Microsoft Says AI Agents at Work Can't Be Trusted

Microsoft CEO Satya Nadella wrote on his blog that companies can no longer simply trust a model vendor's safety promises. He said the decision about what an AI agent is allowed to do inside a company has to stay with the company itself. On October 19, Microsoft's security chief Hayete Gallot said frontier AI models cannot be trusted, no matter who built them. She said they aim for an outcome, not for following a company's rules. Microsoft pointed to Project Perception, a security system it introduced in July. It gives every agent an identity and a set of access rights. It tracks in real time how risky an agent's actions are. It uses supervising «guardian agents». That is the industry term for agents that watch other agents and can restrict them before they act. Microsoft's defense system can already detect up to 60 types of agents running on company computers. These include Claude Code, Anthropic's coding tool, Codex, OpenAI's coding agent, and OpenClaw. It can restrict their access rights right away.

The fact that Microsoft names Claude Code among the agents it tracks shows something. Agentic coding inside companies is no longer an experiment. It is standard practice now. Raw agent output gets caught by review and tests. It gets caught because one specific person is accountable for what ships, not because a tool gets banned. Microsoft's move to separate the model vendor from the party that decides what an agent can do does not look like marketing. It looks like something companies will actually run into as they scale up their use of agents.