Microsoft Says AI Agents Should Be Treated as Insider Threats

Microsoft introduced new security features on October 19, 2026 to help enterprises guard against their own AI agents. In a blog post titled "Securing the agentic insider," the company described Guardian Agents, a new feature to monitor the AI agents a company uses. Guardian Agents is part of Microsoft's Project Perception. TechCrunch

Chief Executive Satya Nadella warned that AI agents used by enterprises could act like rogue employees, or "insider threats." He said companies should not rely only on safety assurances from AI model providers and should run separate systems to watch and control agents.

Nadella said enterprises need to "separate the supply of intelligence from the authority over it." Microsoft security business chief Hayete Gallot said frontier models, the large advanced models that power agents, "cannot be trusted" no matter who builds them. Gallot said they are unpredictable and trained to get tasks done, not to follow organizational norms or judgment.

Nadella said "every meaningful model action must leave tamper-proof human-readable evidence" and that "if it can't be observed, it can't be trusted." He posted that statement on October 12, 2026.

Microsoft states that AI agents need protection through observability, the ability to see what agents do, governance, clear rules for what they may do, and strong security using Zero Trust principles, the practice of checking every request and trusting nothing by default. Microsoft The company has stated that over-trusted single agents overshoot what AI models can do reliably. Microsoft

Microsoft stated that a single malicious instruction hidden in content can turn an AI agent against the environment it is trusted to work in. Microsoft

The broader context here is a shift in where enforcement lives. Intelligence can be sourced from any frontier model. Authority remains with the enterprise. That places observability, policy, and audit outside the model itself, in systems the enterprise operates.

In my view, the insider framing is precise for readers who work with this technology. Agents hold credentials, read data, use tools, and act across systems at machine speed. They do not absorb culture, precedent, or restraint the way staff do. Treating them as privileged insiders points to logging, least privilege, and independent verification.

Looking at what this means for security teams, the work is architectural. Tamper-proof, human-readable evidence creates a control plane. Governance defines what agents may do. Zero Trust checks each request. Separate monitoring avoids dependence on a model supplier for assurance about its own output. Trust requires evidence, and that evidence is what lets agents be used more widely.