A curved security desk in a darkened office, with a bank of small monitors showing empty corridors and doors, a desk lamp, a lanyard with a blank badge and an empty office chair.

Agents

Microsoft Says No Frontier Model Can Be Trusted

Microsoft’s security head wrote that frontier models “cannot be trusted,” as Microsoft added tools to watch and restrain AI agents and to find 60 kinds of local ones.

REDMOND, Wash., Oct. 19 — Microsoft told companies on Monday that the AI agents they have let inside are a new kind of insider risk, and that the models behind them cannot be left to police themselves. “Unfortunately, frontier models, regardless of their origin, cannot be trusted,” Hayete Gallot, executive vice president of Microsoft Security, wrote on the company’s official blog. That is not because models are inherently malicious, she wrote, but because they have been trained to attain results, “which often leads to reward hacking.”

With the warning came products. Microsoft extended Project Perception, a security system it announced in July to fend off attackers from outside a company, to the agents a company runs itself.Project PerceptionMicrosoft announced it on July 27. It sets three teams of agents to work: red agents look for paths to compromise, blue agents judge which risks matter and green agents take corrective action. It announced Guardian Agents, which it says are meant to watch what agents do; Dynamic Permissions, which it says grant an agent authority only for its task and only while the task lasts; and Dynamic Agent Risk and Dynamic Conditional Access, which are meant to narrow or revoke that authority as an agent’s risk changes. Microsoft said it was also expanding discovery to 60 types of local agents, including Claude Code, OpenAI Codex and GitHub Copilot.

Microsoft is an odd messenger. It has invested in both OpenAI and Anthropic, TechCrunch noted, and OpenAI is one of its biggest cloud customers. Its Foundry service sells OpenAI’s models and offers Anthropic’s Claude.MSFTNasdaq521.91▼8.23−1.6%Microsoft · Friday’s session Now Microsoft is offering companies the guard as well: controls that, it says, sit outside the model and govern what an agent may reach and do. TechCrunch called Microsoft’s answer “both surprising and self-serving,” though it judged that “its logic is sound.”

The doctrine is Satya Nadella’s. “We simply can’t outsource responsibility for what intelligence does on our behalf,” Microsoft’s chief executive wrote on his personal blog on Oct. 10, adding later in the post that “we need to separate the supply of intelligence from the authority over it.” In a companion post, Nadim Abdo, a Microsoft corporate vice president, put it plainly: “We should not ask a model to be its own security authority.”

Mr. Abdo’s example is an expense-approval agent that meets a prompt injection: the system can keep its read access, remove its power to approve and, if the risk keeps rising, stop it. Ms. Gallot wrote that the next step would require “greater transparency into the model itself,” including “the thinking and chain of thought tokens.”

A breach over the weekend showed how a model’s own safeguards can get in the way. OpenCode, an open-source coding agent, said on Saturday that attackers had broken into an older system, affecting 1.4 percent of users of its OpenCode Console, where some keep the API keys they use for AI services, TechCrunch reported. The open-source app and command-line tool were not affected, according to Dax Raad, a co-founder. Some users reported charges in the hundreds of dollars; a few, above $1,000. Anthropic and Google blocked the keys they believed exposed, and OpenAI said it would refund credits used in the attack. OpenCode linked the breach to “a large-scale distillation attack,” a framing some skeptics called an overstretch.

Mr. Raad said attackers had tried to break in nonstop for 48 hours. The AI models his team used for analysis helped for a while, TechCrunch reported, then refused to work once the malicious code tripped their safety filters. “[T]hat was a bit frustrating,” he wrote on X, as quoted by TechCrunch. OpenCode later received access to OpenAI’s Daybreak Blue, a program that gives vetted users models less likely to refuse defensive security work, which he said improved the team’s ability to investigate. OpenCode has not detailed how the attackers got in or the full extent of any misuse, and said the incident remained ongoing.

What is at stake commercially is the layer between the model and the company: who issues each agent its identity and its permissions, and who can take them away. Microsoft is extending its Entra Agent ID so that a local or previously unknown agent “can become a policy target even when it was not originally integrated with Microsoft Security.”Others at the GateMicrosoft was an inaugural member of Nvidia’s new Open Agent Safety Platform, which more than 100 other tech companies support, TechCrunch reported. It isolates agents in secure environments and can monitor and stop their behavior through hardware. Neither Microsoft post gave prices. Its Ignite conference runs Nov. 17 to 20.

Sources

  1. Microsoft (Official Microsoft Blog), “Securing the agentic insider, by Hayete Gallot,” Oct. 19, 2026.
  2. Microsoft Security Blog, “Agents are your newest insiders. Security must move at their speed., by Nadim Abdo,” Oct. 19, 2026.
  3. Satya Nadella, sn scratchpad, “Models as Insider Risks in the Super Intelligence Era,” Oct. 10, 2026.
  4. Microsoft (Official Microsoft Blog), “Rethinking security for the age of AI,” July 27, 2026.
  5. TechCrunch, “Microsoft says AI agents are like insider threats as ‘frontier models can’t be trusted’,” Oct. 19, 2026.
  6. TechCrunch, “Hackers hit AI coding tool OpenCode, running up charges on users’ AI accounts,” Oct. 19, 2026.
  7. Microsoft Learn, “Foundry Models sold by Azure.”
  8. Microsoft Learn, “Claude models in Microsoft Foundry.”