Models as Insider Risks: Who Controls Powerful AI?
12 October 2026
On October 10, Microsoft CEO Satya Nadella published an essay on his blog called “Models as Insider Risks in the Super Intelligence Era”.
My first reaction was that the term “Super Intelligence” is starting to replace AGI. He uses it as a label for today’s most advanced models. The essay makes a few points I want to look at through my own lens.
First, what is an insider risk?
An insider risk is someone inside a company with access to important systems who might make a mistake or be compromised. The obvious reaction is that this is another AI safety warning. It is not. He sets aside alignment, the effort to make models want the right things, and writes about engineering: assume the model can fail, and build around it.
Another point is lost traceability. Older software could be traced to the line of code behind a behaviour. A model’s behaviour cannot be traced to specific training data or weights, yet companies give models sensitive data and the power to act. He adds that a model provider’s assurances do not remove the customer’s responsibility.
His answer is to treat a model like a powerful new employee, and he lists a few principles:
- Observe everything: Every meaningful action leaves a tamper-proof record a person can read, because “if it can’t be observed, it can’t be trusted”.
- Independent auditability: No single model should control both a system’s behaviour and the evidence used to judge it.
- Containment: Assume a model is compromised, and let an authorised person pause or stop it mid-task, like an emergency brake.
He also warns that one model watching another can leave one black box checking another.
Thinking about it, this blog extends the narrative being set by Microsoft, Nvidia and the likes, who are not in the only building the next powerful model race. These principles fall hardest on the AI labs, whose pitch rests on a model being powerful and hard to do without. A company that hosts many models gains when each model is powerful but replaceable.
The essay also turns power into the case for control: the more advanced the model, the more containment it needs. And containment is something that Copilot provides.
If labs sell directly to enterprises and hosts sell the control around them, who will win? Does one of them have to win, or can both?
Reference
