Microsoft Says Frontier Models Can't Be Trusted, Unveils Agent Controls

Microsoft has put a blunt position on the record. On 19 October its security business argued that frontier models can’t be trusted, and announced a set of controls that sit outside the model instead. The headline feature is Guardian Agents, part of Project Perception. The more interesting part is the architecture behind it.

What was announced

The detail is in a Microsoft Security Blog post by Nadim Abdo, titled “Agents are your newest insiders. Security must move at their speed.” Hayete Gallot, EVP of Microsoft Security, framed it in a separate post, “Securing the agentic insider”. Several pieces matter for defenders.

Discovery. Defender’s agent discovery grows by 35 local agent types, bringing the total to 60. The named examples include Claude Code, OpenAI Codex and GitHub Copilot. Discovered agents can land in a unified registry, and Entra Agent ID is being extended to cover local and previously unknown agents found by security sensors.

Permissions. Under what Microsoft calls Dynamic Permissions, agents start with no permissions and receive task-scoped, time-bound access. Organisation-wide policy sets the outer boundary. Higher-impact actions can require verified human approval.

Containment. Sandboxes such as the Microsoft Execution Container create an enforcement boundary with policy-controlled access to resources. Dynamic Agent Risk and Dynamic Conditional Access reassess exposure from multiple signals, and the post says the response is “graduated, not binary”. At the top risk levels the runtime can be isolated or execution stopped.

Guardian Agents. New Playbooks and a team of Guardian Agents let security teams work “continuously, at machine speed and scale”, with people setting policy and approval limits.

We found no per-feature preview or availability dates in Abdo’s post, Gallot’s post or TechCrunch as of 2026-10-21. Gallot says you can get started today with Project Perception, and TechCrunch reports agent detection has been added to Defender along with controls that limit agent access and adjust permissions dynamically, so some capabilities appear to be available now. Check which ones apply to your tenant before planning around them.

The reasoning

In “Securing the agentic insider”, Gallot wrote: “Unfortunately, frontier models, regardless of their origin, cannot be trusted.” TechCrunch also covers the post. Her point is unpredictability rather than malice: “Agents are unpredictable.” Models, she says, “are not optimized around organizational norms or judgment.” She calls Guardian Agents “an established industry term”, so this is Microsoft joining an existing category, not inventing one.

TechCrunch says this echoes an essay by CEO Satya Nadella earlier in October, which argued that companies need to “separate the supply of intelligence from the authority over it.” The framing is insider threat: a misbehaving agent is a bit like a rogue employee.

Abdo’s post uses an expense-approval agent as its example. Such an agent “should not inherit every permission of the employee who sponsors it”, and as the post puts it, “Its configuration has not changed, but its behavior and risk have.” Our inference: static permissions can’t catch that kind of drift, because the grant looked fine when it was made.

Why it matters

Notice what isn’t being claimed. Our reading: Microsoft isn’t saying prompt injection is solved. The post says to assume an agent can fail or be compromised, and to make sure the damage is bounded. An agent that has been hijacked might keep read access but lose approval or write rights, or need a human to sign off before a significant action.

That’s a sensible design principle, and it matches how security teams already handle insiders. Least privilege, short-lived grants and independent monitoring are old ideas applied to a new kind of identity.

There’s a commercial reading too. TechCrunch calls the move “surprising and self-serving”: Microsoft has invested in both OpenAI and Anthropic, yet is telling customers not to rely on model providers’ assurances, and it would like them to buy agent security from Microsoft. The same piece concedes the logic is sound, comparing independent monitoring to auditors who sit outside the organisations they audit.

What to do now

Our own checklist, useful regardless of vendor (not Microsoft guidance):

• Inventory the agents running on endpoints, including coding assistants developers installed themselves.
• Give each agent its own identity, rather than letting it borrow an employee’s session.
• Scope permissions to a task and a time window, and require human approval for payments, deletions and external messages.
• Keep enforcement in code and infrastructure outside the model, never in the prompt.
• Log tool calls so you can tell when behaviour drifts.

Microsoft’s Ignite conference runs 17 to 20 November, which is our guess for where more detail may appear.

References

• Microsoft Security Blog — Agents are your newest insiders. Security must move at their speed.
• Microsoft — Securing the agentic insider (Hayete Gallot)
• TechCrunch — Microsoft says AI agents are like insider threats as ‘frontier models can’t be trusted’