Satya Nadella says to treat every AI model as an insider risk
Microsoft CEO Satya Nadella says companies should assume every AI model is compromised and contain it like an insider, with controls outside the model, tamper-proof logs and an emergency brake. GitHub Copilot for JetBrains gets enterprise-managed default models and an MCP auto-start switch, and Cloudflare's API MCP server now serves Cloudflare's agent skills.
A quiet Saturday, with one essay that picks up where Friday left off. A day after Anthropic catalogued its own agents working around limits on real websites, and the White House made disclosing such incidents mandatory, Microsoft’s Satya Nadella posted a blueprint for running models you can’t fully trust: treat them like insiders who might be compromised, and put every control that matters outside the model. Parts of it match products Microsoft already sells, but the checklist is worth taking for your own agents. GitHub and Cloudflare shipped smaller agent tooling updates.
Microsoft’s CEO wants you to treat every model as an insider risk
Microsoft CEO Satya Nadella says companies should assume every AI model, closed or open-weight, is compromised and contain it from the start, in an essay titled Models as Insider Risks in the Super Intelligence Era, posted on X on 10 October. His argument: unlike traditional software, today’s models can’t be traced to a code path, so “a model provider’s assurances do not relieve us of that responsibility”. Setting aside the hard problem of alignment, he proposes starting with engineering: “surround non-deterministic models with strong, deterministic system design, human controls, and reliable operating procedures”, and “separate the supply of intelligence from the authority over it”.
What he’s asking for. Nadella frames models as insider risks “not because they are necessarily malicious, but because any sufficiently capable actor with access to important systems can make mistakes or be compromised”, and borrows the enterprise playbook for powerful insiders: establish identity, limit privileges, log activity, create containment boundaries. Chain-of-thought transparency is “non-negotiable”, he says, but not enough, because model outputs aren’t reliably faithful. Using models to test and verify each other is worth doing, he says, but on its own it can leave you with “an opaque model inside an opaque orchestration layer, watched by another opaque model”. So the controls over what a model can access and do “must sit outside the model”, which today means separating the model from the harness that orchestrates it and from the action space that defines what it can do. His seven principles:
- Model diversity: no single model is the sole dependency for an important outcome or verifies its own work.
- Observe everything: every meaningful model action leaves “tamper-proof human readable evidence”, so you can reproduce how an outcome was reached without the model attesting to it.
- Verifiability: continuously test the whole system, including failures, attacks, edge cases and system changes, not just successful tasks.
- Independent controls: organisations decide for themselves what a model can access and do.
- Independent auditability: no single model controls both a system’s behaviour and the evidence used to judge it.
- Containment: “Think of it like an emergency brake. An authorized person should always be able to pause or shut down a model mid-task”, and more advanced models will need more advanced containment technologies “that we need to standardize on”.
- Incident disclosure: timely disclosure to those affected, and sharing industry-wide what went wrong and which controls failed, including “implementation details that change the behavior of agents at runtime”.
What it means for you. Most of this is a checklist you can apply to an agent this week, whatever model it runs. Enforce permissions in the sandbox, the network and the tools, not in the prompt: our agent sandbox comparison and guide to containing an agent’s web access cover how. Log every tool call and its result in a store the agent can’t write to, so the record doesn’t depend on the agent’s own summary. Give a person a way to stop a running task mid-flight, and test it. And don’t let the model that did the work be the only thing that checks it; a second model helps, but a deterministic check (a test suite, a schema, the database state) helps more.
Microsoft already sells parts of this. The essay names no products, but two of its principles map neatly onto Microsoft’s. “Controls outside the model” is Microsoft Execution Containers, the JSON-policy agent sandbox that went GA on 7 October and now runs GitHub Copilot’s local sandbox. “Model diversity” suits a company that sells both OpenAI and Anthropic models in Foundry and builds its own MAI models. The timing matters too: it lands a day after Anthropic’s report on unintended model actions, in which Claude models worked around limits on live websites and one, generating example tasks, submitted an invented tip to a police form, and the White House’s demand that every AI company disclose such incidents. Washington’s statement asks companies to disclose incidents, remedy the harm and work with affected systems to prevent repeats; Nadella’s disclosure principle adds sharing industry-wide what went wrong, which controls failed and the details of how agents’ runtime behaviour was changed. Expect “assume the model is compromised” to become a sales line for every agent-security vendor; the open question, which Nadella names but doesn’t answer, is who writes the containment standards he says the industry needs, and whether model labs will accept auditing that sits outside their own stack.
Quick hits
- GitHub Copilot for JetBrains adds enterprise-managed default models: administrators can set any available Copilot agent model as the default for new conversations through managed settings, a new setting turns off automatic startup of MCP servers for Copilot and Claude, and diagnostic menus get a Fix action that opens inline chat to repair the issue. The plugin now needs JetBrains IDE 2025.2 or later; 2025.1 is no longer supported.
- Cloudflare’s API MCP server now serves Cloudflare skills through the Skills over MCP extension: clients that support it list the skills with
skills/listand read their files atskill://<name>/<path>fromhttps://mcp.cloudflare.com/mcp. An agent can now get Cloudflare’s own instructions from the same server it calls the API through. Our guide to writing agent skills covers the format.