[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fcMjdXjd7aP_JuE-2VFNHv3X6pSAGByNSdd1YwI25v2A":3},{"article":4,"iocs":41,"watch_terms":42,"solutions":43,"lesson":79},{"id":5,"title":6,"slug":7,"summary":8,"ai_summary":9,"brief":10,"url":11,"image_url":12,"published_at":13,"ingested_at":14,"relevance_score":15,"entities":16,"category_id":23,"category":24,"article_tags":28},"95e85e78-6372-4f49-aa4a-22c1337bd3d7","Microsoft AI Code of Conduct Sets Cyberattack Boundaries, Chain of Command, Safety Constraints","microsoft-ai-code-of-conduct-sets-cyberattack-boundaries-chain-of-command-safety-5828a0","The Humanist AI Code of Conduct draws a line between defensive cyber research and operational attack capability. The post Microsoft AI Code of Conduct Sets Cyberattack Boundaries, Chain of Command, Safety Constraints appeared first on SecurityWeek.","Microsoft AI has released a draft 'Humanist AI Code of Conduct' for its MAI Models, establishing strict safety rules for offensive cyber capabilities. The code prohibits models from generating exploit code, attack tooling, or providing guidance that aids cyberattacks, classifying these as 'Absolute Constraints' that cannot be overridden. While blocking direct offensive capabilities, the code permits AI assistance for defensive cybersecurity research, including vulnerability discovery and malware analysis.","Microsoft AI's draft code of conduct sets boundaries for AI offensive cyber capabilities.","https:\u002F\u002Fwww.securityweek.com\u002Fmicrosoft-ai-code-of-conduct-sets-cyberattack-boundaries-chain-of-command-safety-constraints\u002F","https:\u002F\u002Fwww.securityweek.com\u002Fwp-content\u002Fuploads\u002F2026\u002F09\u002FAI-artificial-intelligence-training.jpeg","2026-09-15T09:40:25+00:00","2026-09-15T10:00:21.162055+00:00",7,[17,20],{"name":18,"type":19},"Microsoft","vendor",{"name":21,"type":22},"MAI Models","product","c5c77cdb-f7d7-4990-9436-c81dcbff1163",{"id":23,"icon":25,"name":26,"slug":27},null,"Policy","policy",[29,34,39],{"category":30},{"id":31,"icon":25,"name":32,"slug":33},"6cbdd207-aaa1-4176-9534-e156b125e917","Nation-state","nation-state",{"category":35},{"id":36,"icon":25,"name":37,"slug":38},"839da5c1-3c34-47e2-9499-f7201640e3ac","AI Security","ai-security",{"category":40},{"id":23,"icon":25,"name":26,"slug":27},[],[18,21],{"controls":44,"vendors":73},[45],{"slug":38,"name":46,"problem":47,"products":48},"AI application security","Prompt injection, data leaks through AI tools and unapproved AI use get caught.",[49,57,65],{"vendor_slug":50,"vendor_name":51,"vendor_logo":52,"product_slug":53,"product_name":54,"url":55,"description":56},"boomi","Boomi","\u002Fvendor-logos\u002Fboomi.png","boomi-agentstudio","Boomi Agentstudio","https:\u002F\u002Fboomi.com\u002Fplatform\u002Fagentstudio\u002F","Agent builder whose Agent Control Tower registers and monitors Boomi agents and agents on Amazon Bedrock, Microsoft Copilot and other platforms, keeps audit logs and can switch agents off where the provider allows it.",{"vendor_slug":58,"vendor_name":59,"vendor_logo":60,"product_slug":61,"product_name":62,"url":63,"description":64},"cisco","Cisco","\u002Fvendor-logos\u002Fcisco.png","ai-defense","Cisco AI Defense","https:\u002F\u002Fwww.cisco.com\u002Fsite\u002Fus\u002Fen\u002Fproducts\u002Fsecurity\u002Fai-defense\u002Findex.html","Discovery of AI use, testing of models and guardrails for AI applications.",{"vendor_slug":66,"vendor_name":67,"vendor_logo":68,"product_slug":69,"product_name":70,"url":71,"description":72},"hiddenlayer","HiddenLayer","\u002Fvendor-logos\u002Fhiddenlayer.png","hiddenlayer-ai-security","HiddenLayer AI Security Platform","https:\u002F\u002Fhiddenlayer.com\u002F","Model scanning, AI red teaming and runtime protection for AI applications.",[74],{"slug":75,"name":18,"logo_path":76,"roles":77},"microsoft","\u002Fvendor-logos\u002Fmicrosoft.png",[78],"reported_by",{"slug":80,"title":81,"body":82,"framework_refs":83,"framework_notes":93},"microsofts-ai-code-of-conduct-draws-hard-lines-on-offensive-cyber-capabilities","Microsoft's AI Code of Conduct Draws Hard Lines on Offensive Cyber Capabilities","Microsoft's draft 'Humanist AI Code of Conduct' highlights a critical and emerging challenge: AI models can be misused to generate exploit code, attack tooling, or cyberattack guidance if no guardrails exist. By classifying offensive capabilities as 'Absolute Constraints,' Microsoft acknowledges that without explicit, enforceable boundaries, AI systems pose a systemic risk to global cybersecurity. This matters because AI lowers the technical barrier for threat actors, meaning even unsophisticated attackers could leverage unguarded models to launch sophisticated attacks. The distinction between permitting defensive research while blocking offensive use sets an important industry precedent that other AI vendors should follow. Organizations deploying AI tools must verify that similar conduct frameworks and safety constraints are in place for any third-party models they use.",[84,85,86,87,88,89,90,91,92],"NIST AI RMF (AI Risk Management Framework) - Govern 1.1, Map 1.5","NIST SP 800-53 AC-2 (Account Management)","NIST SP 800-53 SI-10 (Information Input Validation)","CIS Control 3: Data Protection","CIS Control 16: Application Software Security","EU AI Act – Article 5 (Prohibited AI Practices), Article 9 (Risk Management)","GDPR Article 25 (Data Protection by Design and by Default)","ISO\u002FIEC 42001 (AI Management System Standard)","ITIL – Service Design: Risk and Compliance Management",{}]