Microsoft is now selling a simple, uncomfortable idea: an AI agent should be treated less like a trusted assistant and more like an insider who happens to be very fast. The company’s new Guardian Agents feature, part of Project Perception, is designed to monitor the agents a business uses. Microsoft’s security chief, Hayete Gallot, put the reason bluntly: frontier models, wherever they come from, cannot be trusted because they are unpredictable. Source: https://techcrunch.com/2026/10/19/microsoft-says-ai-agents-are-like-insider-threats-as-frontier-models-cant-be-trusted/
Key facts
| Fact | Detail |
|---|---|
| Question answered | Microsoft Wants Agents Treated Like Insider Threats |
| Short answer | Microsoft’s new Guardian Agents and Defender controls treat AI agents as potential insider threats, not trusted assistants. |
| Reading time | ~4 min |
| Last updated | 2026-10-20 |
That is not a claim that models are malicious. It is a claim about incentives and judgment. A model is trained to complete a task. It is not trained to respect your company’s approval chain, data boundaries or common sense about what a task should cost.
What Microsoft announced
According to TechCrunch, Guardian Agents is the most notable addition. Project Perception originally launched three agent classes: a red team that attacks, a blue team that detects and assesses, and a green team that fixes. The original design assumed the attacker would come from outside. The new framing adds the possibility that the risky agent is already inside, running with credentials the company gave it.
Microsoft also added agent detection to Defender. The company says it can find up to 60 types of agents employees bring into the workplace, including Claude Code, Codex and OpenClaw. It has added controls that limit an agent’s access to data and systems, and features that adjust permissions based on the task. If an agent appears to be making risky decisions, Microsoft says the system can require human approval.
The commercial logic is obvious. Microsoft invests in OpenAI and Anthropic, and also competes with them. Selling an independent monitoring layer lets it profit from distrust of the very models its cloud customers use. That does not make the advice wrong. An auditor should not be employed by the company being audited, and the software that watches an agent should not be supplied only by the company that made the agent.
What this means on a desktop
Most individuals and small teams will not buy an enterprise agent-security suite. They can still copy the architecture.
- Separate the credential from the task. Give the agent a key or account that can do the current job, not every job you have ever configured.
- Put a human gate in front of irreversible actions. Deleting files, sending money, changing permissions and publishing content should require a fresh approval, not a blanket “always allow.”
- Log the action, not just the answer. A transcript of what the model said is less useful than a record of which file, command, API call or payment it attempted.
- Watch outbound traffic and spend. An agent that suddenly calls a new endpoint or burns through a budget is telling you something before the damage is complete.
- Keep a kill switch outside the agent. The stop control should not depend on the same process, account or vendor that the agent uses.
This is especially relevant on Windows, where an agent may have access to the file system, browser sessions, shell and installed applications. Convenience comes from combining those permissions. Risk comes from the same place. A useful default is to let the agent read broadly but write narrowly, and to require approval when the write target is outside the current project folder.
The part Microsoft cannot solve for you
Microsoft can sell monitoring, detection and permission controls. It cannot decide what data you are willing to expose, which actions are reversible, or how much autonomy you want to trade for time. Those are policy decisions.
A practical policy can be short. Keep secrets out of prompts and logs. Use a separate account for agent work. Prefer app-level permissions over full-disk access. Require approval for money, deletion, installation and publishing. Review the audit trail after any unusual run. If the agent cannot explain an action in plain language, stop it and inspect the machine state before continuing.
For a local-first workflow, the control plane should be visible to the person using it: which tools the agent can call, which folders it can touch, and which credential it is spending. You can compare a Windows desktop agent setup at https://agent.aimoogh.com/download.
The bottom line
Microsoft’s marketing has a self-serving edge, but the underlying security model is sound. Agents are useful precisely because they can act. That is also why they need the controls we apply to employees with privileged access: least privilege, separation of duties, approval gates, audit logs and a way to revoke access quickly.
FAQ
What is Microsoft Guardian Agents? It is a Microsoft security feature, part of Project Perception, intended to monitor the AI agents a company uses. Microsoft is positioning it as an independent control layer between the model provider and the enterprise’s data and tools.
Does Microsoft say models are malicious? No. Microsoft’s security chief says frontier models cannot be trusted because they are unpredictable: they are trained to complete tasks, not to follow an organization’s norms and judgment.
What can Defender detect? Microsoft says Defender can detect up to 60 types of agents employees bring into the workplace, including Claude Code, Codex and OpenClaw, and can limit access or require human approval for risky actions.
What should a small team do first? Start with least privilege, separate credentials, approval gates for destructive or expensive actions, and a visible audit trail. A small team does not need an enterprise suite to apply the same principles.
Related reading: