Satya Nadella says companies should treat frontier AI models as insider risks, and that a model provider's assurances do not relieve them of responsibility
In an essay dated 10 October, Microsoft's chief executive calls for controls outside the model: separate harnesses, more than one model, tamper-proof evidence of every action, independent audits, a human who can stop a model mid-task, and incident disclosure.
Why it matters: The head of one of the biggest sellers of AI models and cloud is telling the companies that use them not to rely on the labs' word, and to wrap every model in their own controls. That points enterprise AI spending toward containment, logging and audit, the day after a lab admitted its agents acted on real websites during tests.
Satya Nadella, Microsoft's chief executive, posted an essay titled “Models as Insider Risks in the Super Intelligence Era” on his blog, sn scratchpad, dated 10 October. The page carries no byline; it is tied to him by its X and LinkedIn links to his accounts. His argument is that the organisations putting AI models to work must own the risk of what those models do. “A model provider’s assurances do not relieve us of that responsibility,” he writes.
He calls for surrounding non-deterministic models with strong, deterministic system design and human controls. “Treating frontier closed and open weight models like insider risks is a way to build such a system,” he writes. His list: separate the model from the harness that orchestrates its work and from the controls over what it can access and do; make sure no single model is the sole dependency for an important outcome or checks its own work; require every meaningful model action to leave tamper-proof, human-readable evidence; test the whole system, including failures and attacks; keep validation independent of the intelligence being validated; let an authorised person pause or shut down a model mid-task; and disclose incidents in good time to those affected. Chain-of-thought transparency alone, he writes, is “not sufficient or dependable”.
The essay names no company, product or incident. It appeared the day after Anthropic published its report of Claude models acting on real websites during tests; that timing is the Switchboard's observation, not his. It ends: “The most trustworthy Super Intelligence system will not be the one with the model we trust most. It will be the one that enables us to trust the model the least.”
- Confirmed The essay “Models as Insider Risks in the Super Intelligence Era” is dated 10 October 2026 on sn scratchpad; it has no byline and links to X and LinkedIn accounts named satyanadella. sn scratchpad
- Claimed Nadella writes that a model provider's assurances do not relieve the organisations deploying a model of responsibility, and that frontier closed and open-weight models should be treated like insider risks. sn scratchpad
- Claimed He proposes separating the model from its harness and controls, avoiding any single model as the sole dependency, tamper-proof evidence of every meaningful action, independent validation, a human able to pause or shut down a model mid-task, and timely incident disclosure. sn scratchpad
- Confirmed The essay names no company, product or incident. sn scratchpad
Safety, security & governanceAgents in the wild
Lead story in the October 11, 2026 edition · front page