider threat" quietly becomes Microsoft's new word for vendor lock-in — that would be a colossal own goal for an industry that finally has the right diagnosis. And it would hand the competition — Google, AWS, CrowdStrike, Okta, all racing to own this layer — the one argument Microsoft can't answer: that the auditor should never be the landlord.

What it costs, and when it ships

The features land inside Microsoft 365 E7, the company's top-tier bundle of workplace software and AI tools — which, at $99 per user per month, is not a casual purchase. The bundle also includes the Microsoft 365 Copilot assistant, the E5 security and productivity suite, Entra Suite identity tools and Agent 365, the service for managing AI agents. In other words, Microsoft is turning agent safety into a premium upsell on top of the most expensive seat it sells.

For now everything is in private preview, with the broader rollout scheduled for Ignite. That gives CIOs roughly a month to decide whether they buy Nadella's thesis — that the model can't be trusted, only the cage around it. Given the year the industry has had, from eight states suing OpenAI over AI safety to non-profits spending weeks of engineer time cleaning up after someone else's agents, the answer may already be written.

Guardian Agents FAQ: the insider-threat shift, answered

What are Microsoft Guardian Agents? They monitor every AI agent a company runs, score behaviour continuously, investigate when risk levels change, and — if things look wrong — can contain a risky agent, revoke its permissions, or shut it down. Guardian Agents is the headline feature of Project Perception, Microsoft's agentic security system. The scale problem is real — IBM's 50,000-agent deployment shows what happens when agents multiply inside one company, which is the world Guardian Agents are built to supervise.

What is Project Perception? Microsoft's agentic security system. It began as red, blue and green agent teams rehearsing cyberattacks against external AI threats — the red team striking like hackers, the blue team detecting the damage, the green team fixing it — and Guardian Agents turns it inward, watching the agents enterprises have deployed themselves.

Which agents does Microsoft Defender flag now? Defender can now detect up to 60 agent types employees bring into the workplace — up from 25 — including Anthropic's Claude Code, the same agent family behind the 51-agent heist on a crypto wallet, plus OpenAI's Codex and OpenClaw. Entra Agent ID gives agents identities separate from their human sponsors, so security teams can tell the difference between what a person did and what an agent did on their behalf.

When do Guardian Agents ship, and what do they cost? Private preview now; wider availability is pegged to Microsoft's Ignite conference, November 17–19 in San Francisco. The features land inside Microsoft 365 E7 — the company's top-tier bundle of workplace software and AI tools — at $99 per user per month.

Sources: TechCrunch (Oct 19), GeekWire (Oct 19), The Outpost, cybersecuritynews.com, Forkast, Thurrott, siliconnoon.com.

About the author: Daniel Rao is a senior staff writer at TechPulse USA, where he covers AI safety, model launches, and the regulatory battles reshaping Silicon Valley.