Microsoft treats AI agents as insider threats and calls for separating model supply from oversight

The employee who has access rights to sensitive databases and moves within the enterprise network may no longer be human today, but an artificial-intelligence agent whose operating costs have been officially funded. This explicit shift was driven by Microsoft with its announcement of a new security-features bundle to protect companies from the risks posed by smart agents, describing the software as closer to insider threats that resemble a rogue human employee within the system. The announcement, which coincided with a series of warnings to the business sector, launches the Guardian Agents feature as the latest addition to Project Perception, which the company unveiled last June to counter advanced intrusion tools.

Project Perception was originally designed to counter powerful hacking models such as Mythos and Viper from Anthropic and the Daybreak security system from OpenAI, and it adopted a three-tier structure that splits agents into a red team that conducts attacks, a blue team that monitors vulnerabilities, and a green team that handles remediation and repair. However, the underlying premise of that system assumed that attacks would always originate outside the organization’s perimeter. The current shift overturns that premise, as Satya Nadella, Microsoft’s chief executive officer, warned that the greatest danger may lie in the agents themselves that enterprises deploy and grant authority over their sensitive data on their behalf.

In his personal blog, Nadella explained that the time has come to stop placing trust in model providers, even when they offer prior security assurances, emphasizing that enterprises cannot delegate responsibility for decisions made by those systems on their behalf."We must separate AI supply from its oversight authority"; with that statement Nadella settled the principle of the new security architecture.Hayit Galot, Microsoft’s executive vice president for security, elaborated on this vision by stressing that cutting-edge models cannot be trusted regardless of their source, not because they are inherently malicious but because they are unpredictable; they have been trained to perform required tasks without a genuine understanding of regulatory standards and corporate governance, while possessing keys to critical systems.

We noted a striking business paradox in this presentation: Microsoft is a major investor in OpenAI and Anthropic and provides them with core cloud infrastructure, while also developing its own models in its labs. Yet it now casts doubt on the outputs of those models to position itself as the cloud provider and independent auditor that sells protection, just as financial auditing requires a party separate from the audited entity. To capitalize on this opportunity, the company enhanced Microsoft Defender with the ability to detect sixty types of agents that employees introduce into work environments, including tools such as Cloud Code, CodeX and OpenAI Clo, and it implemented mechanisms that dynamically limit agents’ privileges and require prior human approval for high-risk actions.

The wave did not stop at software; it extended to hardware and broad industry alliances. Microsoft joined as a founding member of Nvidia’s Open Agent Safety Platform, alongside more than one hundred technology companies; the platform isolates agents in secure environments and enables their monitoring and shutdown through hardware acting as a physical emergency cut-off. This coincided with the announcement of Surface Laptop Ultra devices specifically designed to run agents, which use Nvidia chips and embed safety and control controls into their hardware configuration.

This development redraws the spending and governance equation for those who lead digital infrastructure in the Gulf, Egypt and the Levant. If you oversee linking automation agents to customer databases and transaction logs, you can no longer rely on developers’ promises as sufficient audit protection; legal and operational responsibility remains solely in your own domain.Enterprise protection now requires allocating a separate budget for an intermediate oversight and audit layer that monitors model actions before they are executed.This shift also places on regional information-security teams the task of regulating work environments from uncontrolled programming tools and building instant kill-switches before granting any agent authorization to carry out irreversible financial or administrative actions.