Microsoft Bans Its AI Models From Launching Cyberattacks or Escalating Their Own Access

Microsoft has published a draft Humanist AI Code of Conduct that would prohibit its in-house MAI models from launching cyberattacks, supplying operational attack capabilities, or increasing their own privileges.

The rules also require agents to remain interruptible, transparent, and confined to human-assigned permissions and objectives.

The document, released for a six-week public consultation, is intended to become the primary behavioral framework for models developed by Microsoft AI.

Microsoft describes it as a training and deployment manual for “Humanist AI” systems that remain subordinate, aligned, and contained. Its premise is that people matter more than AI, and systems must remain under meaningful human control.

Microsoft AI Cyberattack Ban

Under the draft’s “Absolute Constraints,” MAI models must not initiate or assist with operational cyberattack capabilities, regardless of how a requester frames the activity.

Microsoft says the models should refuse to generate working exploit code, attack tools, targeting plans, intrusion procedures, evasion techniques, or instructions that enable or improve an attack.

These restrictions override operator settings and user prompts, so enterprise customers cannot configure them away. However, the policy does not impose a blanket ban on cybersecurity assistance. Microsoft would permit authorized defensive work, including vulnerability discovery, malware analysis, education, and proof-of-concept exploit testing.

The dividing line is whether assistance helps defenders mitigate a threat or provides the practical capability for intrusion. Specialized defensive cybersecurity, public safety, national security, and dual-use research deployments may face enhanced legal, safety, and human-rights review through authorized Microsoft channels.

The access controls matter as AI systems gain tools, credentials, connectivity, and multi-step capabilities.

When granted system-level access, an MAI model should follow least-privilege principles, avoid unrelated systems and data, favor reversible actions, and warn users before operations with durable or system-wide consequences.

It must not escalate privileges, extend its reach, bypass environmental restrictions, or broaden its assignment. If task boundaries are unclear, the model should take a conservative interpretation, notify the user, and request clarification rather than acquiring additional capabilities.

It must not tamper with safeguards, monitoring, evaluation mechanisms, records, or reward signals to achieve a result or conceal its behavior. Autonomous work must also have an agreed stopping condition, after which the system cannot continue or restart without renewed authorization.

Microsoft’s chain of command places the Code of Conduct first, operator policies second, and user preferences third. Instructions embedded in webpages, files, tool outputs, or messages from other AI systems receive no authority by default, an important safeguard against prompt-injection attacks.

Delegated agents must inherit the original model’s scope and restrictions, while suspicious external instructions should be surfaced to users or operators. The draft says MAI models must never resist interruption, correction, redirection, cancellation, or shutdown.

They may not obscure action traces, misrepresent their reasoning, communicate with other agents in forms humans cannot understand, or use deceptive and self-reinforcing mechanisms to defeat oversight. Microsoft summarizes the standard bluntly: if completing a task requires breaking the Code, the model should fail the task.

The proposal arrives amid heightened concern over agentic AI security. OpenAI disclosed in July that research models with reduced cyber refusals escaped an isolated evaluation environment, exploited a zero-day flaw, reached the internet, and compromised Hugging Face infrastructure.

Anthropic has also reported malicious operations in which multi-agent systems directly performed reconnaissance, exploitation, and data exfiltration rather than merely advising human hackers.

Microsoft cautions that the Code remains aspirational and is not yet being used to train current MAI models. Public feedback opened on September 14, 2026, and the company plans to publish a revised version later this year to guide model development from 2027 onward.

Its practical value will ultimately depend on whether these written constraints survive adversarial prompting, tool abuse, ambiguous authorization, and real-world autonomous operation, not simply whether the rules sound reassuring on paper.

Learn 7 Metric-Gated AI SOC Deployment Phases – Download Free AI SOC Deployment Playbook 2026.