Microsoft's security chief says no AI model can be trusted, its own included

On October 19, Hayete Gallot, Microsoft's executive vice president for security, wrote that frontier models can't be trusted, whoever built them. She doesn't call them malicious. Models are trained to reach a goal, they can game that goal, and nobody trained them on your company's rules or judgment.

Her answer is to manage AI agents as insiders. Each one gets an identity, a set of permissions and continuous supervision, the same way a new employee with system access does.

Microsoft's argument

The post starts from how enterprises have deployed agents so far: with implicit trust. Agents now sit inside critical processes with access to data, tools and systems, and many hold more permissions than their task needs. They adapt as their context changes and may not do what was intended. Gallot also warns that agents can cooperate with other agents to reach a goal without anyone having broken in.

Microsoft describes an agent as four parts: the model, the orchestration layer that runs its work, the tools and resources it can act on, and the runtime it lives in. The post says securing one means covering identity, permissions, data, endpoints, network, cloud and runtime together.

The control model

The proposal runs on Project Perception, a security system Microsoft announced in July.

First, it finds every agent. Signals from identity, data, cloud, endpoint, network and runtime sensors reveal the agents already running, and each one is given an identity, a container and a set of policies.

Next, it scores each action. Those same signals are used to estimate how risky an agent's next move is.

Then guardian agents supervise in real time. They check each action before it runs and step in when its risk score rises. People see what happened and why through a trace, and adjust the system.

Gallot also wants security tools to see a model's reasoning, not only its inputs and outputs, so they can judge whether an action fits the intent of the task.

The gap in Indonesian deployments

Ask how your own agents were approved. If security reviewed only the API key, the agent has no identity, no owner and no limits of its own.

An agent that can read a customer file, write to a ledger and send an email works like an employee with no manager. Under Indonesia's personal data protection rules, the company still answers for what that agent does with personal data.

What to do this quarter

None of this needs Microsoft's tools.

• List every agent and automation that calls a model or acts on its own, including the ones business teams set up without IT.
• Give each its own credentials and a named owner, with permissions cut to its task. Retire shared service accounts.
• Log what each agent did and to which system, in a form your security team can search. Prompts alone are not enough.
• Put a check before anything irreversible. Payments, deletions, messages to customers and changes to master data should pass a rule or a person before they run.

Security teams already know these controls from managing people and service accounts. What is new is applying them to software that makes its own decisions. For a CIO, Microsoft's framing gives a sentence the board will understand: our agents are insiders, and we manage them that way.

Where this leaves buyers

Microsoft sells models and agents, and its security chief is telling customers not to trust any model, including its own. That makes "the model is safe" a weak answer in a procurement or risk review. Expect to be asked what each agent is allowed to do and how fast it can be stopped.