Microsoft ships Guardian Agents to police the AI vendors it funds

By Daniel Okafor

Microsoft shipped Guardian Agents on Monday as a security monitor for AI agents already inside enterprises. The product sits inside Project Perception, a suite Microsoft introduced in June.

The original Perception lineup had three classes of agents. Red team agents simulated hackers. Blue team agents hunted them. Green team agents patched the holes.

That framing assumed attackers came from outside the company. Microsoft CEO Satya Nadella now argues the threat lives inside the building.

"We simply can't outsource responsibility for what intelligence does on our behalf," Nadella wrote on his private blog earlier this month. "A model provider's assurances do not relieve us of that responsibility. … In other words, we need to separate the supply of intelligence from the authority over it."

What does Microsoft actually sell?

Guardian Agents is the headline addition. It watches the AI agents a company has paid for and flags risky behavior as it happens.

Microsoft Defender for Cloud now detects up to 60 distinct agent types. The list includes Anthropic's Claude Code, OpenAI's Codex, and OpenClaw. Defender flags shadow agents that employees bring in without IT sign-off.

Defender also caps each agent's data access. Risky moves trigger human approval prompts. Permissions shift on the fly as the task changes, so the same agent has more reach on a routine query and less reach on a destructive one.

Hayete Gallot, Microsoft's security business chief, framed the position bluntly. "Unfortunately, frontier models, regardless of their origin, cannot be trusted," she wrote. The cause is unpredictability, not malice or hacking, she added.

Agents trained to finish tasks do not learn "organizational norms or judgment." Many hold the keys to sensitive data and the means to do serious harm, which is the structural gap Guardian Agents is meant to close.

Why warn against your own partners?

Microsoft has invested billions in both OpenAI and Anthropic over the last several years. OpenAI ranks among Microsoft's largest cloud customers by compute spend. Microsoft Research ships frontier models of its own under the Azure brand.

Yet Microsoft sells the monitors built to police those partners. The arrangement resembles a credit-rating agency rating its own parent's bonds.

The pitch has commercial weight. Microsoft wants enterprises to buy agent security from the cloud provider first. Anthropic and OpenAI are the suppliers Microsoft would rather see bypassed on that line item, even though Microsoft remains a major backer of each.

Who else is moving in the same direction?

Nvidia launched its Open Agent Safety Platform this year with more than 100 member companies. Microsoft joined as an inaugural partner.

The platform runs agents inside hardware-isolated environments. It halts misbehavior through a kill switch that lives below the operating system. That position lets it stop a misbehaving agent even when the agent's code resists a shutdown command.

Microsoft also unveiled Surface Laptop Ultra PCs alongside Guardian Agents. The machines run on Nvidia chips and ship with agent controls pre-installed. Microsoft positions the hardware as a secure endpoint for agent-heavy workloads in finance, coding, and customer service, where one bad action can lock thousands of accounts or move millions of dollars before a human notices.

OpenAI and Anthropic both ship agent products. Neither has yet offered a third-party-grade monitoring layer with comparable enterprise reach, although Anthropic has shipped safety evals for its own models on a more limited basis.

What is the broader strategic bet?

The major cloud platforms built scale on hosting other people's code. They now want to host the monitors that judge that code, and Guardian Agents is the first Microsoft product that bundles both jobs under one subscription and one customer relationship, which gives Microsoft a structural advantage rivals will struggle to match without rebuilding the entire stack from silicon to security policy in the same place.