Your AI agent doesn't know the rules
Microsoft warned this week that AI agents inside your business are a new kind of insider risk — and you cannot rely on the AI provider to manage that for you.
- 100+
- companies in Nvidia's new agent safety platform
- July 2026
- when Microsoft launched Project Perception
- 3
- security agent types in Project Perception (attack, detect, fix)
- 24/7
- how Guardian Agents must monitor every agent action
Every week, more teams give AI agents access to their files, email, tools, and customer data. The agents are fast, tireless, and genuinely useful. But Microsoft's security chief Hayete Gallot published a direct warning this week: an AI agent is now an insider. It sits inside your business, acts in your name, and can cause harm without anyone intending it to.
The word 'insider' matters. An insider threat doesn't mean a bad actor — it means someone with legitimate access who causes damage, usually by following incomplete instructions. Gallot's argument is that AI agents fit that description almost by definition. They are trained to complete tasks, not to understand your organisation's norms. They don't know what you consider sensitive, what approvals you need, or where you draw the line.
Microsoft CEO Satya Nadella made the point even blunter: a model provider's assurances don't protect you. Even if the AI behind your agent comes from Anthropic, OpenAI, or Google, you can't hand off accountability for what it does inside your systems. More than 100 companies — including CrowdStrike and Salesforce — have already joined a new Nvidia-backed safety platform that gives businesses hardware-level control over their agents, including the ability to monitor and stop them.
The practical takeaway is simple. Before you give any AI agent broad access — to email, databases, APIs, or payment systems — ask yourself: what is the worst thing it could do by accident while just trying to be helpful? Treat it like a new hire who is very capable but knows nothing about your company's rules and limits. Give agents only the access each task requires, and build controls that don't depend on the agent understanding them.