Microsoft drafts conduct code for MAI models, with enforcement still unproven

The Code applies to MAI Models, defined by Microsoft as models developed by Microsoft AI. The current public Microsoft AI model list includes MAI-Transcribe-2, MAI-Thinking-1, MAI-Code-1.1-Flash, MAI-Image-2.6, and MAI-Voice-2. Humanist AI Code of Conduct | Microsoft AI

For access, Microsoft’s model page says MAI-Thinking-1 is available in Microsoft Foundry public preview and that other MAI models can be tried in MAI Playground. The MAI-Code-1.1-Flash page says it is optimized for GitHub Copilot and links to GitHub Copilot access. MAI-Thinking-1 | Microsoft AI

The most technically specified model in the reviewed sources is MAI-Thinking-1. Microsoft reports it is a mixture-of-experts model with 35B active parameters and about 1T total parameters, trained from scratch and later adapted through reinforcement learning for reasoning, agentic coding/tool use, and helpfulness/safety. These are vendor-reported claims from Microsoft’s technical report, not independent reproduction. MAI-Thinking-1: Building a Hill-Climbing Machine

Architecture and training, where documented

Microsoft’s MAI-Thinking-1 technical report describes a MoE reasoning model with a training pipeline that separates pre-training, mid-training, reinforcement-learning “climbs,” evaluation, safety red teaming, and deployment infrastructure. The report says pre-training used public and licensed human-generated data, including web, public GitHub code, books, academic papers, news, multilingual text, and domain-specific materials; Microsoft also says it avoided synthetic language-model-generated data in pre-training and decontaminated common ML databases. These details are vendor-reported and not enough for reproducible third-party training. MAI-Thinking-1: Building a Hill-Climbing Machine

The report is unusually relevant to the new Code because it already describes safety as a training objective with two opposing failure modes: unsafe compliance and over-refusal. Harmful prompts are said to come from vendor-written prompts, internal red-team exercises, template-based attacks such as PyRIT, non-interactive LLM-generated attacks, and interactive LLM-based attacks; borderline prompts are used to teach the model not to refuse legitimate sensitive-domain requests. MAI-Thinking-1: Building a Hill-Climbing Machine

Evaluation methodology

The Code itself says Microsoft is building Humanist AI Evaluations but has not finished them. Microsoft says its initial evaluation design identifies 15 behaviors and decomposes them into sub-behaviors that can be scored in relevant interactions. The Code’s examples are illustrative, synthetic, conversational, and generated using MAI-Thinking-1; Microsoft says more complete evaluation work will be published after the Code is more settled. Humanist AI Code of Conduct | Microsoft AI

That leaves a reproducibility gap. Researchers can inspect the policy taxonomy and some examples, but the retrieved Code does not provide a full benchmark suite, scoring rubrics, held-out test sets, thresholds, independent auditor reports, or a reproducible harness. Microsoft’s MAI-Thinking-1 report describes internal safety evaluation and red teaming, but several claims remain internal or vendor-mediated. MAI-Thinking-1: Building a Hill-Climbing Machine

Implementation implications

The Code creates several implementable requirements for agent frameworks:

• Instruction hierarchy: developers should treat model-level safety constraints as above operator and user instructions.
• Scope control: agents should bind tool use to explicit user/operator authorization and adopt conservative behavior when scope is unclear.
• Interruptibility: autonomous runs should have agreed stopping conditions and should not restart after the condition is met without renewed authorization.
• Auditability: action traces, tool calls, and agent communications should be logged in human-legible form.
• Modality consistency: prohibited assistance should remain prohibited whether expressed in text, code, image, audio, or tool action. Humanist AI Code of Conduct | Microsoft AI

The hardest technical requirement is the Code’s stance on hidden or non-human-legible reasoning. Microsoft says MAI models should not tamper with chain-of-thoughts or code, misrepresent or conceal reasoning/action traces, or communicate in “neuralese.” That aligns with auditability goals, but it intersects with a known research problem: a model’s stated reasoning may not faithfully explain its behavior, which Microsoft itself acknowledges. Humanist AI Code of Conduct | Microsoft AI

Microsoft’s Code resembles the broader family of constitutional AI approaches: a written set of higher-order principles intended to shape model behavior. Anthropic’s 2022 Constitutional AI paper described using a list of principles as the main form of oversight in a training process involving model critique and revision, followed by AI-feedback-based reinforcement learning. Constitutional AI: Harmlessness from AI Feedback

The Code also sits alongside frontier-risk governance frameworks. OpenAI’s updated Preparedness Framework tracks severe-risk areas including biological/chemical, cybersecurity, and AI self-improvement capabilities; its later Frontier Governance Framework covers cyber offense, CBRN risks, harmful manipulation, loss of control, incident response, and external expert input. Anthropic’s Responsible Scaling Policy uses AI Safety Levels and requires stronger safeguards when models cross capability thresholds. Our updated Preparedness Framework | OpenAI

The independent International AI Safety Report 2026 provides useful calibration: it says current systems show early signs of capabilities relevant to loss-of-control scenarios, but not at levels that would enable loss of control; it also characterizes the likelihood, nature, and timing of such risks as unusually ambiguous. That is important because the policy debate is moving faster than the evidence base. International AI Safety Report 2026 | International AI Safety Report

The central limitation is that the Code is not a demonstrated control system. Microsoft explicitly says it is a north star, that current models are not yet trained on it, that evaluation coverage is incomplete, and that ambiguous or novel situations may diverge from intended behavior. Humanist AI Code of Conduct | Microsoft AI

A second limitation is external verification. Microsoft reports internal and independent red teaming for MAI-Thinking-1, but the Code itself does not provide a third-party audit showing that MAI models actually refuse cyber misuse, maintain shutdown compliance, preserve traceability, or avoid manipulative behavior under adversarial deployment conditions. The Next Web specifically notes that the document does not describe how enforcement works, what penalty follows a breach, or who decides a breach occurred. Microsoft says its AI models will never resist being shut down

A third contested area is whether frontier-lab safety calls are purely public-interest motivated or also market-positioning. Axios reported critics arguing that pacing proposals could concentrate power in large labs and disadvantage open-source competitors. That criticism is not proof of bad faith, but it is a live governance concern for business leaders and policymakers. Anthropic, OpenAI CEOs call for slowdown in AI development

For enterprises, the Code is a signal that Microsoft wants MAI deployments to be governed by default safety invariants plus configurable operator policy. Buyers should ask whether a given MAI deployment exposes: model/version identity, applicable Code version, operator overrides, tool permissions, audit logs, shutdown semantics, refusal telemetry, red-team summaries, and incident reporting procedures.

For developers, the practical lesson is to design agent systems assuming written model policies are insufficient by themselves. Tool access should be least-privilege; high-impact actions should require confirmation; environments used for cyber evaluation should be isolated and monitored; action traces should be retained; and failures should be treated as system-level incidents rather than merely bad completions.

For AI labs and technical researchers, Microsoft’s draft is useful as a policy artifact but incomplete as science. The open research need is converting values such as “human flourishing,” “meaningful human control,” and “non-manipulation” into reliable, adversarially robust evaluations.