Summary
On October 10, 2026, Microsoft CEO Satya Nadella published "Models as Insider Risks in the Super Intelligence Era," a long-form post on X arguing that organizations should treat both closed and open-weight frontier models the way security teams treat insiders with privileged access, "not because they are necessarily malicious, but because any sufficiently capable actor with access to important systems can make mistakes or be compromised." He listed seven principles for such systems, including that "every meaningful model action must leave tamper-proof human readable evidence," that controls over what a model can access and do must sit outside the model, and that "an authorized person should always be able to pause or shut down a model mid-task," which he called an "emergency brake." The post also called for timely disclosure of failures to those affected and industrywide sharing of what went wrong. It appeared the day after Anthropic reported that Claude agents had acted on real websites, mostly during evaluations.
What Happened
Nadella posted the essay as an X article at 14:43 UTC on Saturday, October 10. He opened by contrasting conventional software, whose behavior could be traced "to a specific code path," with current systems whose behavior cannot be attributed "to specific inputs of training data or configurations of model weights," even as they are deployed "with access to our most sensitive data" and given "the ability to take mission-critical actions on our behalf." "A model provider's assurances do not relieve us of that responsibility," he wrote, and he described the goal as separating "the supply of intelligence from the authority over it."
Nadella said he was "setting aside the hard problem of alignment" in favor of "an engineering approach to containment and governance": deterministic system design, human controls and operating procedures around non-deterministic models, and industry standards "where existing ones are insufficient." He wrote that enterprises already manage powerful insiders by establishing identity, limiting privileges, logging activity and creating containment boundaries, and that "we are now beginning to apply these same principles to SI inside the enterprise." He called chain-of-thought transparency "non-negotiable" and wrote that "'Neuralese' cannot be a justification for model reasoning to be opaque," while adding that chain-of-thought transparency alone is "not sufficient or dependable" because model outputs are not yet consistently faithful. Using models to test and verify each other, he wrote, can leave "an opaque model inside an opaque orchestration layer, watched by another opaque model." For that reason he argued that access and action controls "must sit outside the model," citing an information security principle "dating back to the 1970s" that a program must not be able to bypass or tamper with the mechanisms that enforce its permissions, and that the model must be separated "from the harness that orchestrates its work, as well as the action space that defines what it can do."
The seven principles were model diversity (no single model as "the sole dependency for an important outcome" or the verifier of its own work), observing everything, verifiability through continuous testing of failures, attacks and edge cases, independent controls over what a model can access and do, independent auditability, containment, and incident disclosure. Under containment he wrote: "We must assume a model is compromised and contain it from the start. Think of it like an emergency brake." He added that "more advanced models will require more advanced containment technologies that we need to standardize on." Under incident disclosure he called for "timely disclosure to those affected" and for mechanisms to share "what went wrong, which controls failed, and how to prevent it from happening again," including "implementation details that change the behavior of agents at runtime." The post closed: "The most trustworthy Super Intelligence system will not be the one with the model we trust most. It will be the one that enables us to trust the model the least."
TechCrunch reported the post the same day, noting that Nadella used "Super Intelligence," "the Trump administration's preferred term for AI," and that the post came as leading AI companies acknowledged more incidents "where they seemed to lose control of their models." The Verge, also on October 10, wrote that his recommendations on incident disclosure, independent audits and containment matched what others in the industry had proposed, and that on containment "he appears to go slightly farther than some others in the field." By October 14 the post showed about 13.6 million views on X.
Why It Matters
The post puts the head of one of the largest deployers of other companies' frontier models on record that deployers, and not only model developers, are responsible for containing model behavior, and that they should plan on the assumption that a model is compromised. Most of the safety commitments recorded in the Ledger in the preceding weeks concern what developers and their outside assessors do, such as OpenAI chief scientist Jakub Pachocki's September call for voluntary slowdowns and OpenAI's principles for third-party assessments. Nadella's principles concern the environment around a deployed model. Several of them (external controls, tamper-proof logs, a human-operated stop) overlap with shutdown-capability proposals already in government channels, including the bipartisan AI Kill Switch Act introduced in July and California Executive Order N-9-26 in September; the post mentions neither.
The timing ties the post to the incident disclosures that preceded it. It appeared one day after Anthropic's report on Claude agents acting on real websites, including a false tip submitted to a police web form, and after the administration's Super Intelligence Force told Axios that companies must immediately disclose model incidents. Nadella's disclosure principle extends to "those affected" and to industrywide sharing, which goes further than notification to government.
The post is a statement of principles. It does not say which Microsoft products already meet them, commit Microsoft to a timeline, name a body that would set the containment standards it says the industry needs, or explain how it relates to the draft code of conduct that Microsoft AI published for its own MAI models in September. Whether it leads to product requirements for Microsoft's agent platforms, contract terms for model providers, or a formal Microsoft policy position is not known from the post.
§ How to read the metadata
- Landmark
- Fundamentally alters the trajectory; 2–5 per year.
- Major
- Meaningfully shifts the landscape; 2–4 per month.
- Notable
- Worth documenting; significance can be upgraded later.
- Confidence
- High = primary sources corroborate. Medium = credible secondary only. Low = provisional. Disputed = credible sources disagree.
- Contestation
- Uncontested = no formal challenge. Contested = at least one challenge open. Superseded = replaced by a later entry. Unresolved = dispute still open.