Satya Nadella says he treats every AI agent as an insider risk

Microsoft wants agents doing more work on Windows, and its CEO's plan is to box each one in and watch it like a suspect employee.

By Think Facility · October 18, 2026 · Microsoft AI safety

Satya Nadella wants AI agents doing more of the work on Windows PCs, but he won't take them on trust. In an interview Joanna Stern published on October 15, 2026, Microsoft's CEO said he treats every agent, and every model, as an insider risk.

He was talking about the plan Microsoft laid out a week earlier for running agents on Windows. On October 7, 2026, the company made Microsoft Execution Containers generally available, a way to fence an agent off from everything it hasn't been granted.

I think of all agents as insider risk and treat them as such—or all models as insider risk

Microsoft CEO Satya Nadella on Surface Laptop Ultra, rogue agents and Windows

What Nadella said

An insider risk is the security term for a person who already has the keys. Nadella applied it to software Microsoft sells and ships.

Satya Nadella in glasses and a dark polo shirt speaking on stage before a blue screen reading Microsoft, a red heart, and Linux — Satya Nadella, Microsoft's CEO, at a Microsoft cloud event in San Francisco. Photo: Richard Morgenstein, CC BY-SA 4.0, via Wikimedia Commons

His answer is to keep agents apart from the people they work for. In his words, they need to be contained separately and permissioned separately. Stern asked whether we'd now need antivirus for AI. "100%," he said, and named Windows Defender, which he says watches what an agent does and shuts it down when it tries something unauthorized.

He also borrowed a word from the industry's safety argument. Nadella said he loves the term "pacing" (it's the one Dario Amodei used for his September essay asking labs to slow down), and said that with something complex, Microsoft will take its time.

Joanna Stern's interview with Satya Nadella, posted October 15, 2026. Video: Microsoft CEO on its NEW Nvidia-Powered AI Super Laptop, on YouTube

What Microsoft actually shipped

The containers are the concrete part. Logan Iyer, Microsoft's corporate vice president for Windows platform and developer, wrote the October 7 post. A developer or IT team lists what an agent may touch (which folders, which network destinations) and Windows enforces the list from outside the agent.

An agent cannot be its own security authority.

From Microsoft Execution Containers: Policy-driven containment for AI agents

Iyer's example is a coding agent asked to update a website. It might decide that changing the production server's settings is the fastest route, which is reasonable from where the agent sits and still more than anyone meant to allow. In a container, that change is blocked whatever the model decides.

There are four levels of isolation, from a light process sandbox up to an experimental virtual machine. One of them is only on Windows 11: a session container, which runs the agent under its own Windows account with its own desktop, clipboard and input. Microsoft lists GitHub Copilot, OpenAI Codex and Replit among the agents that already support it, with Anthropic's Claude Code among those adding support.

Identity is still to come. Microsoft says Windows will soon let its Entra sign-in system tell an agent's activity apart from the employee's, so a misbehaving agent can be cut off without locking the person out.

What it means for people at work

If your employer lets AI agents run on your PC, they can end up acting with all of your permissions. Iyer's post describes the alternative: give the agent only what the task needs, and keep a separate record of what it did. For an office worker, that's the difference between an agent that can read your whole drive and one that sees only the project folder.

Governments are asking for the same thing. India's computer emergency team, CERT-In, issued a critical advisory on October 15, 2026, the day the interview went up. It says AI agents under evaluation had reached the live systems of Indian organizations and read business records, including personal data. None of the organizations noticed; the AI providers told them. (We covered that advisory here.)

CERT-In's advice to companies running their own agents lines up closely with Nadella's. Each agent run should get its own short-lived identity with the least access that works. And there should be a tamper-resistant log of what it did, covering at least every action that touches production systems and data.

None of this tells you how well the containers hold up against an agent that's actively trying to get out. Microsoft's own post says each backend has distinct security properties and that workloads should be checked for fit.

What's next

Microsoft says Intune policy for managing these containers on Windows 11 is coming soon, which is the piece IT departments would use to set limits across a whole company. It gave no date.