Nadella says to assume the AI model is compromised as Microsoft ships OS-enforced agent permissions

The claims behind this

Each figure above cites the claim it rests on, verbatim from the story that reported it.

1. [1]

   Nadella wrote that systems should start from the assumption that the model is compromised, and should contain it.

   Satya Nadella wants AI agents designed as if the model were already compromised

2. [2]

   Microsoft made Microsoft Execution Containers (MXC), its policy-driven system for restricting what AI agents and other untrusted workloads can access, generally available on Windows on October 7th.

   Microsoft makes Execution Containers generally available for OS-enforced agent permissions

3. [3]

   MXC selects a containment backend and enforces the policy at runtime, outside the agent's control.

   Microsoft makes Execution Containers generally available for OS-enforced agent permissions

4. [4]

   Microsoft wants Windows to supply the operating-system boundary around agents, rather than leave developers to rely on instructions given to the model or limits inside an agent application.

   Microsoft makes Execution Containers generally available for OS-enforced agent permissions

5. [5]

   Microsoft lists Decision-1 input tokens at $0.042 per million, with output tokens free.

   Microsoft's Decision-1 turns the check before an agent acts into a scored Foundry call

6. [6]

   Nadella made the comments in a post on X on October 10, 2026 (a Saturday morning, per mezha.net).

   Satya Nadella wants AI agents designed as if the model were already compromised

7. [7]

   Developers define which resources a workload may use, including file paths and network destinations.

   Microsoft makes Execution Containers generally available for OS-enforced agent permissions

8. [8]

   At Build on June 2nd, Microsoft introduced the MXC SDK in early preview, initially describing a cross-platform execution layer for Windows and Windows Subsystem for Linux.

   Microsoft makes Execution Containers generally available for OS-enforced agent permissions

9. [9]

   Cloudflare introduced its Clef models on October 1st, with open weights and deployment through Workers AI.

   Microsoft's Decision-1 turns the check before an agent acts into a scored Foundry call

10. [10]

    In his October 9th announcement, Srivastava describes Decision-1 as a tool for routing, classification, prioritization, verification and workflow control.

    Microsoft's Decision-1 turns the check before an agent acts into a scored Foundry call

11. [11]

    Nadella called for controls and safeguards to be located outside the model itself.

    Satya Nadella wants AI agents designed as if the model were already compromised

12. [12]

    Nadella said every meaningful or significant action of the model should be recorded in a way that is tamper-proof and human-readable.

    Satya Nadella wants AI agents designed as if the model were already compromised

13. [13]

    The MXC source repository describes MXC as an SDK dependency that builds into an application and documents Rust, .NET and Node SDKs.

    Microsoft makes Execution Containers generally available for OS-enforced agent permissions

14. [14]

    Microsoft's launch materials describe process containers for Windows, macOS and Linux; Windows-only session containers and WSL containers; and microVMs on Windows and Linux marked experimental.

    Microsoft makes Execution Containers generally available for OS-enforced agent permissions

15. [15]

    On macOS, the only backend listed in Microsoft's launch materials is the process container.

    Microsoft makes Execution Containers generally available for OS-enforced agent permissionsComputed: Filter the c8 backend list for macOS: process containers (Windows, macOS, Linux) = yes; session containers (Windows only) = no; WSL containers (Windows only) = no; microVMs (Windows, Linux) = no. Result: process containers only.

16. [16]

    dev.to's write-up states that Nadella's points are recommendations, not implementation details.

    Satya Nadella wants AI agents designed as if the model were already compromised

17. [17]

    A single Decision-1 check that fills the full 32,768-token input window costs about $0.0014 at list price.

    Microsoft's Decision-1 turns the check before an agent acts into a scored Foundry callComputed: 32,768 tokens x $0.042 / 1,000,000 tokens = $0.00137616, about $0.0014 (output free)

18. [18]

    Microsoft's Foundry listing says the model accepts text inputs of up to 32,768 tokens and returns JSON.

    Microsoft's Decision-1 turns the check before an agent acts into a scored Foundry call

19. [19]

    One thousand maximum-length Decision-1 checks cost about $1.38 at list price.

    Microsoft's Decision-1 turns the check before an agent acts into a scored Foundry callComputed: 1,000 x $0.00137616 = $1.37616, about $1.38

20. [20]

    An agent can ask whether a proposed tool call meets a rubric, then proceed, retry or escalate based on the score.

    Microsoft's Decision-1 turns the check before an agent acts into a scored Foundry call

21. [21]

    Developers can use Decision-1 scores to route a support ticket, check an agent's proposed action, or send an uncertain case for human review.

    Microsoft's Decision-1 turns the check before an agent acts into a scored Foundry call

22. [22]

    Microsoft reports median latency 35 times faster than GPT-6 Sol and 4.5 times faster than Quyet-1.0-Large.

    Microsoft's Decision-1 turns the check before an agent acts into a scored Foundry call

23. [23]

    Xbox Research used Decision-1 to sort more than 10,000 feedback items, and Copilot's team used it to assess AI responses; these results are Microsoft-reported.

    Microsoft's Decision-1 turns the check before an agent acts into a scored Foundry call

24. [24]

    OpenAI's Decisions API is in public beta, returning typed answers for fixed questions.

    Microsoft's Decision-1 turns the check before an agent acts into a scored Foundry call

25. [25]

    Microsoft plans to bring Decision-1 to OpenRouter; its announcement says OpenRouter access is coming soon, without giving a date.

    Microsoft's Decision-1 turns the check before an agent acts into a scored Foundry call

26. [26]

    A human intervened in six of the 98 conversations.

    Google's AMIE chatbot interviewed 98 patients before urgent-care visits in a Lancet studyComputed: 1 hallucination caught + 5 conversations with added clinical information = 6

27. [27]

    In a real-world clinical study, 98 patients consulted AMIE, Google's research diagnostic AI chatbot, ahead of urgent care visits.

    Google's AMIE chatbot interviewed 98 patients before urgent-care visits in a Lancet study

28. [28]

    Supervising physicians monitored the interactions in real time.

    Google's AMIE chatbot interviewed 98 patients before urgent-care visits in a Lancet study

29. [29]

    Supervisors spotted one hallucination and added clinical information in five conversations.

    Google's AMIE chatbot interviewed 98 patients before urgent-care visits in a Lancet study

30. [30]

    AMIE's differential diagnoses matched the doctors' final diagnoses 90% of the time.

    Google's AMIE chatbot interviewed 98 patients before urgent-care visits in a Lancet study

31. [31]

    This trial had no comparison group and doesn't establish how AMIE would perform without supervision.

    Google's AMIE chatbot interviewed 98 patients before urgent-care visits in a Lancet study

32. [32]

    The Foundry catalog warns that Decision-1 should not be the sole automated decision-maker for consequential matters involving employment, credit, housing, healthcare or legal rights; integrating applications need to set thresholds, human review and safeguards.

    Microsoft's Decision-1 turns the check before an agent acts into a scored Foundry call

33. [33]

    "We are currently spending over $1,000 per day on AI services for the demo," the team wrote on its Steam update.

    Easy Fox takes a bank loan to cover its free Steam demo's $1,000-a-day AI bill

34. [34]

    Easy Fox, the developer of the free, AI-powered Steam demo Teach My Little Sister How To Drive, has taken out a bank loan as more players tried the title.

    Easy Fox takes a bank loan to cover its free Steam demo's $1,000-a-day AI bill

35. [35]

    Voice is the game's sole control method; AI recognizes the player's commands and translates them into instructions for the virtual little sister.

    Easy Fox takes a bank loan to cover its free Steam demo's $1,000-a-day AI bill

36. [36]

    At a sustained $1,000 a day, AI spending on the demo is at least $30,000 a month.

    Easy Fox takes a bank loan to cover its free Steam demo's $1,000-a-day AI billComputed: $1,000 per day x 30 days = $30,000; the studio says 'over' $1,000, so this is a floor

37. [37]

    SteamDB showed an average player count of under 10 until late August, around 50 players by late September, and a peak of 431 on October 1.

    Easy Fox takes a bank loan to cover its free Steam demo's $1,000-a-day AI bill

38. [38]

    Easy Fox said the number of players trying the game has grown over 20 times, more than it expected.

    Easy Fox takes a bank loan to cover its free Steam demo's $1,000-a-day AI bill

39. [39]

    The game uses Google Gemini to listen to voice commands and generate responses, with ChatGPT serving as a fallback system.

    Easy Fox takes a bank loan to cover its free Steam demo's $1,000-a-day AI bill

40. [40]

    The increased number of users caused the game to hit usage limits on Google Gemini, forcing it to fall back on the less capable ChatGPT Realtime Mini 2.1 model, which led to player issues such as delayed responses and wrong inputs.

    Easy Fox takes a bank loan to cover its free Steam demo's $1,000-a-day AI bill

41. [41]

    Easy Fox plans to introduce local AI models for players with capable hardware so the game does not have to rely on external services, which can run into limits.

    Easy Fox takes a bank loan to cover its free Steam demo's $1,000-a-day AI bill

42. [42]

    Alibaba's Qwen team released Qwen-Image-2.1-Turbo on October 9th, offering downloadable model weights for image generation and editing with a recommended eight-step sampling schedule.

    Qwen-Image-2.1-Turbo cuts sampling to eight steps under a research-only license

43. [43]

    The 7-billion-parameter visual-generation model's BF16 weights occupy about 14 GB.

    Qwen-Image-2.1-Turbo cuts sampling to eight steps under a research-only licenseComputed: 7e9 parameters x 16 bits (BF16) / 8 bits per byte = 14e9 bytes, about 14 GB

44. [44]

    The model card links to Qwen's Research License Agreement, which permits use, reproduction and modification for noncommercial research or evaluation; commercial use requires a separate license from Qwen.

    Qwen-Image-2.1-Turbo cuts sampling to eight steps under a research-only license

45. [45]

    A budget set at August 2025 prices buys about 17% as many 64GB DDR5 kits at August 2026 prices.

    Price forecasters call a DRAM peak in 2027 while chipmakers say supply stays short through 2028Computed: 191 / 1118 = 0.171, i.e. about 17%

46. [46]

    A 64GB DDR5 kit averaged $191 in August 2025 and averaged $1,118 a year later, according to Tom's Hardware.

    Price forecasters call a DRAM peak in 2027 while chipmakers say supply stays short through 2028

47. [47]

    The 64GB DDR5 kit average rose about 485% from $191 to $1,118.

    Price forecasters call a DRAM peak in 2027 while chipmakers say supply stays short through 2028Computed: (1118 - 191) / 191 = 4.85, i.e. about 485%

48. [48]

    TrendForce recorded DRAM contract prices up 90 to 95% quarter over quarter in Q1 2026, cooling to 13 to 18% by Q3, still rising.

    Price forecasters call a DRAM peak in 2027 while chipmakers say supply stays short through 2028

49. [49]

    Current price trackers show DDR4 around $6 to $10 per gigabyte versus $9 to $16 for DDR5, so DDR4 remains the cheaper path per gigabyte.

    Price forecasters call a DRAM peak in 2027 while chipmakers say supply stays short through 2028

50. [50]

    Citi expects DRAM and NAND prices to peak in Q2 2027.

    Price forecasters call a DRAM peak in 2027 while chipmakers say supply stays short through 2028

51. [51]

    Gartner suggested in March 2026 that DRAM prices may stabilize by early 2027.

    Price forecasters call a DRAM peak in 2027 while chipmakers say supply stays short through 2028

52. [52]

    Micron now expects conditions to be "much tighter in calendar 2027 and 2028 than they were in 2026" and sees no line of sight to balance.

    Price forecasters call a DRAM peak in 2027 while chipmakers say supply stays short through 2028

53. [53]

    Samsung told investors the memory shortage will persist through 2028.

    Price forecasters call a DRAM peak in 2027 while chipmakers say supply stays short through 2028

54. [54]

    Every HBM stack Samsung, SK hynix or Micron sells to an AI data center pushes ordinary PC memory down the queue for the same fabrication capacity.

    Price forecasters call a DRAM peak in 2027 while chipmakers say supply stays short through 2028

55. [55]

    SK hynix's CEO said 2027 will be "the worst year in the industry's history from the supply perspective," and that demand will exceed supply "even beyond 2030."

    Price forecasters call a DRAM peak in 2027 while chipmakers say supply stays short through 2028

56. [56]

    The MXC repository labels several backends experimental, which RuntimeWire says reinforces that general availability for MXC does not mean every isolation option has the same maturity.

    Microsoft makes Execution Containers generally available for OS-enforced agent permissions

57. [57]

    Microsoft CEO Satya Nadella called for safeguards that give an authorised person the ability to pause or shut down an AI model in the middle of a task.

    Satya Nadella wants AI agents designed as if the model were already compromised

58. [58]

    "For the paid release, we plan to account for expected AI usage in the game's price," the team said. "Players will not be charged separately for their individual AI token usage after purchasing the game."

    Easy Fox takes a bank loan to cover its free Steam demo's $1,000-a-day AI bill