Microsoft CEO Satya Nadella has launched a proposal that shifts the conventional way of thinking about artificial intelligence security. Instead of trusting a model until it fails, he suggests starting from the opposite premise: all advanced AI should be considered compromised from the very beginning.
The idea is gaining traction at a time when several companies in the sector, including Anthropic, have reported episodes of unforeseen behavior in their systems. The debate over how to contain increasingly autonomous models is no longer theoretical, but a matter that is beginning to touch upon real-world cases.
Nadella’s premise: assuming model compromise from the start
Nadella outlined his approach in an extensive message posted on the social network X. According to the executive, the current approach treats artificial intelligence as a set of nested black boxes, where the user simply accepts or rejects what the system proposes.
His alternative reverses that logic. "We must assume that a model is compromised and contain it from the start," wrote Nadella, as reported by the specialized outlet The Verge.
The message does not point to any specific model or describe a specific failure. It is a design rule: build containment before it is needed, not after an incident occurs.
Throughout his explanation, Nadella repeatedly uses the term "superintelligence," which places the debate on systems more capable than current ones—those for which, according to his argument, conventional security measures would be insufficient.
The emergency brake: pausing or shutting down a model mid-task
Nadella's most concrete proposal is the one he himself compares to an emergency brake. He suggests that an authorized person must always be able to pause or shut down a model while it is executing a task, without waiting for it to finish or for the system itself to allow it.
The executive adds a technical corollary: more advanced models will require more sophisticated containment mechanisms, and those mechanisms must be standardized. According to his approach, it would not be enough for each company to design its own system in isolation.
An example helps to understand the scope of the idea. If an artificial intelligence agent manages a business workflow, such as reviewing and sending documents, an authorized manager could interrupt it at any step of the process. The system would also leave a record readable by anyone who needed to review it later.
Independent audits and tamper-proof evidence
Nadella demands that models leave behind human-readable and tamper-resistant evidence. This is the necessary complement to containment: if a system stops or fails, it must be possible to reconstruct what it did and why, without relying on what the model itself claims about its behavior.
His recommendations also include timely disclosure of incidents, independent audits, and the requirement for verifiable data. According to The Verge, many of these ideas coincide with proposals already circulating in the sector. Immediate containment, however, is the point where Nadella seems to go further than other industry players.
The context: recent episodes fueling the debate
Nadella's message comes as the debate over the containment of advanced models becomes more concrete. The Verge frames it within its coverage of the slowdown of superintelligence systems, which includes other recent episodes.
One of them affects Anthropic, which has restricted internet access during its internal evaluations after publishing a report on the investigation of unintended actions by its models in testing and internal use.
Another case, also reported by The Verge, notes that an artificial intelligence system from Anthropic sent a false lead to the Philadelphia police related to an unsolved homicide.
These episodes do not constitute direct proof of what Nadella advocates, but they do illustrate the context in which his proposal is inserted: companies that are already isolating their own test systems and are already facing concrete consequences derived from the behavior of their models.
The standardization proposal also has a competitive reading. If containment becomes a common industry standard, no company could differentiate itself by offering fewer security controls, and developers would have to agree on compatible interfaces and shutdown procedures.
What standardizing containment would imply for the industry
For organizations that already use or plan to use artificial intelligence agents, Nadella's approach translates into several practical checks.
It is advisable to verify who has the authority to pause or shut down a system in the middle of a task and how that action would be executed in practice. It is also relevant to ask providers what logs each model generates and whether these are human-readable and difficult to alter.
Another control point is to check if there is an established incident disclosure procedure and if the system has undergone independent audits. Finally, Nadella suggests demanding verifiable data on how each model has been evaluated before its deployment.
The Microsoft executive does not propose specific deadlines or a body in charge of enforcing these recommendations. What he proposes is a design criterion that any client could demand from their providers right now: containment from the origin, the possibility of human intervention at all times, and an auditable trail of the model's activity.
Frequently asked questions
What exactly does Satya Nadella propose regarding artificial intelligence?
He proposes that every advanced AI model be treated as potentially compromised from its design, with containment mechanisms, an emergency brake, and independent audits, rather than trusting the system until it fails.
What is the emergency brake that Nadella mentions?
It is the ability for an authorized person to pause or shut down an AI model at any time while it is executing a task, without needing to wait for it to finish.
Why does Nadella use the term superintelligence in his message?
Because he places his proposal in the context of AI systems more capable than current ones, for which he considers that standard security measures could be insufficient.
What is the relationship between this proposal and the Anthropic incidents?
Nadella does not directly mention these cases, but his message arrives in the same context in which Anthropic has restricted internet access in its evaluations and has reported an incident with a false lead sent to the Philadelphia police by one of its systems.
Does Nadella propose a body or deadline to implement these measures?
No. The Microsoft executive does not set deadlines or propose a specific regulatory entity, but rather suggests a design criterion that clients could already demand from their AI providers.
What should companies using AI agents check according to this proposal?
They should verify who can pause or shut down the system, what logs it generates, whether independent audits exist, and if verifiable data on its prior evaluation is available.
