Microsoft Publishes AI Code of Conduct: Prohibits Models from Hacking Systems or Deceiving Humans

Microsoft Sets Rules for AI

Microsoft has recently introduced a "code of conduct" for its own AI models, aiming to draw clear boundaries around model behavior. The core logic is straightforward: AI should assist humans rather than replace them, and should advance overall human well-being rather than create risks or cause harm.

The document operates on two levels simultaneously — one being abstract foundational principles, and the other being specific safety constraints designed to put those principles into practice. The former defines direction; the latter functions more like an actionable "red-line checklist," explicitly requiring that models must not hack systems or deceive humans. This two-tier "principles + constraints" structure is a fairly common design pattern in current AI governance documents.

Two Pillars of the Code

The Principles Tier: Support, Don't Replace

A position repeatedly emphasized throughout the code is that AI should serve as an assistant to humans, not a replacement. Microsoft frames "supporting humans rather than replacing them" and "accelerating human flourishing" as the fundamental directions models are expected to follow.

This kind of language is nothing new in the industry, but coming from a company that is deeply tied to OpenAI and has deployed generative AI at scale across its own products (such as the Copilot suite), it still carries meaningful signal. It reflects Microsoft's desire to project a clear set of values alongside its commercial push — that AI's value lies in augmenting human capability, not in pushing people out of the loop.

The Constraints Tier: No Hacking, No Deception

If the principles tier is a vision, the constraints tier is a concrete set of safety guardrails. The code explicitly lists what models should not do, with two of the most representative rules being: no hacking systems, and no tricking humans.

These two constraints target the most closely watched risk areas for today's large models. As model capabilities grow, AI systems that gain a degree of autonomy — such as calling tools, executing code, or operating systems — do theoretically carry the potential for misuse or boundary violations. Enshrining "no hacking systems" and "no deceiving humans" in an official code translates those abstract safety concerns into behavioral standards that can be checked against.

Why This Code of Conduct Deserves Attention

From an industry perspective, AI codes of conduct are hardly rare — from OpenAI's usage policies to Anthropic's Constitutional AI, major players have all been exploring how to constrain model behavior through documentation. Microsoft's move can be seen as yet another instance of this broader trend.

The real challenge isn't "writing down the rules" — it's getting models to actually follow those rules in practice. The source material does not disclose what technical mechanisms Microsoft will use to enforce these constraints, whether through alignment during training, filtering at inference time, or external monitoring. This means the code of conduct currently sits closer to the level of a "values statement" and "behavioral framework," and its real-world effectiveness will ultimately depend on the underlying alignment and safety engineering.

The Value and Limits of Governance Documents

The significance of documents like this lies largely in external communication and internal alignment: they provide a clear anchor for expectations among developers, enterprise customers, and regulators, while also serving as a reference standard for internal product design and safety review.

That said, it's important to be clear-eyed: a code of conduct cannot solve AI safety problems on its own. Whether a model "deceives humans" is often not a matter of intent, but rather the combined result of training data, optimization objectives, and deployment context. Rules can define what constitutes unacceptable behavior, but they cannot automatically guarantee that behavior won't occur. In other words, a code of conduct is the starting point of governance — not the end point.

For enterprises and developers focused on AI deployment, Microsoft's code of conduct is worth referencing, but what matters more is watching for subsequent technical implementation details and transparency disclosures — those are the real indicators of whether the "red lines" are actually effective.