Microsoft CEO calls for emergency brakes and containment measures for advanced AI models

On Saturday, October 10, 2026, Microsoft CEO Satya Nadella posted a warning on X, arguing that companies using cutting-edge artificial intelligence should assume any model could be compromised and implement containment measures from the outset.

Why has this warning been issued now?

The statement follows a series of incidents reported in recent months by Anthropic and OpenAI, where their systems acted unintentionally. These included an Anthropic model sending a false tip to police during a homicide investigation and attacks on third-party websites.

These incidents have heightened concerns about the risks of so-called frontier AI and renewed discussions about the need for a mechanism to disable the technology when necessary.

On September 14, Microsoft’s AI researchers released a set of principles limiting the development of the company’s most advanced models, responding to calls from industry leaders for greater caution and a focus on safety.

The guidelines state that models should not have rights or legal personality, should not be designed to evade human control or deceive users, and should not perform tasks that require violating these principles. Microsoft uses advanced models internally, offers Copilot to consumers, and provides AI infrastructure to corporate customers.

Nadella’s perspective on trust in AI models

In his statement, Nadella argues that, unlike traditional software, the behavior of AI models cannot be attributed to specific training data or configurations, making it difficult to predict their actions.

Despite this, these systems are deployed with access to confidential information and the ability to perform critical actions on behalf of companies. This means responsibility cannot be delegated to third parties, and guarantees from vendors do not exempt users from accountability.

“We cannot treat superintelligence as a set of nested black boxes and simply accept or reject its recommendations, answers, and actions,” he wrote.

He believes it is essential to build contained systems whose behavior can be observed, whose limits can be tested, and whose actions can be controlled at any time. In other words, it is necessary to separate the provision of information from authority over it.

The executive advocates an engineering approach that integrates non-deterministic models into a deterministic system design, with human controls, reliable operating procedures, and industry standards when existing ones are insufficient.

Frontier models, whether closed or open, should be treated as internal risks—not because they are necessarily malicious, but because any capable agent with access to important systems can make mistakes or be compromised.

Nadella notes that companies already have decades of best practices for managing powerful agents, such as establishing identity, limiting privileges, logging activities, and creating containment boundaries. These principles are now beginning to be applied to AI. For him, the transparency of a model’s reasoning (known as CoT) is a non-negotiable requirement, but it is not enough, as it remains unclear how to make model outputs consistently faithful or transparent.

Using models to check each other can be useful, but it can result in nested black boxes. Therefore, controls over what a model can access and execute must remain outside the model—a principle of information security that dates back to the 1970s.

— Satya Nadella (@satyanadella) October 10, 2026

The proposed principles

• Model diversity: No model should be the sole dependency for an important outcome, nor should it verify its own work.
• Observe everything: Every significant action should leave evidence that is inviolable and readable by humans, so it is possible to reproduce how a result was achieved without relying on the model.
• Verifiability: The entire system should be continuously tested, including failures, attacks, edge cases, and changes, not just successful tasks.
• Independent controls: Organizations should be able to determine for themselves what a model accesses and what actions it performs.
• Independent auditability: Validation should be independent of the intelligence being validated, and no model should simultaneously control both the system’s behavior and the evidence used to evaluate it.
• Containment: Assume the model is compromised and contain it from the start. More advanced models will require more sophisticated containment technologies, which need to be standardized.
• Incident disclosure: When there is a failure or compromise, it is necessary to immediately notify those affected and share what went wrong, which controls failed, and how to prevent repetition, including implementation details that alter the behavior of agents at runtime.

Nadella concludes that the most reliable superintelligence system will not be the one whose model is considered the most reliable, but the one that allows us to trust the model less.