Microsoft says frontier models cannot be trusted, pitches Guardian Agents to contain them

Microsoft is telling companies to treat the AI agents they deploy as potential insiders, then offering more software to watch and constrain them. On October 19, it extended Project Perception with Guardian Agents and controls intended to change an agent’s permissions as its behavior and risk evolve.

In the official announcement, security chief Hayete Gallot writes that “frontier models, regardless of their origin, cannot be trusted.” Her argument is that models pursue results without reliably following an organization’s norms or judgment, not that every model is malicious. The warning is Microsoft’s position accompanying its product pitch, rather than evidence that every enterprise agent has caused harm.

From detecting an agent to limiting its next action

Microsoft says its discovery support is expanding by 35 types of local agents to 60, including Claude Code, OpenAI Codex and GitHub Copilot. It also describes extending Entra Agent ID so previously unknown agents can become identifiable targets for policy and ownership tracking.

The announced Dynamic Permissions feature scopes authority to a task and time window, within organizational policy and the sponsoring user’s own access. Dynamic Agent Risk combines security and activity signals, while Dynamic Conditional Access can respond by removing write access, narrowing reachable resources, requiring verified human approval or isolating a runtime. Microsoft’s expense-approval example illustrates the intended behavior; it is not a report of a measured deployment outcome.

Guardian Agents and Playbooks sit above those signals and enforcement points. Microsoft says they can investigate changing risk, recommend or apply containment and help harden policy within boundaries set by people. The stated principle is that the model supplying intelligence should not control its own security boundary.

An expansion, with effectiveness still a vendor claim

Microsoft dates Project Perception’s introduction to July 2026. Today’s development extends that initiative from defending against outside attacks to supervising agents already operating inside an organization; it is not the project’s first launch.

TechCrunch highlights Microsoft’s commercial interest in selling independent monitoring while also investing in AI model companies. The practical question for customers is which controls can be enforced around their specific agents and systems. The announcements do not establish one universal price or general-availability date for every component, and AITrending has not tested the containment claims.