Project Perception was originally designed on the assumption that AI-powered hackers would attack from outside, with red, blue and green agent teams attacking, detecting and fixing vulnerabilities. But Microsoft CEO Satya Nadella has been arguing that the real danger may be the agents companies themselves have deployed, much like a rogue employee, what security teams call an insider threat. In a recent blog post he wrote that enterprises "need to separate the supply of intelligence from the authority over it", and that a model provider's safety assurances do not lift that responsibility from the companies using the models.

Microsoft's security business chief Hayete Gallot put it more bluntly when announcing Guardian Agents, writing that "frontier models, regardless of their origin, cannot be trusted", not because they are malicious but because they are unpredictable, trained to complete tasks rather than follow organisational norms, and often handed broad access to sensitive data and tools.

Alongside Guardian Agents, Microsoft has added agent detection to Defender that can identify up to 60 types of agents employees bring to work, including Claude Code, Codex and OpenClaw, plus features that restrict agents' data access, adjust their permissions per task and require human approval for risky decisions. The stance is notably awkward for Microsoft, an investor in both OpenAI and Anthropic, though the underlying logic, that agent monitors should be independent of agent suppliers much like auditors, is a reasonable one. The idea is spreading: Microsoft was an inaugural member of Nvidia's Open Agent Safety Platform, backed by more than 100 companies, which isolates agents and can halt their behaviour through a hardware-level kill switch.