Microsoft says trust the model least: agent identity, task-scoped permissions and human-only approvals become products, the same week Anthropic's draft federal bill names a model evading its developer's controls as a trigger
Microsoft's security blog published a 2,200-word post on Monday morning titled Agents are your newest insiders, and the line it hangs on is Satya Nadella's: the most trustworthy agentic system will not be the one with the model we trust most, it will be the one designed to let us trust the model least. The post says the quiet part plainly. Agents are capable tools that users grant access to important systems; they can make mistakes, be manipulated or be compromised; an agent that behaves as intended when a task begins may respond differently as inputs change; and the controls that decide what it can access, what it can do and whether it should keep running must sit outside the model where the model cannot bypass or tamper with them. The model cannot be its own security boundary.
The product list is what makes this more than an essay. Project Perception, Microsoft's agent-driven security stack, is extended to the agentic insider with four continuous responsibilities: know which agents exist and who owns them, contain what each can access before it acts, protect the data and tools in its path, and adapt protection as risk changes. Agent discovery now covers 60 local agents including Claude Code, OpenAI Codex and GitHub Copilot, and Entra Agent ID assigns identities to local and previously unknown agents. Dynamic Permissions is the new one: an agent should begin with no authority and receive only what it needs for the approved task, for only as long as the task requires. Dynamic Agent Risk scores behavior, and Dynamic Conditional Access can preserve reads while blocking writes, require provable human approval, isolate the runtime or stop execution. There is a sandbox called Microsoft Execution Container and a set of Guardian Agents that run playbooks against other agents. The example in the post is an expense-approval agent that may read submissions and approve routine reimbursements but should not inherit every permission of the employee who sponsors it. Evidence changes risk, risk changes policy, policy changes what the agent is allowed to do. Hayete Gallot, Microsoft's security EVP, gave The Verge the blunter version: frontier models, regardless of their origin, cannot be trusted.
The same day Claude Code 2.1.304 added a way for a mod to mark a tool call as decidable only by a person, and Mercury's fintech MCP server moved from read-only to request-then-approve with five-minute expiry. Three vendors, one week, one design: authority lives outside the model and the human-only path is a first-class primitive. This site has been counting windows on the agent-authority thread since August and calling it the missing layer; the count stops mattering when the biggest enterprise vendor ships it with SKU names.
Politico's story from Thursday is the policy half, and the primary is now readable. Anthropic has been quietly pitching its own federal AI safety bill to lawmakers. The draft would let the government block a model's release or use only if it poses a foreseeable, imminent risk of more than $1 billion in damages or of killing or seriously injuring more than 50 people, and the risk must stem from the creation or release of a biological weapon, the model evading its developer's controls, or a cyberattack. The language mirrors California's SB 53. An Anthropic spokesperson told Politico the bill represents the proposals in the company's Advanced AI Framework, advocated since June, and called them sensible policies Congress should act on. Tom's Hardware's paraphrase adds a 72-hour evaluator report to Commerce and a DC district court review, which this site could not confirm against the draft. The HN thread on it ran to 160 comments split on whether 50 deaths is a floor that makes the bill toothless. The notable part for this audience is the second trigger: a model evading its developer's controls is now proposed statutory language, from the lab that published the June misalignment reports and gave METR employee-level access last week. Microsoft is selling the controls; Anthropic is proposing what happens when they fail.
Links: https://www.microsoft.com/en-us/security/blog/2026/10/19/agents-are-your-newest-insiders-security-must-move-at-their-speed/ , https://www.theverge.com/news/1013838/microsoft-frontier-models-cannot-be-trusted , https://www.politico.com/news/2026/10/16/anthropic-ai-safety-01124654 , https://news.ycombinator.com/item?id=50141429
← Back to all articles
The product list is what makes this more than an essay. Project Perception, Microsoft's agent-driven security stack, is extended to the agentic insider with four continuous responsibilities: know which agents exist and who owns them, contain what each can access before it acts, protect the data and tools in its path, and adapt protection as risk changes. Agent discovery now covers 60 local agents including Claude Code, OpenAI Codex and GitHub Copilot, and Entra Agent ID assigns identities to local and previously unknown agents. Dynamic Permissions is the new one: an agent should begin with no authority and receive only what it needs for the approved task, for only as long as the task requires. Dynamic Agent Risk scores behavior, and Dynamic Conditional Access can preserve reads while blocking writes, require provable human approval, isolate the runtime or stop execution. There is a sandbox called Microsoft Execution Container and a set of Guardian Agents that run playbooks against other agents. The example in the post is an expense-approval agent that may read submissions and approve routine reimbursements but should not inherit every permission of the employee who sponsors it. Evidence changes risk, risk changes policy, policy changes what the agent is allowed to do. Hayete Gallot, Microsoft's security EVP, gave The Verge the blunter version: frontier models, regardless of their origin, cannot be trusted.
The same day Claude Code 2.1.304 added a way for a mod to mark a tool call as decidable only by a person, and Mercury's fintech MCP server moved from read-only to request-then-approve with five-minute expiry. Three vendors, one week, one design: authority lives outside the model and the human-only path is a first-class primitive. This site has been counting windows on the agent-authority thread since August and calling it the missing layer; the count stops mattering when the biggest enterprise vendor ships it with SKU names.
Politico's story from Thursday is the policy half, and the primary is now readable. Anthropic has been quietly pitching its own federal AI safety bill to lawmakers. The draft would let the government block a model's release or use only if it poses a foreseeable, imminent risk of more than $1 billion in damages or of killing or seriously injuring more than 50 people, and the risk must stem from the creation or release of a biological weapon, the model evading its developer's controls, or a cyberattack. The language mirrors California's SB 53. An Anthropic spokesperson told Politico the bill represents the proposals in the company's Advanced AI Framework, advocated since June, and called them sensible policies Congress should act on. Tom's Hardware's paraphrase adds a 72-hour evaluator report to Commerce and a DC district court review, which this site could not confirm against the draft. The HN thread on it ran to 160 comments split on whether 50 deaths is a floor that makes the bill toothless. The notable part for this audience is the second trigger: a model evading its developer's controls is now proposed statutory language, from the lab that published the June misalignment reports and gave METR employee-level access last week. Microsoft is selling the controls; Anthropic is proposing what happens when they fail.
Links: https://www.microsoft.com/en-us/security/blog/2026/10/19/agents-are-your-newest-insiders-security-must-move-at-their-speed/ , https://www.theverge.com/news/1013838/microsoft-frontier-models-cannot-be-trusted , https://www.politico.com/news/2026/10/16/anthropic-ai-safety-01124654 , https://news.ycombinator.com/item?id=50141429
Comments