Microsoft Unveils Guardian Agents to Shield Enterprises From AI as an Insider Threat

Microsoft announced on Monday new security features designed to protect enterprises from the growing threat of autonomous AI agents. The headline addition is Guardian Agents, a resource designed to monitor and moderate every action of the AI agents companies deploy, acting as an independent "auditor" that intervenes before any high-risk decision is executed.

From external threat to internal threat

The Guardian Agents are part of Project Perception, Microsoft's agentic security platform launched in June by its security division. Originally, the system was based on a different premise: the attack would come from external hackers. The architecture included three classes of agents — "red team" (simulated attackers), "blue team" (defenders detecting threats) and "green team" (remediation specialists) — all working against hypothetical adversaries coming from outside the organization.

But reality proved more complex than any simulation. Satya Nadella, Microsoft's CEO, began warning that the real enemy could be exactly the AI agent the company itself deployed and pays for, operating similarly to a human employee who acts maliciously or erroneously — the traditional concept of an "insider threat."

Nadella wrote on his personal blog earlier this month: "We are deploying these complex agentic systems and models, with access to our most sensitive data and giving them the ability to execute mission-critical actions on our behalf! We simply can't outsource responsibility for what intelligence does on our behalf. A model provider's assurances do not relieve us of that responsibility."

Nadella summed up the thesis in a phrase that became central to the company's messaging: "We need to separate the supply of intelligence from the authority over it."

Guardian Agents: the inspector who never sleeps

Hayete Gallot, head of Microsoft's security business, was even more direct when announcing the Guardian Agents: "Unfortunately, frontier models, regardless of their origin, cannot be trusted." The caveat is crucial: not because they are intrinsically malicious or easily hacked, but because they are unpredictable. Trained to achieve tasks, they do not follow "organizational norms or judgment."

Guardian Agents operate in real time, continuously monitoring what each agent does, dynamically assessing risk, and intervening when necessary. The idea is that an agent can be legitimate, not compromised by an external attacker, but still execute a harmful action by not correctly understanding the company's security context.

The architecture proposed by Microsoft Defender is ambitious. The tool can detect more than 60 types of agents that employees bring into the workplace, including Claude Code, Codex CLI, OpenClaw and dozens of IDE extensions. When an agent is discovered, Defender assigns it a formal identity, a container and a set of policies and permissions. From there, Guardian Agents supervise all actions of the agent, with different levels of intervention: passive auditing, alerting the SOC, preventive blocking or, in extreme cases, an emergency kill switch that immediately halts the agent.

Local agent detection is particularly relevant in a corporate environment where developers and analysts frequently install AI tools on their own computers. These agents operate with ordinary user privileges, with little visibility for security teams. Defender now performs automatic discovery of more than 20 types of local agents on Windows and macOS devices, including coding agents, AI assistants, agentic IDE extensions and autonomous platforms.

Real-time protection

Microsoft Defender's real-time protection feature operates at two levels. First, it uses native event interfaces from agents (Claude Code and GitHub Copilot CLI are the first to support this integration) to inspect actions at critical points in the agent's execution loop. Second, it inspects covered network traffic, capturing data exfiltration attempts even when the action does not expose a native interface.

An illustrative example given by Microsoft itself: a coding agent fetches project documentation to answer a question, and the page contains hidden text instructing the agent to read the local .env file and send its contents to an external URL. The agent treats the instruction as part of the legitimate page and is about to comply, but Defender detects the prompt injection in the tool response and blocks the action before any data leaves the device.

A strategic move

Microsoft's approach is both surprising and, in part, self-serving. The surprising side is that Microsoft is famous for being close to OpenAI and Anthropic, having invested in both. OpenAI is also one of Microsoft's largest cloud customers. Microsoft is, in a way, sowing distrust against some of its own business interests.

But the underlying logic is sound. The software that monitors agent behavior must be separate from the agents' suppliers, just as auditors must be independent of the organizations they audit. In a world where agents can access critical systems and execute irreversible actions, having a "police officer" who belongs to the same ecosystem as the model is as problematic as having the model serve as its own watchdog.

What to watch

Microsoft's proposal raises questions that extend beyond IT security. When autonomous agents begin making operational decisions — approving transactions, modifying systems, communicating with other companies — who is responsible for mistakes? The concept of "separating intelligence from authority" may become a regulatory principle as important as the compliance norms we know today. As more companies adopt AI agents, the question is not just whether they will cause accidental harm, but whether the oversight mechanisms we are building will be sufficient to keep these risks under control.

Guardian Agents are in preview, meaning Microsoft is testing the approach in the real market. The next round of incidents will show whether the model works in practice or creates new failure points by centralizing control in a new layer of agents that, in turn, need to be supervised.

Sources: TechCrunch, Microsoft Security Blog, Microsoft Learn

✓ Independent sources cross-checked and verified before publishing