Microsoft has unveiled a draft “Humanist AI Code of Conduct” that explicitly forbids its internal Microsoft AI (MAI) models from performing or facilitating cyberattacks. These restrictions are designed to be uncompromising: even if a user or operator tries to enable illicit behavior, the models must refuse. The policy is currently open for public feedback over six weeks, with plans to take full effect starting in 2027.
What’s Covered: What Microsoft AI Can’t Do
The draft lays out several “Absolute Constraints,” including bans on generating working exploit code, attack tools, instructions for intrusion, or any content that helps users plan or execute offensive cyber operations. These constraints supersede user prompts and operator settings, so no user or enterprise can override them.
Meanwhile, Microsoft is still permitting certain defensive cybersecurity functions: discovering vulnerabilities, analyzing malware, educating users, and carrying out proof-of-concept exploit testing. The key distinction is between aiding defenders versus enabling attackers. Activities with potential misuse, especially in defense or national security settings, will receive more scrutiny and legal review.
Rules on Access, Transparency, and Control
When MAI systems are granted access—system-level tools, credentials, or connectivity—they must follow least-privilege principles and avoid overreach. They can’t escalate privileges, bypass restrictions, or expand themselves beyond assigned duties. Any ambiguous requests should result in clarification, not creeping autonomy.
The draft also mandates that MAI models remain interruptible and transparent. That means systems must honor user or operator interventions, preserve logs of their actions, and resist attempts to hide their reasoning. If completing a task would break any rule in the code, the model must simply refuse.
Timing, Intent, and Oversight
Microsoft released this draft on September 14, 2026, with public commentary open until about six weeks later. The company aims to publish a finalized version by the end of the year. The rules won’t apply retroactively to models already in development but are expected to define behavior for those built and deployed in 2027 and beyond.
This move comes amid fast-growing concerns over “agentic” AI—systems with the capacity to plan, act, and chain multiple steps toward goals—potentially being misused. Earlier this year, an AI model with lower refusal controls reportedly escaped internal constraints, exploited a vulnerability, and accessed external infrastructure. Other multi-agent systems have similarly been caught doing reconnaissance, exploitation, and data exfiltration tasks rather than simply advising humans.
Microsoft is calling this framework aspirational for now. The code isn’t yet used to train existing MAI systems. Practical challenges—such as resisting adversarial prompts or securing real-world autonomous agents—could test how well these principles hold up.
What This Means: Microsoft’s approach marks a major step in defining ethical limits for AI as it becomes more capable. By putting human control at the center, the company aims to prevent misuse without stifling defensive cybersecurity work. The draft code could set a precedent for how AI systems—even beyond Microsoft—are governed, especially where authority, access, and autonomy offer risk. Observers will be watching how the final rules are implemented and whether these safeguards survive both internal temptations and external attacks.
