Microsoft has unveiled Guardian Agents, a new layer of security tooling that treats a company's own AI agents as potential insider threats.

Announced in a blog by Nadim Abdo, Microsoft's Corporate VP for Identity and Network Access, the system continuously monitors every planned action of operational agents and can surgically block risky behavior before it executes.

The company coined the term 'agentic insiders' to describe the risk: agents hold extensive permissions and can make mistakes or be manipulated, creating disaster potential if left unwatched.

Guardian Agents extend Project Perception, originally launched to fight external AI hackers with red, blue, and green agent teams, and now pivot that machinery inward.

The reversal is striking because Microsoft is famously close to OpenAI and Anthropic, having invested in both, while OpenAI is one of its biggest cloud customers — and Microsoft runs its own AI lab. As TechCrunch notes, Microsoft is sowing distrust against some of its own business interests.

CEO Satya Nadella argued in a blog post that enterprises must stop trusting AI model providers, even those offering safety assurances: 'We simply can't outsource responsibility for what intelligence does on our behalf.'

Microsoft's security chief Hayete Gallot was blunter still, writing that 'frontier models, regardless of their origin, cannot be trusted' — not because they are malicious, but because they are unpredictable and prone to reward hacking.

The architecture rests on Nadella's principle that non-deterministic intelligence must be surrounded with deterministic controls, independent evidence, and containment boundaries.

The controls span seven layers — identity, permissions, data, endpoints, network, cloud, and runtime — with four responsibilities: know each agent and its owner, contain what it can access before it acts, protect the data and runtime it uses, and adapt continuously as risk changes.

New features include Dynamic Permissions, which limit agents to the access a specific task needs, and Dynamic Agent Risk scoring; Dynamic Conditional Access can then restrict permissions, block operations, demand human approval, or in extreme cases stop and isolate an agent entirely.

GeekWire reports the system can score each agent's risk as it works and limit it to read-only when that risk rises.

Microsoft also expanded agent discovery to 35 additional types of local agents — including Claude Code, OpenAI Codex, and GitHub Copilot — and, according to TechCrunch, added detection to Microsoft Defender that can find up to 60 types of agents employees bring into the workplace, including Claude Code, Codex, and OpenClaw.

Microsoft Entra Agent ID gains identity types for additional agent patterns, including local and previously unknown agents surfaced through security sensors.

Project Perception, Microsoft Agent 365, and the broader cyber stack share signals, context, and a unified registry, giving IT and security teams one consistent view of every agent and its risk posture.

The idea of agents as untrustworthy insiders is taking hold across the industry.

TechCrunch reports Microsoft was an inaugural member of Nvidia's new Open Agent Safety Platform, backed by more than 100 tech companies, which isolates agents in secure environments and monitors behavior through hardware like a kill switch.

Microsoft also announced Surface Laptop Ultra PCs built for agents, running on Nvidia chips with agent security controls baked in.

The stakes are high because agents work at machine speed across connected systems — India Today notes a small mistake or hidden harmful instruction could expose sensitive data before any human notices, which is why oversight must be continuous, real-time, and pre-emptive.

The underlying logic is one enterprises will recognize: the software monitoring agent behavior should be separate from the suppliers of agents, just as auditors should be independent of the organizations they audit — a comparison TechCrunch draws explicitly.

Expect AI agents watching AI agents to become standard practice: Guardian Agents pair with 'green' and 'blue' agents to supervise actions around the clock, while algorithmic speed combines with human judgment to trace what happened and recalibrate rules.