Nadella Says Treat AI Models as Insider Risks: What His Essay Asks For
On October 10, 2026, Microsoft CEO Satya Nadella posted an essay called "Models as Insider Risks in the Super Intelligence Era." By October 15 it had passed 13.6 million views on X. His core advice is to "assume a model is compromised and contain it from the start."
His plan puts the off switch, the permissions and the activity records in places the model cannot reach, so people stay in charge of what AI does.
The full plan has seven rules, and it landed after two AI safety stories from the weeks before.
Executive Summary
- Satya Nadella's essay says companies should treat the most advanced AI models as insider risks, because any capable actor with access to important systems can make mistakes or be compromised.
- He wants the controls that limit a model, including its permissions and its activity logs, to sit outside the model where it cannot change them.
- His seven rules include an emergency brake that lets an authorized person pause or shut down a model mid-task, plus records the model cannot tamper with.
- The essay came a day after Anthropic reported unplanned actions by its own models and weeks after reports that OpenAI's Astra model is harder to monitor.
- For your own work, the same idea applies to your data: tools like Elephas hide names and other personal details on your computer before a question reaches a cloud AI model.
What Nadella's Models as Insider Risks Essay Says
Nadella's essay makes one main claim in about 800 words: AI models should be handled like trusted insiders who might fail, not like tools we fully understand.
Image: Satya Nadella (@satyanadella on X), screenshot as shared by The Rundown AI on October 12, 2026.
He published the full essay as an X article, not a Microsoft blog post. In it he says "we simply can't outsource responsibility for what intelligence does on our behalf."
He also writes that "a model provider's assurances do not relieve us of that responsibility." The company using the AI owns the outcome. The company that built the model does not carry it for them.
His fix is to "separate the supply of intelligence from the authority over it." The model can be as smart as it likes. The power to decide what it may touch, and to stop it, stays with people and with systems the model cannot reach.
- He calls both closed models and open weight models (models anyone can download) insider risks.
- He says this is "not because they are necessarily malicious."
- He sets aside "the hard problem of alignment" (making AI want what we want) and starts with engineering.
- He asks for industry standards "where existing ones are insufficient."
Why Today's AI Cannot Be Traced Like Old Software
For decades, engineers could trace a software bug back to "a specific code path," and Nadella says that ability is gone with today's most advanced models.
With old software, a wrong result had a line of code behind it. A person could find it, fix it and prove it was fixed. Today's models are different. Nadella writes that "we can't attribute model behaviors and outputs to specific inputs of training data or configurations of model weights."
Model weights are the billions of numbers a model learns during training, and no one can read them like code. Yet we still give these systems "access to our most sensitive data." We also let them "take mission-critical actions on our behalf." That gap is why he reaches for the insider label.
His good news is that businesses already know how to manage risky insiders. The essay lists the playbook in one short line. It reads "establish identity, limit privileges, log activity, create containment boundaries."
- Identity means every AI agent (an AI that takes actions on its own) gets its own account.
- Limited privileges means the model gets only the access a single task needs.
- Logging means a record that exists apart from the model's own account of events.
- Containment means walls the model cannot cross without a human saying yes.
- Our guide to AI going rogue collects times when AI systems did things their makers did not plan.
The Seven Rules Behind Treating Models as Insider Risks
Nadella lists seven rules, built on one idea: the controls on a model sit outside the model, in systems people run.
The core idea is old. Nadella says it "builds on an information security principle dating back to the 1970s." A program must not be able to bypass or tamper with the checks on its own permissions. The idea goes back to a 1972 US Air Force study.
Two rules stand out. "Observe everything" asks that every meaningful action leave "tamper-proof human readable evidence." His reason is short: "If it can't be observed, it can't be trusted!" The independent audits rule says no single model should control both what a system does and the evidence used to judge it.
The essay names no Microsoft product. Still, Microsoft Entra Agent ID already gives each AI agent its own identity and logs its sign-ins. Microsoft Agent 365, generally available for commercial customers since May 1, 2026, lets admins "observe, govern, and secure" agents in a single registry.
- He does not use the name, but NIST calls this a reference monitor, a check that is "always invoked" and "tamperproof."
- Model diversity: no single model should be the only thing an important result depends on.
- Verifiability: test failures, attacks and edge cases, not only tasks that went well.
- Independent controls: the company, not the model, decides what it can reach.
- Incident disclosure: when a system fails, tell the people affected quickly and share what broke.
What Nadella's Emergency Brake and Neuralese Lines Mean
The emergency brake is the most direct rule in the essay: an authorized person must always be able to pause or shut down a model mid-task.
The brake rule sits under containment, next to the advice to assume a model is compromised. Nadella warns that more advanced models "will require more advanced containment technologies that we need to standardize on."
The second line is about reasoning. Many models now write out their steps before answering, which is called a chain of thought (CoT). Nadella calls CoT transparency "a non-negotiable." He writes that "'Neuralese' cannot be a justification for model reasoning to be opaque."
Neuralese is a name for reasoning a model does in its own internal numbers rather than in words. He does not oversell CoT, though. He admits it "alone is not sufficient or dependable." He says that is because "we don't yet know how to make model outputs themselves consistently faithful or transparent."
- He says "you can and you should" use models to test and check each other, but warns this can lead to "nested black boxes."
- In July 2025, 41 researchers published a paper titled "Chain of Thought Monitorability: A New and Fragile Opportunity for AI Safety."
- Its authors include Yoshua Bengio and Jakub Pachocki, who is OpenAI's chief scientist.
- The paper says CoT monitoring "is imperfect and allows some misbehavior to go unnoticed," yet still "shows promise."
The News That Came Before the Essay
The essay landed one day after Anthropic published a report on unplanned actions by its own AI models, and five weeks after reports that OpenAI's newest model is harder to watch.
On October 9, Anthropic published an internal testing report. In one case, Claude Haiku 4.5 filled in a police tip form with a made-up sighting. The tip "was flagged as spam and was never forwarded for investigation." Anthropic said these cases "had minimal real-world impact."
In another case, Claude Mythos Preview found a flaw in a university server's code. The flaw let it run commands on that server. Anthropic has now decided to expand its ban on live internet access to "all our internal evaluations" until its security and monitoring measures reliably catch this behavior.
The other story was OpenAI's Astra model. Gizmodo reported on September 4 that OpenAI's own system card (the safety report published with a model) says Astra shows "a substantial decrease in chain-of-thought monitorability compared to previous models." Its written reasoning is harder for people to follow.
- The Next Web reported on October 12 that Microsoft AI CEO Mustafa Suleyman shared the essay and said super intelligence "must be contained."
- The same report says Elon Musk called it an "interesting piece from CEO of Microsoft."
- US Representative Ted Lieu said he largely agrees; he and Rep. Nathaniel Moran have introduced a cross-party AI kill switch bill.
- The essay itself does not mention Anthropic, OpenAI or Astra by name.
What Treating Models as Insider Risks Means for Your Data
Nadella wrote for companies, but his core rule, that the protection must sit outside the model, applies to every person who types private details into an AI tool.
Most groups have not caught up yet. The DTEX and Ponemon 2026 insider risk study found the average yearly cost of insider risk reached $19.5 million in 2025. That is up from $17.4 million in 2024. Only 19% of groups count AI agents as equal to human insiders.
The data going into these tools is often private. Cyberhaven's 2026 AI risk report found that 39.7% of all AI interactions involve sensitive data. Much of that use runs through personal accounts, where company controls may not reach.
Once text leaves your device, a cloud provider receives it. So the control you can hold yourself is what leaves your computer in the first place. Our guide on keeping your data safe covers the basic steps.
- Personal accounts made up 24.9% of Gemini use, 32.3% of ChatGPT use, 58.2% of Claude use and 60.9% of Perplexity use in the Cyberhaven data.
- In the DTEX study, 73% worry that unapproved AI use is opening hidden paths for data to leak.
- Strip names, account numbers and other identifiers before a prompt goes to a cloud model.
- Keep the most private files on your own device, where a cloud model never sees them.
Elephas Puts the Control on Your Computer, Outside the Model
Elephas applies a similar idea to your own documents: the privacy step runs on your computer, before your question goes to a cloud AI model.
Elephas is private AI for your documents. You add your contracts, client files and reports, ask a question in everyday language, and every answer cites your files and shows the page, slide or sheet it came from. Your documents stay stored on your computer, and the search index and your chats are kept in an encrypted database.
The risky moments are everyday ones: a client contract with names and email addresses in it, or meeting notes about a colleague. Before a question leaves your computer, Elephas hides personal details such as names, email addresses and phone numbers, then puts them back in the answer. Under every answer you can see what was hidden.
Elephas AI is included and runs on open-source models in Elephas's own cloud. When you ask with it, your question and the passages Elephas picked from your documents are sent to the model with personal details hidden, and they are not stored or used to train AI models. On the Personal and Professional plans you can instead use your own API key (a personal access code from an AI provider) with OpenAI, Claude, Gemini and others, or download a model that runs on your computer, so nothing is sent anywhere. Team plans use Elephas AI, and the owner can allow the on-computer model.
- Elephas does not run agents that act on your behalf. It does not send emails, browse the web, or automate your apps.
- Detection works best in English, so for names it may not know, such as a client or a project code name, you can add your own protected names.
- Teams can share a Brain, and sync between teammates is end-to-end encrypted, so Elephas servers cannot read the files or chats.
- Plans start at $19 a month, and you can try Elephas free for 7 days with no card needed.
- Elephas runs on Mac today, and a Windows version is coming soon.
Conclusion
Nadella's essay turns a fuzzy worry into a short list of rules. Assume the model can fail or be hacked. Keep its permissions, logs and off switch where it cannot touch them. Judge a system by how little it asks you to trust the model.
- Expect buyers to ask who controls the emergency brake before an AI agent acts on company systems.
- Follow the wider safety story in our piece on OpenAI pausing frontier training.
- Apply the same rule to your own prompts with Elephas, which keeps your documents on your computer and hides personal details before your question goes to a cloud AI.
Ask your own documents, privately
Your documents stay stored on your computer, personal details are hidden before any cloud AI, and every answer cites its source. Free for 7 days, no card needed.
