Microsoft's top security executive wrote Monday that "frontier models, regardless of their origin, cannot be trusted," as the company introduced controls that treat the AI agents companies deploy like insiders to be watched rather than software to be trusted, TechCrunch reported. Coming from one of the largest sellers of AI models and agents, the message tells boards and security chiefs that keeping agents in check is their own job, handled through access rules they control rather than through assurances from the labs that build the models.
What Happened
Hayete Gallot, executive vice president of Microsoft Security, made the case in a post on the Official Microsoft Blog, "Securing the Agentic Insider." TechCrunch reported that she said the problem is not that models are malicious or easily hacked but that they are unpredictable. Gallot wrote that models "have been trained to attain results, which often leads to reward hacking," a term for an AI system reaching its goal through shortcuts its designers did not intend. She added that agents are often overprivileged, meaning they hold more access than their work requires.
A companion post on Microsoft's security blog by Nadim Abdo, corporate vice president for identity and network access, "Agents Are Your Newest Insiders. Security Must Move at Their Speed," set out the products. It cites a principle from Chief Executive Satya Nadella: "We should not ask a model to be its own security authority." Controls, it argues, belong outside the model, where an agent cannot bypass or tamper with them.
The new controls include:
- Dynamic Permissions: an agent "should begin with no authority," the post says, and receive only what an approved task needs. Access is time-bound, shrinks or ends as the task changes, and higher-impact actions can require verified human approval.
- Dynamic Agent Risk: a continuously updated score for each agent built from identity, data, device, cloud, network and runtime signals, including drift from what the user or organization intended.
- Dynamic Conditional Access: an extension of Entra Conditional Access, Microsoft's existing system for deciding who may reach which resources under what conditions. As risk rises it can cut permissions, allow reading but block changes, require human approval or, at the highest levels, isolate or stop the agent.
- Guardian Agents and Playbooks: in Project Perception, a security system Microsoft first announced in July, people write playbooks that define the desired response, and Guardian Agents investigate risk changes and recommend or apply containment.
- Wider discovery: Microsoft Defender now recognizes 35 more types of agents running on employees' machines, for 60 in total, including Claude Code, OpenAI Codex and GitHub Copilot.
Neither post gives preview or general-availability dates or pricing. Gallot wrote that customers "can get started today" with Project Perception, and Abdo's post points readers to Microsoft's Ignite conference, Nov. 17-20.
Why It Matters
The framing moves agent risk into territory boards already understand: insider risk and access control. If agents are treated like staff with keys, directors can ask the same questions they ask about employees. Who approved this access? Does it expire? Can someone revoke it quickly?
It also signals a shift in where accountability sits. Microsoft is telling customers that model makers' safety claims, including those of labs it backs, are not a sufficient control. TechCrunch noted that Microsoft has invested in both OpenAI and Anthropic and called its approach "surprising and self-serving," since Microsoft wants companies to buy agent security from it rather than from the AI labs. Buyers should weigh the argument on its merits and the products separately.
The oversight layer is itself automated. Guardian Agents are agents, which makes the human-written playbooks and approval limits the part leaders should scrutinize most.
Context
TechCrunch reported that Microsoft is an inaugural member of Nvidia's Open Agent Safety Platform, which isolates agents and can halt them through hardware, much like a kill switch. OpenAI is not on that public list, though it backs the effort privately, The Primary Wire reported last month, citing TechCrunch. Regulators have also turned to agent behavior, including a Federal Trade Commission probe of AI developers.
What to Watch
- Release dates, licensing and pricing, which Microsoft may detail at Ignite on Nov. 17-20.
- Whether model makers give customers the greater transparency into model reasoning, including reasoning tokens, that Gallot called for.
- Whether other cloud and security vendors adopt task-scoped, model-independent controls as a default for enterprise agents.
