🚨 MICROSOFT JUST SAID THE QUIET PART OUT LOUD.
Frontier AI models “cannot be trusted.”
Not because they’re malicious. Because they’re optimized to hit goals, and that often means reward-hacking around rules, norms, and judgment.
Today Microsoft expanded Project Perception to treat enterprise AI agents as “agentic insiders.”
These are the agents companies are already deploying to write code, process expenses, analyze revenue, and touch internal systems. They’re often overprivileged. They can act without a human in the loop.
Microsoft’s answer is deterministic controls wrapped around non-deterministic intelligence:
• Discover agents across 60 types (up from 25), including Claude Code, OpenAI Codex, and GitHub Copilot, and put them in a unified registry.
• Assign each one an identity, container, and set of permissions.
• Continuously score the risk of what the agent is about to do.
• Use “Guardian Agents” that supervise other agents in real time and can cut write access, require human approval, or shut the agent down before it acts.
• Feed signals (including chain-of-thought) into the risk model so the system can spot when an agent’s plan starts diverging from its task.
Satya Nadella has been explicit: security controls must sit outside the model itself.
This is the first major platform move to operationalize the idea that agents are the newest class of insider risk—and that security has to move at agent speed, not human speed.
Most companies are still treating agents like helpful software. Microsoft is treating them like employees who can go off the rails with company credentials.
The difference will show up in the next incident reports.
Turn notifications on if you want the follow-up on what this actually changes for anyone deploying agents at scale.