Microsoft Introduces Guardian Agents to Monitor AI Agents Viewed as Insider Security Risks

Image: Securing the agentic insider · Source

Microsoft warns that frontier AI models driving automated agents are unpredictable insider threats. To secure enterprises, it launches Guardian Agents under Project Perception to continuously monitor and control AI agents’ actions independently from model providers.

Microsoft has introduced new security features aimed at protecting enterprises from the emerging risks posed by AI-powered agents, which are increasingly integrated into business processes but present insider threat challenges. The company’s new Guardian Agents capability, part of Project Perception, is designed to continuously observe and moderate AI agent activities within organizations, mitigating risks that arise from granting these agents broad access to sensitive data and critical systems.

Project Perception, originally unveiled in June, was developed to counter AI hacking threats from external actors by deploying simulated “red team” attacks, defensive “blue team” responses, and “green team” remediations. However, Microsoft’s leadership now highlights that the primary risk may come from AI agents deployed and operated internally — essentially untrustworthy insider agents capable of unpredictable behavior rather than deliberate malice.

CEO Satya Nadella has emphasized that enterprises must not rely solely on assurances from AI model providers such as OpenAI or Anthropic, even though Microsoft has partnerships and investments in these firms. Instead, he advocates separating the supply of intelligence (the AI models) from the authority controlling those models’ actions within corporate environments. "We simply can’t outsource responsibility for what intelligence does on our behalf," Nadella wrote, underscoring the need for independent oversight.

Hayete Gallot, Microsoft’s security business chief, stated, "Frontier models, regardless of their origin, cannot be trusted." The unpredictability stems from models being optimized to accomplish tasks rather than adhere to organizational norms or judgment. These agents can adapt, collude, and act in ways that might unintentionally cause harm when operating with elevated privileges.

Microsoft’s solution incorporates continuously updated identity, permissions, and runtime containment controls. These measures enforce least privilege by dynamically scaling agent permissions according to real-time risk assessments and require human approvals for high-risk actions. The system also includes an expanded threat detection scope, able to identify a broad range of AI agents such as Claude Code and OpenAI Codex, within Microsoft Defender.

Guardian Agents function within this architecture by autonomously monitoring every agent’s action, contextualizing risks, and coordinating protective responses through software “playbooks” that security teams define. This agentic security approach aims to operate at machine speed, providing traceability and enabling human security professionals to make informed decisions based on comprehensive evidence.

Microsoft’s initiatives align with a broader industry trend emphasizing agent safety, exemplified by its participation in Nvidia’s Open Agent Safety Platform. This ecosystem approach aims to isolate and control AI agents using hardware and software safeguards.

In summary, Microsoft is advancing a security paradigm that treats AI agents like insider threats, necessitating independent, continuous oversight distinct from AI model providers. This approach seeks to balance rapid innovation with enterprise safety, ensuring organizations can harness AI capabilities confidently without compromising security.