How does AI security guidance from OpenAI, Anthropic, Microsoft, Google, and AWS compare?

The provided sources do not offer a direct comparison of AI security guidance from OpenAI, Anthropic, Microsoft, Google, and AWS. However, they do detail specific security controls and best practices from Anthropic, OpenAI, and Microsoft.

Anthropic's guidance emphasizes building guardrails around the model, pre-screening user inputs, classifying harmful requests, and constraining output formats. It also highlights the importance of external authentication and authorization, scoping API keys and permissions to the minimum task, and distinguishing between read and write actions. For agentic coding, Anthropic recommends treating AI-suggested changes as untrusted code until reviewed, using sandboxed environments, and blocking unreviewed network fetches.

OpenAI's guidance focuses on layered controls, including authentication, rate limiting, content moderation, human review for high-impact actions, and tool permission boundaries. It advises using moderation APIs to reduce unsafe content, requiring authenticated users, and applying rate limits by user, organization, and IP. OpenAI also recommends constraining inputs and outputs, using structured output schemas, and treating retrieved or external content as untrusted.

Microsoft's approach centers on defense in depth, securing identity, constraining data access, inspecting prompts and documents, governing agents and connectors, and continuous monitoring and red-teaming. Key controls include inheriting existing identity and data governance controls like Microsoft Entra ID and role-based access control, applying prompt and content filtering before model execution, and minimizing grounding data that reaches the model. Microsoft also stresses the importance of least privilege for the user, agent, and tool, and requiring sandboxing and human approval for irreversible side effects from agents that execute code or call APIs.