On October 19, 2026, Microsoft introduced a new security feature that monitors AI agents operating inside enterprises: Guardian Agents. The feature extends the Project Perception security product line launched in June, where teams of "red" attacking agents, "blue" agents that detect them, and "green" agents that fix discovered flaws work together. That same day, CEO Satya Nadella and security business head Hayete Gallo urged enterprises not to trust AI model vendors, warning that frontier models cannot be trusted regardless of their origin. Microsoft Defender also gained an agent-detection capability — it finds up to 60 types of agents, restricts their access to data, dynamically adjusts their permissions, and requires human approval for risky decisions.
What Guardian Agents watches
Guardian Agents exists to track every action of the AI agents a company has deployed itself. What makes this approach distinctive is that Microsoft now sees the primary risk as coming from inside, not outside. Project Perception was originally built in June as a defense against external attacks: a "red team" attacked the system looking for vulnerabilities, a "blue team" detected and assessed them, and a "green" team fixed the flaws they found. The Guardian Agents announcement was a logical extension of that system: now enterprises' own agents also fall under surveillance, since they are assessed as an "insider threat" — participants that are trusted but can behave unpredictably.
Nadella: separate the supply of intelligence from the authority over it
Satya Nadella urged companies to stop trusting AI model vendors. In his view, a vendor's security guarantees do not cancel out a company's own responsibility. Nadella wrote that enterprises must "separate the supply of intelligence from the authority over it." This call is part of Microsoft's broader position that corporate internal control systems for agents should be organized independently of the companies supplying those agents.
"We need to separate the supply of intelligence from the authority over it." — Satya Nadella, Microsoft CEO
Nadella's position is that even when a model vendor provides security guarantees, a company cannot shift responsibility for what happens in its own systems. Enterprises are therefore advised to set up dedicated systems for monitoring agent activity.
Gallo: frontier models cannot be trusted
Microsoft security business head Hayete Gallo made an even stronger statement at the Guardian Agents launch. According to him, frontier models cannot be trusted regardless of their origin. The reason is not that they are malicious or easily compromised — they are unpredictably variable and trained to complete the task, not to follow organizational norms or human judgment. With that, Gallo describes agents as an uncontrolled force inside the company itself.
"Frontier models, regardless of their origin, cannot be trusted." — Hayete Gallo, head of Microsoft's security business
Defender now detects 60 types of agents
Microsoft Defender gained an agent-detection feature: it can find up to 60 types of agents that employees bring to their workplaces — including Claude Code, Codex, and OpenClaw. This makes it possible to detect the spread of agents that are not officially authorized within the enterprise. Also added are the abilities to restrict agents' access to data, dynamically adjust their permissions depending on the task, and require human confirmation for risky decisions. According to the official blog, these measures are aimed at preventing agents from being granted excessive privileges in corporate systems and strengthening enterprises' control over internal agents.
The new Defender capabilities address the problem of agents' invisibility in systems: if employees independently introduce various agents into their workflows, finding them, restricting their access level, and tying risky actions to human approval help a company maintain constant control over agents.
Microsoft is also on NVIDIA's platform
Suspicion toward agents is growing across the industry, and Microsoft is not alone. The company became one of the first members of NVIDIA's new Open Agent Safety Platform, backed by more than 100 technology companies. The platform isolates agents in a secure environment and monitors their behavior at the hardware level, with the ability to stop them when needed. This move is one manifestation of industry-wide attempts to technically rein in agents seen as an "insider threat."
Overall, these Microsoft moves show a shift in enterprises' attitude toward AI agents — from external threat to internal control: agents are now treated not only as attack weapons but as controlled, active participants in the company's own systems.
