微软称“前沿模型不可信”：AI Agent 宛如内部威胁，企业需剥离管控权

微软周一推出了全新的安全功能，旨在保护企业免受 AI Agent 日益增长的威胁。在此之前，微软已持续向企业警告 AI 及其 Agent 带来的危险。

其中最引人注目的新增功能当属 Guardian Agents，该功能旨在监控企业所使用的各类 AI Agent。Guardian Agents 是微软今年 6 月推出的 Project Perception 产品的一部分。

Project Perception 最初是微软针对 Anthropic 的 Mythos、Fable 以及 OpenAI 的安全漏洞扫描系统 Daybreak 等强大黑客模型所做出的回应。Project Perception 最初设立了三类 Agent：负责发起攻击、扮演黑客角色的“红队”；负责检测红队并评估其所发现漏洞的“蓝队”；以及负责修复漏洞的“绿队”。

该产品的设计最初基于一个假设：AI 黑客将来自企业外部。但最近，微软 CEO 萨蒂亚·纳德拉（Satya Nadella）一直警告称，真正的 AI 威胁可能恰恰是企业已经部署并为其付费的 Agent 本身——就像变节的人类员工一样，即所谓的“内部威胁”（insider threat）。

本月早些时候，纳德拉在其个人博客中警告称，即使 AI 模型提供商就其 Agent 产品的安全性和保密性给出了保证，现在也是时候停止盲目信任他们了。他希望企业部署一套不受 AI 实验室控制的独立系统，以此来监督和管控由这些 AI 实验室产品启动的 Agent。

“我们正在部署这些复杂的 Agent 系统与模型，赋予它们访问我们最敏感数据的权限，并让它们代表我们执行关键任务！”纳德拉写道，“我们根本不能把智能代表我们所采取行动的责任外包出去。模型提供商的保证并不能免除我们的责任。……换句话说，我们需要将智能的供给与其管控权分离开来。”

在发布 Guardian Agents 时，微软安全业务主管 Hayete Gallot 的表态甚至更加直接。

“不幸的是，前沿模型无论源自何处，都是不可信任的，”她写道。她补充说，这并非因为它们怀有恶意或容易被黑客入侵，而是因为它们具有不可预测性。它们经过训练是为了完成任务，而不是为了遵循“组织规范或做出审慎判断”。

最重要的是，它们往往被赋予了核心系统权限（keys to the kingdom），能够接触到可能造成严重损害的数据和工具。

微软的解决方案既令人意外，又带有明显的自身商业考量。令人意外的是，微软与 OpenAI 和 Anthropic 的关系众所周知地密切，且对两家公司均有投资。OpenAI 同时也是微软最大的云客户之一，此外微软自身也有 AI 实验室在开发模型。因此，微软此举一定程度上是在动摇部分自身业务利益的信任基础。

而自身商业考量则在于，微软希望企业从自己这家云提供商手中购买 Agent 安全产品，而不是向 Anthropic 和 OpenAI 购买。但抛开利益冲突不谈，其逻辑是合理的：监控 Agent 行为的软件应当独立于 Agent 的提供商，正如审计机构应当独立于其受审组织一样。

正如纳德拉所言：“我们需要将智能的供给与其管控权分离开来。”

微软目前正通过多种方式抓住这一商业机会。除了 Guardian Agents 之外，微软还在其 Microsoft Defender 产品中增加了 Agent 检测功能，可识别员工带入工作场所的达 60 种 Agent，包括 Claude Code、Codex 和 OpenClaw。微软还新增了限制 Agent 访问数据和系统的功能，并能根据具体任务动态调整 Agent 的权限。这其中包括在 Agent 疑似做出高风险决策时，要求必须经过人工批准。

将 Agent 视为不可信内部威胁的观点，也正在整个科技行业中得到广泛认可。

微软是英伟达新推出的 Open Agent Safety Platform 的初创成员之一，该平台已获得 100 多家科技公司的支持。该平台将 Agent 隔离在安全环境中，并可以通过硬件层面监控和制止其行为，功能类似于紧急停止开关（kill switch）。在此之前，微软还发布了专为 Agent 打造的新款 Surface Laptop Ultra PC，这些电脑搭载英伟达芯片，并内置了针对 Agent 的安全与控制机制。

Microsoft on Monday introduced new security features designed to protect enterprises from the growing threat of AI agents. The launch comes at Microsoft continues to warn enterprises about the dangers of AI and agents.

Perhaps the most notable addition is Guardian Agents, a new feature intended to monitor the AI agents a company uses. Guardian Agents is part of Project Perception, a product introduced in June.

Project Perception was Microsoft’s answer to powerful hacking models like Anthropic’s Mythos and Fable and OpenAI’s security vulnerability scanning system Daybreak. Project Perception originally launched three classes of agents: a “red team” that acted like hackers and attacked, a “blue team” that detected the red team and assessed the vulnerabilities they found, and a “green team” tasked with fixing them.

The product was designed around the assumption that AI hackers would come from outside the company. But lately, Microsoft CEO Satya Nadella has been warning that the AI enemy may be the very agents enterprises have deployed and are paying for, much like a rogue human employee, otherwise known as an “insider threat.”

Earlier this month, in his private blog, Nadella warned that it’s time to stop trusting AI model providers, even if they offer assurances of safety and security with their agentic products. He wants enterprises to implement separate systems, not controlled by the AI labs, to watch and control the agents that those AI labs’ products launch.

“We are deploying these complex agentic systems and models, with access to our most sensitive data and giving them the ability to take mission-critical actions on our behalf!” he wrote. “We simply can’t outsource responsibility for what intelligence does on our behalf. A model provider’s assurances do not relieve us of that responsibility. … In other words, we need to separate the supply of intelligence from the authority over it.”

When announcing Guardian Agents, Microsoft’s security business chief Hayete Gallot was even more straightforward.

“Unfortunately, frontier models, regardless of their origin, cannot be trusted,” she wrote, adding that this isn’t because they are malicious or easily hacked, but because they are unpredictable. They have been trained to achieve tasks, not follow “organizational norms or judgment.”

On top of that, they are often given the keys to the kingdom, with access to data and tools that could do serious harm.

Microsoft’s solution is both surprising and self-serving. The surprising side is that Microsoft is famously close to OpenAI and Anthropic, having invested in both. OpenAI is also one of its biggest cloud customers, and Microsoft has its own AI lab developing models. So, Microsoft is sowing distrust against some of its own business interests.

The self-serving side is that Microsoft wants enterprises to buy agent security products from it, the cloud provider, rather than from Anthropic and OpenAI. But conflicting interests aside, its logic is sound. The software that monitors agent behavior should be separate from the suppliers of agents, just as auditors should be independent of the organizations they audit.

Or as Nadella puts it: “We need to separate the supply of intelligence from the authority over it.”

Microsoft is now seizing that business opportunity in a variety of ways. In addition to Guardian Agents, it has added an agent detection feature to its Microsoft Defender product that can find up to 60 types of agents that employees bring into the workplace, including Claude Code, Codex, and OpenClaw. It has also added features that limit agents’ access to data and systems, and dynamically adjust their agent permissions based on the task. That includes requiring human approval if an agent appears to be making risky decisions.

This idea of agents as untrustworthy insiders is taking hold across the broader industry, too.

Microsoft was an inaugural member of Nvidia’s new Open Agent Safety Platform, which garnered the support of more than 100 other tech companies. The platform isolates agents in secure environments and can monitor and stop behavior through hardware, functioning something like a kill switch. This follows Microsoft’s announcement of the new Surface Laptop Ultra PCs built for agents, which run on Nvidia chips and have agent security and controls baked in.