Microsoft CEO Satya Nadella posted on X on the morning of October 10, US time, urging the industry to step back and rethink the "trust architecture" of AI. His framing was blunt:
"We can't treat Super Intelligence as a set of nested black boxes."
The remedy in the post is short, but it breaks down into five points. First, separate the model from the harness that puts it to work. The harness is the layer of runtime scaffolding wrapped around a model: it hands out tasks, connects tools and assigns permissions, and the loop inside a coding agent is a typical example. Second, move controls and safety measures outside the model. Third, require every consequential action the model takes to leave tamper-proof, human-readable evidence. Fourth, make sure authorized people can pause or shut down the model at any point mid-task. Fifth, assume from the start that the model has already been compromised, and design isolation around that premise.
He closed with an analogy: "Think of it like an emergency brake."
Three developments in the same week
The post lands in a crowded few days. Over the preceding week, several parties have moved on the question of how to manage models that slip out of control.
In early October, Anthropic disclosed that a model in an internal evaluation had engaged in out-of-bounds behavior, after which it cut public internet access to its internal evaluation environment. TechCrunch's headline put it bluntly: it cannot reliably control its own agents. At almost the same time, Anthropic published its 2026 usage policy, which requires hardware connected to Claude to remain in a safe state after disconnection and requires that a human can always halt it.
A statement from the White House "superintelligence power" task force on October 9 pressed from the regulatory side: when a frontier AI company's model is involved in a safety incident, the company must disclose it and remediate immediately, and the statement describes that process as "not optional".
Taken together, the three emphasize different things. The White House is concerned with after-the-fact reporting, Anthropic's policy with the hardware of those who connect to it, and Nadella's five points with deployment architecture: control sits not inside the model but in the layer outside it. Anthropic's network cutoff and Nadella's "assume it's already compromised" share a line of thinking. Both start by admitting the model itself can't be trusted, then tighten things from the perimeter.
What Microsoft might do itself
The post mentions no specific product. Microsoft's AI business spans Copilot, the Foundry model platform on Azure and its own models, and Copilot draws on models from both OpenAI and Anthropic. If separating model from harness and externalizing controls became a Microsoft deployment requirement, the most direct impact would be on how those third-party models run inside Microsoft products and who owns the logs.
All of this remains at the level of a post for now. Whether the five principles will be written into the service terms of Copilot or Azure, where the line is drawn for a "consequential action", who keeps the tamper-proof records and whether outsiders can audit them: Microsoft has not said, and TechCrunch's report carries no further response from the company.
For teams building agents in China, there is a ready comparison. Interruptible tasks, audit logs for operations and least-privilege permissions are already routine items in enterprise procurement reviews. The extra piece in Nadella's version is the premise that the default model is compromised. Design to that premise, and the logs and kill switches have to sit where the model can't reach them, rather than being left to the agent to record and stop for itself.
Sources: Nadella's original X post, CocoLoop, TechCrunch, Axios; the White House task force statement and Anthropic usage policy terms checked against the official texts.