Nadella calls for an emergency brake on AI⁠.

Satya Nadella, the chief executive of Microsoft, used a long post on X on Saturday morning to set out how he thinks the risks of advanced AI should be handled². His starting point is that it is time "to step back and assess the trust architecture" of AI². He wrote that AI can no longer be treated as a set of nested black boxes whose recommendations, answers and actions we simply accept or reject².

The sharpest line is about containment¹. "We must assume a model is compromised and contain it from the start," he wrote, adding: "Think of it like an emergency brake"². He said an authorised person should always be able to pause or shut down a model mid-task¹. He added that more advanced models will need more advanced containment technologies, and that these should be standardised¹.

The rest of his plan is about being able to see what a model does². He wants the model kept separate from the harness that organises its work, with the controls and safeguards held outside it². He wants every meaningful action a model takes to leave tamper-proof evidence that a person can read². He called for a more transparent system in which models can be contained and observed¹.

Much of this matches what others in the industry have already asked for: timely disclosure of incidents, independent audits, verifiable data and containment¹. On containment, he appears to go slightly further than some others in the field¹. Nadella is the latest technology boss to publish long thoughts on AI safety². His post comes as leading AI companies acknowledge more incidents in which they seemed to lose control of their models, and after Dario Amodei, the chief executive of Anthropic, published a plan for more cautious development².

He also calls AI super intelligence throughout the post¹. That is the Trump administration's preferred term for it².

Borrow the brake, skip the rhetoric

Take out the talk of super intelligence and what is left is sensible, and none of it is new. It is the rule you would apply to a new member of staff with access to the bank account: decide what they can touch, keep a record of what they did, and make sure somebody can stop them. There is no British angle here yet. No UK regulator has said anything about it, and a post on X binds nobody.

For a company putting agents to work, the useful part is the test it implies. Ask three questions of each agent you run. Who can stop it halfway through a job, and how quickly? Where is the record of what it did, and could that record be quietly changed? Does it hold its own keys, or do its permissions sit outside it, where someone else can take them away? If the answer to any of them is nobody, nowhere or itself, that is the work to do before the agent is given more. When the head of Microsoft says to assume the model is compromised, it is fair to plan as though he means yours too.

Also today

• A columnist doubts AI growth can close America's budget gap

  A Guardian column argues hopes of AI driven growth will not fix the US deficit, as the 10 year Treasury yield hit its highest in almost a quarter century last week³.

• A reviewer runs an AI agent on a desk computer

  A Verge reviewer is running the open source Hermes agent with a local Qwen model on a Mac Studio to keep financial records off the cloud, though its daily briefing has broken several times⁴.

• Wired builds three poor games with Google's Playground

  Google's new Playground turns plain descriptions into working browser games, and a Wired writer built three playable, stable and not even remotely good ones in a single day⁵.