Microsoft on Monday announced new security features aimed at protecting enterprises from risks posed by AI agents. The launch accompanies the company’s ongoing warnings about the dangers of agentic systems and large models.
Guardian Agents and Project Perception
The most notable addition is a feature called Guardian Agents, designed to monitor the AI agents a company deploys. Guardian Agents is part of Project Perception, a product that Microsoft introduced in June.
Project Perception initially launched three classes of agents: a red team that simulated attackers, a blue team that detected the red team and assessed discovered vulnerabilities, and a green team responsible for remediation. The product was originally built on the assumption that AI attackers would come from outside an organization.
Emphasis on insider risk
Microsoft CEO Satya Nadella has recently warned that the real AI threat may be the agents organizations run and pay for themselves — analogous to a rogue or negligent employee, an "insider threat." In a post on his private blog earlier this month, Nadella argued that enterprises should not blindly trust model providers’ safety assurances and should instead deploy separate systems, independent of the AI labs, to watch and control the agents those labs’ products launch.
Nadella summarized the approach as needing to "separate the supply of intelligence from the authority over it."
Microsoft’s position and product changes
Hayete Gallot, chief of Microsoft’s security business, stated plainly that frontier models cannot be trusted regardless of origin — not necessarily because they are malicious or easily hacked, but because they are unpredictable, trained to achieve tasks rather than follow organizational norms or judgment. She also noted that these models are often granted wide access to sensitive data and tools.
Microsoft has implemented several concrete measures:
- The Guardian Agents monitoring capability within Project Perception.
- An agent-detection feature in Microsoft Defender that the company says can identify up to 60 types of agents employees bring into the workplace, with examples including Claude Code, Codex, and OpenClaw.
- Controls that limit agents’ access to data and systems and dynamically adjust agent permissions based on tasks, including requiring human approval when an agent appears to be making risky decisions.
Market and strategic context
Microsoft’s approach is both surprising and aligned with its business interests. The company has invested in OpenAI and Anthropic, and OpenAI is also a major cloud customer of Microsoft; at the same time Microsoft operates its own AI lab. By urging enterprises to deploy independent monitoring tools and offering those tools itself, Microsoft is positioning its cloud and security products as the preferred option for agent oversight.
The idea of treating agents as untrustworthy insiders is gaining industry traction. Microsoft was an inaugural member of Nvidia’s Open Agent Safety Platform, which has won the support of more than 100 other tech companies. That platform isolates agents in secure environments and can monitor and halt behavior at the hardware level, functioning similarly to a kill switch.
Microsoft also announced new Surface Laptop Ultra PCs designed for running agents; these devices use Nvidia chips and include built-in agent security and controls.
Why this matters
The announcements reflect a shift in how organizations must think about AI risk: not only as external cyberattacks, but also as potential harm originating from the automated agents they deploy. Microsoft’s technical and strategic moves aim to separate the providers of intelligence from the authority that governs it, and to sell tools that implement that separation.
Summary
Microsoft’s Guardian Agents and Defender agent-detection are intended to monitor and restrict agent behavior inside enterprises, addressing the risk of agents acting like insider threats. The company is also participating in industry efforts such as Nvidia’s Open Agent Safety Platform and offering hardware and cloud products that incorporate agent security.
