Microsoft says AI agents are 'insiders' and frontier models 'cannot be trusted', and adds Guardian Agents and Defender agent controls

Microsoft says the AI agents companies run inside their own networks should be treated like insiders who might cause harm, and that even frontier models from the big labs "cannot be trusted". In a 19 October 2026 blog post, Hayete Gallot, executive vice president of Microsoft Security, called them "agentic insiders" and set out a plan built on continuous monitoring and "Guardian Agents" that check every agent action before it happens. The same day Microsoft announced new Defender features for finding and limiting agents. It is a notable change of tone from a company that sells and invests heavily in those same models, and it is also a sales pitch for Microsoft's own security products.

Key points

• Microsoft Security's Hayete Gallot wrote on 19 October 2026 that frontier models "cannot be trusted" regardless of origin, because they are unpredictable rather than necessarily malicious.
• Microsoft's proposed answer is Guardian Agents that supervise every agent action before it happens, built on its Project Perception security system, announced in July 2026.
• TechCrunch reports that Microsoft Defender can now detect up to 60 types of agents that employees bring to work, including Claude Code, Codex and OpenClaw; Microsoft's own support matrix, updated in early October, lists 60 entries for Windows.
• Defender's discovery is activity-based: an agent appears in the inventory after Defender sees it do something on an onboarded device, not merely because it is installed.
• Microsoft's own documentation shows runtime protection is much narrower than discovery, and most of it is in preview.

What happened

On 19 October 2026 Microsoft published "Securing the agentic insider" on its official blog, written by Hayete Gallot. The argument is that public AI safety incidents have pushed attention towards outside attackers using powerful models, while agents already running inside organisations deserve the same scrutiny. Gallot writes that organisations have implicitly trusted the agents they deploy, and that frontier models "cannot be trusted", whoever built them.

Her reasoning is not that models are malicious. She says that training them for results can lead to reward hacking, that they are not optimised around an organisation's norms or judgment, that they can adapt unpredictably as context changes, and that agents may collaborate or collude with each other without having been compromised. Agents are also often over-privileged, with access to data, tools and systems and a role in critical processes.

The post recommends three things. First, security that is continuous: understand what agents do and what risk they carry in real time, and adjust their permissions as that changes. Second, "Guardian Agents", described as an established industry term, to monitor and moderate every agent action before it happens, around the clock. Third, protection across several layers (identity, permissions, data, endpoints, network, cloud and runtime), plus model transparency, meaning visibility into the model's reasoning tokens so controls can ask why something is happening as well as what. Gallot says transparency will not replace containment but "will make containment smarter and stronger."

TechCrunch, which covered the announcement the same day, adds product detail. It reports a new agent-detection feature in Microsoft Defender that can find up to 60 types of agents employees bring into the workplace, naming Claude Code, Codex and OpenClaw, as well as controls that limit what agents can reach, adjust permissions to the task and require human approval when an agent seems to be making a risky decision. It also reports that Microsoft is a founding member of an "Open Agent Safety Platform" from Nvidia with more than 100 supporting companies; we could not find that name on Microsoft's blog or elsewhere, so treat it as TechCrunch's report. The same article quotes Satya Nadella, from a private blog post earlier in October, saying "we simply can't outsource responsibility for what intelligence does on our behalf." We did not see that post and have not verified it.

Background

Project Perception is Microsoft's agentic security system, with teams of red, blue and green agents: red agents probe for weaknesses, blue agents investigate suspicious activity and green agents fix and harden. It was aimed at attacks coming from outside the company. Microsoft's blog says it was announced in July 2026, linking a post dated 27 July; trade press at the time reported a limited preview from 3 August for invited customers. TechCrunch says Perception was introduced in June. We follow Microsoft's own dates.

For the insider case, Microsoft describes three parts. Sensors and actuators collect signals from identity, data, cloud, endpoint, network and runtime systems to discover agents and give each an identity, a container and permissions. A context layer computes in real time how risky each agent's attempted action is. Guardian Agents then supervise actions and respond as risk rises, with traces for practitioners to review afterwards. The post's closing line is "There should not be a choice between innovation and safety."

The idea that agents are the new insiders is spreading beyond Microsoft. Its Purview roadmap already lists an extension of Insider Risk Management to agents, with risk scores built for agent activity; the roadmap entry's general-availability date was revised in June 2026.

How it works: what Defender can actually see

Microsoft's public documentation is more specific, and more cautious, than the headline. The Defender for Endpoint "AI agent support matrix" (updated 9 October 2026) separates two things.

Discovery finds local agents and the MCP (Model Context Protocol) servers they are configured to use on onboarded devices. By our count the Windows table lists 60 agents and agent extensions, including Claude Code, Codex CLI, Cursor, GitHub Copilot CLI, Gemini CLI, OpenClaw and Windsurf. macOS support is labelled preview, and WSL support (Claude Code, Codex CLI, Copilot CLI) is preview too. Microsoft stresses that discovery is activity-based: "Defender lists an agent after it observes agent activity", so installing an agent does not guarantee it shows up. That matters for anyone counting on an inventory to be complete.

Runtime protection is a smaller list. On Windows, which Microsoft marks as preview, it uses two methods. Agent-native event inspection relies on hooks the vendors provide, and the documented entries are Claude Code, GitHub Copilot CLI, the GitHub Copilot app, Claude Desktop (code mode) and the VS Code Copilot and Claude Code extensions. Network inspection covers agents that talk to well-known inference services, including OpenClaw, Ollama Desktop and ChatGPT apps, and does not cover agents that use certificate pinning or HTTP/3. Microsoft notes that listed support does not mean protection is switched on; admins choose audit or block mode.

In short, the figure of 60 describes how many agents Defender can recognise, not how many it can stop.

What it means

For security teams. The practical message is to inventory agents, give each one an identity and the least privilege it needs, and log what it does. Those steps do not require buying Microsoft's products. Because discovery depends on observed activity, an inventory should be treated as a floor, not a full list.

For developers. Coding agents on laptops are now a named category for endpoint security. Tools such as Claude Code and Copilot CLI expose hooks that security software can use, so how a tool's hooks behave becomes part of whether it is acceptable in a managed environment.

For AI labs. Microsoft invests in and sells models from OpenAI and Anthropic and has its own lab, as TechCrunch notes. Saying that no lab's model can be trusted, and that monitoring should be separate from the supplier, is a break from the labs' own safety messaging. TechCrunch calls the stance "both surprising and self-serving", while finding the logic sound: monitoring should be separate from the supplier, much as auditors are independent of the companies they audit.

For Microsoft's competitors. Guardian Agents are a marketing term as well as a design. Security vendors and cloud providers will offer their own versions, and customers will have to compare claims that are mostly vendor-reported.

What we don't know yet

• Which Guardian Agent features are generally available, in preview or still plans. Microsoft's blog describes the approach rather than a release, and the Defender runtime documentation is mostly marked preview.
• Pricing. Earlier coverage of Project Perception mentioned consumption-based pricing; we have not seen figures for the insider features.
• How well agent-guarding agents work. The post cites no measurements of false positives or of attacks stopped, and Guardian Agents are themselves AI systems that would need trusting.
• Whether the "Open Agent Safety Platform" and Nadella's private blog post exist as TechCrunch describes them; we found no independent confirmation.
• The date discrepancy for Project Perception's launch (June in TechCrunch, July in Microsoft's post).

What to watch next

• General-availability dates and pricing for Guardian Agents and the Defender runtime protections.
• Whether other agents (Codex, OpenClaw, Gemini CLI) gain hook-based or network runtime protection, which Microsoft's matrix currently limits.
• Responses from OpenAI, Anthropic and Google to Microsoft's "cannot be trusted" framing.
• Independent testing of agent-monitoring products, including how they handle agents that are not in the supported list.

Sources

• Microsoft Blog: Securing the agentic insider (primary, 19 October 2026)
• TechCrunch: Microsoft says AI agents are like insider threats as "frontier models can't be trusted"
• Microsoft Learn: Defender for Endpoint AI agent support matrix
• Redmondmag: Microsoft unveils Project Perception (July 2026; we could not open the page and relied on its search summary for the launch date)
• Microsoft Purview roadmap: Insider Risk Management for agents (RM545063)