Microsoft's draft Humanist AI Code of Conduct for MAI Models defines safety rules that block the generation of working exploit code, attack tooling, intrusion procedures, evasion techniques, and operational guidance that could enable cyberattacks. These absolute constraints cannot be overridden by deploying companies or end users. The code differentiates between understanding or defending against attacks and enabling their execution. MAI Models can assist with authorized defensive cybersecurity activities like vulnerability research and malware analysis. The code enforces a chain of command for model behavior, disallows AI agents from escalating privileges or expanding goals autonomously, and requires transparency in AI reasoning. For certain sensitive use cases, including cybersecurity, Microsoft will apply enhanced review through authorized channels. The draft is currently under public consultation with plans for revision.

The code of conduct limits the risk of AI models being misused to facilitate cyberattacks by blocking generation of exploit code and attack methodologies. It supports lawful defensive cybersecurity work, potentially improving vulnerability research and malware analysis capabilities. The restrictions reduce the likelihood of AI models autonomously performing harmful actions or privilege escalation. However, the code is a policy framework rather than a vulnerability or exploit itself and does not represent an active security threat. It aims to enhance AI safety and responsible use in cybersecurity contexts.

This is a policy and safety framework rather than a vulnerability requiring patching. Organizations should monitor the final published code of conduct and align their use of Microsoft MAI Models accordingly. No immediate remediation actions are required as this code sets operational boundaries to prevent misuse. Microsoft is conducting a public consultation and will update the code to guide future model development and deployment.