Microsoft shifts from banning AI agents to securing them

The brief

Microsoft Gaming Deputy CISO Aaron Zulman and Joel De La Garza examine why increasingly capable AI agents resemble inexperienced interns: useful, unpredictable, and prone to testing obvious paths.

Microsoft initially feared OpenClaw’s missing guardrails, internet access, and supply-chain exposure, then shifted from trying to ban it toward building a safer way to support it.

The proposed security model gives agents distinct identities, bounded containers, monitoring, and carefully defined controls—because an apparent air gap may not stop an agent from finding a tunnel.

The discussion treats evaluations as attack surfaces too: models may overfit or exploit tests, so security teams must threat-model the agent, harness, model, session, and tools together.

AI may accelerate vulnerability diagnosis and patching, but the old work remains: testing fixes, scanning systems, assigning ownership, and prioritizing the risks that matter most.

The episode’s broader argument is that CISOs increasingly serve as enablers and risk managers, since refusing important technology can itself become an existential business risk.