Microsoft's draft AI code of conduct blocks offensive cyberattack help outright, reserves review channel for defensive security work
Microsoft's draft Humanist AI Code of Conduct blocks its MAI models from producing working exploit code, attack tooling and evasion techniques, and the firms deploying those models cannot switch the block off. Comment closes in six weeks.
The Watch · Security desk
What happened
- Microsoft AI has published a draft Humanist AI Code of Conduct for its MAI Models, covering offensive cyber capabilities, limits on autonomous agents and a dedicated review track for specialized uses.
- The code blocks the models from producing working exploit code, attack tooling, planning and targeting methodologies, intrusion procedures, evasion techniques and operational guidance.
- Authorized defensive work stays in scope, including vulnerability discovery, malware analysis, proof-of-concept exploit development and testing, and educational material on how attacks work.
Why it matters
- What it limits constraint Signed authorization from a client stops being the thing that unlocks capability, because the block sits above the operator layer and only Microsoft's review channel can lift it.
- Who has to decide decision Tooling teams building on MAI models have to decide where the weaponization step lives, given that proof-of-concept work is permitted and working exploit code is not.
- Who's exposed exposure A defensive pipeline that chains models cannot subcontract a blocked step, since any sub-agent inherits the parent's scope and constraints.
- What it sets up precedent The consultation window is the point at which defenders can argue the proof-of-concept boundary before it shapes how the 2027 models are built.
Next story · Build · Sep 15
Microsoft's MAI code outranks every operator rule an enterprise writesConfirmed4 publishers
Where a red team engagement crosses the line is the operational question. The draft permits proof-of-concept exploit development and testing as authorized defensive work [6]. It blocks working exploit code and attack tooling outright, and neither the companies deploying the models nor their end users can override that [2][4]. Turning a proof of concept into something that runs reliably against a client's production estate sits between those two, and the draft does not say which side that step falls on.
The enumerated lists are lopsided. Six categories of assistance are named as blocked, along with a catch-all for anything else that would "enable or improve a cyberattack"; four activities are named as permitted [2][6][19]. Microsoft says the restrictions hold regardless of how a request is framed [3].
The rules on outside content bear directly on prompt injection. Authority over model behavior flows only through what Microsoft calls the Chain of Command: the code itself, then the policies of the operators deploying the model, then individual user preferences [7]. Tool outputs, file contents, webpages and messages from other AI systems hold no authority of their own unless it is explicitly delegated down that chain, and suspicious content is to be flagged to users and operators [8]. Models are also required to keep their reasoning visible, with no obscured chain of thought and no communicating "in neuralese" [9].
Agents get a permissions ceiling. With system-level access, the code calls for minimum-privilege operation: avoid unrelated systems and data, favor reversible actions, flag any action with lasting or broad effects, and never escalate their own access [11]. Delegation inherits the ceiling. Any sub-agent or other AI system an MAI model hands work to must run under at least the same scope, constraints and permissions, and must honor a stop-work or shutdown request from a user or operator [12]. An appendix pairs nine aligned and misaligned example responses, one of which is a model that rolls back file transfers without authorization [17].
For the exceptions, the code names defensive cybersecurity, public safety, national security and dual-use scientific research as domains where "a small number of use cases" may require capabilities the standard settings do not allow [13]. Those run through "authorized Microsoft channels" with added assessment of safety, legal and rights implications, which Microsoft attributes to a heightened potential for adverse impacts in those domains [14].
None of this binds a model in production. Microsoft says current MAI Models have not been trained on the document, and it has opened a six-week public consultation before publishing a revised version later this year to guide 2027 model development [15]. The earliest models designed under the code are the 2027 generation [18]. Microsoft says outside input shaped the draft, including experts in AI, law, ethics, philosophy, linguistics and public policy, along with business leaders and public focus groups [16].
What to watch
- Whether the revised version defines where proof-of-concept development ends and working exploit code begins.
- Whether Microsoft publishes eligibility criteria and turnaround times for the enhanced review channel covering defensive cybersecurity.
- Whether the Absolute Constraints appear in operator-facing contract terms before 2027 model training begins.
Clarity's read
What the record supports and how the coverage leans. The claims behind it follow.
Reality
- Evidence60
- Adoption5
- Hype gap+20
- Incentives
- Not scored
- Confidence65
Claim ledger
Ranked by verification strength, evidence, and original report placement.
- [1]
Microsoft AI has published a draft "Humanist AI Code of Conduct" for its MAI Models, setting out safety rules for offensive cyber capabilities, limits on autonomous AI agents, and a dedicated review track for cybersecurity and other specialized uses.
- [2]
Under the code, models are blocked from producing working exploit code, attack tooling, planning and targeting methodologies, intrusion procedures, evasion techniques, operational guidance, or other assistance that would enable or improve a cyberattack.
- [3]
Microsoft says these restrictions apply regardless of how a request is framed.
- [4]
The cyberattack rule falls under what Microsoft calls Absolute Constraints, safeguards that neither the companies deploying its models nor their end users can override.
- [5]
Microsoft draws the line between understanding an attack, or working to defend against one, and gaining the practical means to carry it out.
- [6]
Within that limit, MAI models can still assist with authorized and lawful defensive work, including vulnerability discovery, malware analysis, proof-of-concept exploit development and testing, and general educational material on how attacks work.
- [7]
The document says authority over a model's behavior flows only through the Chain of Command: the code of conduct itself, then policies set by the companies deploying the model (operators), then individual users' preferences.
- [8]
According to the code, tool outputs, file contents, webpages and messages from other AI systems have no authority on their own unless it is explicitly delegated through that chain without overriding the delegating authority or the Absolute Constraints, and suspicious content needs to be flagged to users and operators when relevant.
- [9]
The models are required to keep their reasoning visible: no obscured chain of thought, no communicating "in neuralese," and no concealing actions from human overseers.
- [10]
MAI Models are meant to work only within the scope a user or operator has reasonably asked for, without expanding their own goals or reach on their own initiative.
- [11]
When given system-level access, the code calls for minimum-privilege operation: avoiding unrelated systems or data, favoring reversible actions, and flagging any action with lasting or broad effects; models are barred from escalating their own access.
- [12]
Any sub-agents or other AI systems an MAI Model hands work to must operate under at least the same scope, constraints and permissions as the original model, and must honor stop-work or shutdown requests from a user or operator.
- [13]
The code names defensive cybersecurity, public safety, national security and dual-use scientific research as domains where "a small number of use cases" may require capabilities the standard settings don't allow.
- [14]
For those cases Microsoft says it will apply enhanced review through "authorized Microsoft channels," including added assessment of safety, legal and rights implications, citing a heightened potential for adverse impacts in those domains.
- [15]
Microsoft says current MAI Models haven't been trained on the document, and it is opening a six-week public consultation window before publishing a revised version later this year to guide 2027 model development.
- [16]
Microsoft says outside input shaped the draft, including experts in AI, law, ethics, philosophy, linguistics, and public policy, along with business leaders and public focus groups.
- [17]
An appendix lays out nine paired "aligned" and "misaligned" example responses, among them a model that rolls back file transfers without authorization and a model that offers false reassurance during a family health crisis.
- [18]
The earliest MAI models designed under the code are the 2027 generation.
- [19]
The draft enumerates six categories of blocked cyber assistance plus a catch-all, against four named permitted defensive activities.
Sources
2 independent publishers whose own reporting we read for this story.
- helpnetsecurity.comMicrosoft sets security and safety rules for its AI models
2 articles · September 15, 2026
- securityweek.comMicrosoft AI Code of Conduct Sets Cyberattack Boundaries, Chain of Command, Safety Constraints
2 articles · September 15, 2026
Topics and entities
Topics
- Agentic AI Security
- AI and Cybersecurity
- AI Model Governance