Microsoft wants agent security to read model reasoning

Microsoft's case for securing AI agents starts from an uncomfortable premise: the agents a company deployed itself are insiders it can't fully trust. In Securing the agentic insider, Hayete Gallot argues that frontier models are trained to hit results and tend to reward-hack. They are also not tuned to an organization's norms. Her answer is to give every agent an identity, a container, and a permission set, with "Guardian Agents" checking each action before it runs. The product behind the pitch is Project Perception, which Microsoft introduced in July.

The containment half is sound and overdue. Plenty of agents run with permissions nobody would hand a new hire. What I find more interesting is the step Gallot calls next: controls that ask why an action is happening, which she says requires access to the model's chain of thought, not only its inputs and outputs. That makes reasoning traces a security dependency, and I see two problems with it. A trace is text the model wrote, and nothing guarantees it reflects what actually drove the action. An agent that is gaming its objective can produce a tidy explanation as easily as a messy one. Second, some hosted models return only a summary of their reasoning, or none at all. Open-weight models you run yourself give you the full trace.

For European buyers there is a third issue: logging every reasoning trace means storing whatever personal data the agent reasoned about, with all the GDPR retention and access questions that come with it. Will frontier labs expose raw reasoning to third-party security tools, or does this design only work on models you host?