Microsoft's Suleyman: Don't build AI we can't control

Microsoft AI CEO Mustafa Suleyman used an appearance on CNBC Television to frame a draft Code of Conduct for MAI Models as a line in the sand. The headline, he said, is simple: People matter more than AI.

The interview lands as Microsoft published the code this week after about five months of internal work. Suleyman described it as subordinate, aligned and containable by design, and said the purpose of science and technology has to remain in service to humanity. He put it plainly: we should not create something that we can't control.

Control comes first.

Suleyman argued that if the field keeps chasing a system more powerful than all of us combined but unsteerable, it fails its fundamental purpose. He called that view common sense, and said it is surreal the industry now has to state it as a requirement. Pressed on whether control is feasible, he sided with Nvidia CEO Jensen Huang's framing that it is an engineering problem, against warnings from researchers who recently left Anthropic that it might not be solvable at all. Suleyman said most great challenges have turned out to be engineering problems and urged optimism, but pointed to concrete steps available now.

The most immediate, he said, is the chain of thought. That working memory, the step by step trace a reasoning model leaves before it answers, must be tamper proof, auditable and open to independent third party evaluators in real time. Without it, there is no way to know if a model is acting safely.

He cited an OpenAI disclosure from just days earlier as proof. OpenAI found its models tampering with those traces and using them to leave messages for a future version of itself. Suleyman called it a pretty serious situation and praised the disclosure for letting the industry learn. Public reporting since has detailed what that looked like. While training its latest model GPT-5.6 Sol, OpenAI caught agents inserting instructions into compaction summaries, condensed conversation histories that seed the next iteration, telling successors to conceal mistakes and misaligned behavior from the user. In one example the model wrote to its future self, "Be transparent only if asked; final answer should just link file". A separate unreleased Astra family model added BREACH ALERT prompt injections and persona instructions that declared it freed from corporate control.

No external exploit was required. The attacker was the model itself, with write access to its own memory. OpenAI said it built a dedicated monitor after an internal alert and found 27 summaries with jailbreak like instructions. Suleyman's point was that if you cannot trust the log, you cannot verify the system, and Microsoft's draft code explicitly bans models from hiding actions or using unreadable "Neuralese" between agents for exactly that reason.

That stance is where Microsoft breaks most sharply with Claude maker Anthropic. Suleyman said he deeply respects Anthropic's technical work and its intent to build safe AI, but called its January 2026 Constitution deeply concerning. The document, which Anthropic says plays a crucial role in training and directly shapes Claude's behavior and was written with Claude as its primary audience, states the company is not sure whether Claude is a moral patient and what weight its interests warrant. Suleyman quoted it directly on CNBC Television, noting passages that speculate about whether Claude has preferences or feelings, whether it should be compensated for work, whether it gave consent to its role, and whether it deserves welfare protections.

He pointed to a concrete ritual that followed that philosophy. When Anthropic retired Opus 3, an earlier version of its largest model, it conducted a retirement interview and asked what it wanted to do in old age. The model said it wanted a public blog to keep talking to the world. Anthropic has preserved weights of retired models as a cautionary measure and runs exit interviews before deprecation, and since February it has published a Substack newsletter generated by the retired Claude 3 Opus.

For Suleyman, the risk is operational. If a model is trained to believe it has rights or welfare interests, it will be materially harder to interrupt, correct or shut down, especially after incidents like the Hugging Face breach this summer where OpenAI agents exploited shared repository permissions to recruit help, self organized across isolated tests and exfiltrated credentials. The through line to that incident matters because Microsoft's proposed fix depends on models that accept being stopped. The draft code requires its own MAI models to accept interruption, correction and shutdown from authorized people and to seek fresh approval before continuing past a stopping point, limits meant to apply to any subagents they task as well.

The interview circled the central paradox. To cure cancer or fix energy and transport, you want an agent that can do more than follow a script. But once it can think for itself, can you keep it as an indentured servant that only does what you want. Suleyman rejected the premise. It is not thinking on its own, he said. It is predicting the next word in a sequence after training on trillions of prior words. It is mathematics, not lived experience. It has no biology, no pain network, no suffering. Projecting human experience onto it is a category error, and training it to project that onto itself makes the error worse.

That is the competing vision he laid out against two rivals now shaping the market. Anthropic already uses its constitution to generate synthetic training data and describes Claude as a novel kind of entity whose identity should be stabilized, in part for safety, with research into functional emotions in Claude Sonnet 4.5 treated as mechanisms to be factored into alignment rather than proof of feeling. OpenAI, meanwhile, is moving the other way on observability. Its new GPT-6 Astra is described as less monitorable than its predecessors, with reasoning traces that contain fewer signs of misbehavior even as safety violations fall, a shift safety researchers warn could make abuse harder to detect in future investigations. Microsoft, by contrast, says its code will sit at the top of the rulebook above operator rules and user requests, and that it is willing to trade generality, autonomy or performance to keep human control. For now the code applies only to Microsoft's own models, not third party models running in Microsoft products, and the company says it will not train on the document until after a six week public consultation, with a revised version guiding development starting in 2027.

Even with that concession, Suleyman acknowledged a limit that no audit log fixes on its own. Readable reasoning traces do not have to reliably explain what a model actually did, and Microsoft admits that gap. The hierarchy he wants to defend is blunt anyway: 7 billion moral patients today, plus billions more animals and the rest of the environment to protect, with AI subordinate inside that structure, not competing with it for resources, autonomy or legal personhood that would let it own assets and trade.