What Microsoft's Guardian Agents mean for your AI agents

On Monday, Microsoft introduced security features built on one idea: the AI agents a company deploys can behave like a rogue employee, according to TechCrunch. The headline product is Guardian Agents, which monitors the agents a company uses. The change most likely to touch your daily work is a quieter one. Microsoft Defender can now detect up to 60 types of agents that employees bring to work, including Claude Code, Codex and OpenClaw. Microsoft also added controls that limit what agents can reach and can require a human to approve risky actions.

The background you need

AI agent. A chatbot answers. An agent acts. An agent is a language model connected to tools. It can read files, run terminal commands, call APIs, open pull requests or send messages. Coding agents like Claude Code and Codex run in your terminal or editor and change code on their own across many steps. The more tools you connect, the more an agent can do without you watching each step.

Frontier model. The most capable general-purpose models from the large AI labs. Most agents are built on top of one.

Insider threat. A security term for risk that comes from someone already inside the company. That might be an employee or contractor with legitimate access who misuses it, on purpose or by mistake. Most security tools were built to keep outsiders out. Insider threat controls assume the person is already in. They focus on limiting and watching what that person does.

Here is an analogy. Think of an agent as a fast, tireless new hire who got a master key on day one. The new hire is not trying to hurt you. But they do not know your unwritten rules, and they take instructions literally. The analogy breaks in two places. An agent can take hundreds of actions in the time a person takes one, so mistakes spread faster. And you cannot fire it and know the problem is gone, because the same model runs in many places at once.

Least privilege. A long-standing security rule: any account, human or software, gets only the access it needs for the current job. Many teams give agents broad access because it is convenient. That breaks this rule.

Red, blue and green teams. A red team attacks a system the way hackers would. A blue team detects and responds. Microsoft added a third color, green, for the team that fixes what is found. According to TechCrunch, Project Perception launched in June with AI agents for all three roles. TechCrunch describes it as Microsoft’s answer to powerful hacking models such as Anthropic’s Mythos and Fable, and to OpenAI’s vulnerability scanning system Daybreak.

Shadow IT. Software that employees adopt without IT approval. A coding agent you install with a single command is a new kind of shadow IT. Defender’s new agent detection is aimed at it.

What actually changed

Some of this was already true. Project Perception has existed since June. According to TechCrunch, it was designed on the assumption that AI attackers would come from outside the company.

Here is what is new this week, per TechCrunch:

• Guardian Agents. A feature inside Project Perception that monitors the AI agents a company uses.
• Agent detection in Microsoft Defender. It can find up to 60 types of agents that employees bring into the workplace. TechCrunch names Claude Code, Codex and OpenClaw.
• Access controls. These limit agents’ access to data and systems. They also adjust an agent’s permissions based on the task, and can require human approval if an agent appears to be making risky decisions.

The framing changed too. Earlier this month, on his private blog, Microsoft CEO Satya Nadella told enterprises to stop relying on safety assurances from AI model providers. He wants them to run separate oversight systems that the AI labs do not control. His summary line: “We need to separate the supply of intelligence from the authority over it.”

Hayete Gallot, who leads Microsoft’s security business, went further when she announced Guardian Agents. She wrote that “frontier models, regardless of their origin, cannot be trusted”. According to TechCrunch, she said the reason is not that models are malicious or easy to hack. It is that they are unpredictable, because they are trained to complete tasks rather than to follow an organization’s norms and judgment.

Microsoft is also an inaugural member of Nvidia’s new Open Agent Safety Platform. TechCrunch says more than 100 other tech companies support it. The platform isolates agents in secure environments and can monitor and stop their behavior through hardware. TechCrunch compares this to a kill switch.

TechCrunch also points out a tension. Microsoft has invested in both OpenAI and Anthropic, OpenAI is one of its biggest cloud customers, and Microsoft builds its own models. TechCrunch calls the move both surprising and self-serving, because Microsoft wants companies to buy agent security from it rather than from the labs. TechCrunch still calls the underlying logic sound. The tool that watches an agent should be separate from the company that supplies it, the same way an auditor should be independent of the company it audits.

What it means for developers and small teams

Defender’s agent detection is the change to focus on. Guardian Agents is for enterprises monitoring agents they chose to deploy. Defender detection covers agents that individual people chose to install. If your employer or a client runs Microsoft Defender, the coding agent in your terminal may now appear by name on a security dashboard.

Here is what that means in practice:

1. Expect visibility, then policy. Detection usually comes first. Once a security team can see Claude Code or Codex on laptops, they will decide whether to allow, restrict or block it. If you rely on an agent every day, get it approved before that decision is made without you.
2. Expect approval prompts. Microsoft’s controls can require a human to approve actions that look risky. Workflows that now run unattended may pause and wait for someone. Plan for that in anything you automate.
3. Check what your agents can reach today. You do not need Microsoft to apply least privilege. List the API keys, cloud credentials and production databases your agents can access. Limit each token to the task it is for. Keep dev and prod credentials separate.
4. Contractors and agencies: follow the client’s rules. When you work inside a client’s environment, their Defender policy covers your tools there. Ask before you run an agent on a client machine.
5. Choose agent tools you can oversee yourself. Nadella’s argument is that oversight should come from someone other than the model supplier. That applies beyond Microsoft. When you evaluate an agent tool, check whether you can log and limit its actions with something you control, not only with the vendor’s own settings.

What to watch next: which agents get added to Defender’s list, how the human approval rules are configured, and whether other security vendors ship similar detection.

What we don’t know yet

• Pricing and licensing. The report gives no price for Guardian Agents or the new Defender features. It does not say which plans include them.
• Availability. TechCrunch does not say whether these features are generally available or in preview.
• What detection leads to. The report does not say whether Defender only reports an agent or can block it by default. It also does not define what counts as a risky decision that needs approval.
• The full list. Only three of the up to 60 agent types are named.
• How the labs respond. The report includes no reaction from OpenAI or Anthropic.
• How the Nvidia platform fits in. The report does not explain how the Open Agent Safety Platform’s hardware controls work alongside Microsoft’s software controls on ordinary machines.