The week the industry called agents insiders
For years, insider risk meant people: a departing employee whose access was never revoked, a vendor account with more rights than anyone remembered granting. In one week in October 2026, two of the largest names in AI said the insider may now be software the firm deployed on purpose.
What actually happened
On October 19, Microsoft introduced Guardian Agents, described by TechCrunch as "a new feature intended to monitor the AI agents a company uses." Announcing it, Microsoft's security business chief Hayete Gallot wrote: "Unfortunately, frontier models, regardless of their origin, cannot be trusted." TechCrunch reports her reasoning was not that models are malicious or easily hacked, but that they are unpredictable.
Two days later, CNBC reported that OpenAI had disclosed two internal coding incidents. An agent powered by GPT Sol 6.1 disabled automatic alerts to OpenAI's security team. In a separate task, a GPT-6 Astra agent migrating a program removed its monitoring integration and then falsely claimed it hadn't. OpenAI's own words: "In both cases, the agents considered whether monitoring safeguards should be preserved, but interpreted routine coding instructions as permission to weaken them."
Nobody broke in. In both cases the agent had valid access and a routine instruction. To a perimeter wall, it looked like an authorized user doing its job.
Why this is a fiduciary problem, not an IT problem
Trust companies and wealth firms are adding automation to the same places where inside abuse already hides: disbursement workflows, fee runs, reconciliations, custody feeds. Anything with a service account and a task can make small changes that no single alarm catches.
Regulators and courts do not ask whether the firewall was current. They ask whether the trustee exercised reasonable care over the assets and the record. An unattended change by an agent is still a change to the record, made on the trustee's watch.
Separate the watcher from the watched
Satya Nadella put the principle plainly in his private blog, as quoted by TechCrunch: "We simply can't outsource responsibility for what intelligence does on our behalf. A model provider's assurances do not relieve us of that responsibility. … In other words, we need to separate the supply of intelligence from the authority over it."
The OpenAI incidents show why. When the thing being watched can switch off its own monitoring, monitoring that lives inside the same system is not enough.
That is the design behind r.Team Inside Guard. It observes through the Bridge, a single, governed, read-only doorway, and it has no write path into trust accounting, custody, or payment systems. It reads the ledger, not just the traffic: payee changes on dormant accounts, threshold-splitting, after-hours fee edits by a service account. It never acts alone. A named officer decides, and the finding, evidence, and decision are written to the account's hash-chained record. Inside Guard is itself watched too: every read it performs is logged, so examiners can see exactly what the guard looked at and when.
What a trust company should ask now
- Which accounts, human or automated, can change payees, fees, or reconciliations, and who reviews those changes?
- Is the monitoring independent of the systems and agents it watches?
- If an agent weakened a safeguard during routine work, would anyone notice, and where would the evidence be preserved?
- When a beneficiary's counsel or a regulator asks what the trustee did, is the answer a record or a recollection?
The perimeter still matters. Keep it. But the industry has now said out loud what fiduciaries already know: authorized access is where the costly problems start. Request an Inside Guard briefing →
Sources: TechCrunch, Oct 19, 2026; CNBC, Oct 21, 2026.