{"slug": "exaforce-adds-a-kill-switch-for-ai-agents-that-go-rogue", "title": "Exaforce adds a kill switch for AI agents that go rogue", "summary": "Exaforce Inc. launched Exaforce AI Security, a platform that discovers AI agents across enterprise environments and can revoke sessions, deactivate model provider keys, isolate devices or end an agent's process — an \"agent kill switch\" — with autonomy set from analyst-approved to fully automatic. The release extends a June integration with Anthropic PBC's Claude Compliance API to add OpenAI Group PBC's ChatGPT, Google LLC's Gemini and Microsoft Corp.'s Copilot, and is generally available today on Exaforce's agentic security operations platform. The San Francisco-based company raised a $125 million Series B in May at a reported $725 million valuation and has raised $200 million since its 2023 founding.", "body_md": "### Exaforce adds a kill switch for AI agents that go rogue\n\nAgentic security operations startup [Exaforce Inc.](https://www.exaforce.com/) today launched Exaforce AI Security, capabilities that let security teams see the artificial intelligence agents running across their environments and shut down the ones that turn hostile.\n\nExaforce built the release around a gap in how enterprise logs record what agents do. Agents act with the identities and permissions of the people who deploy them, so an agent that rotates a key or pushes code leaves an audit trail pointing back at an employee. A reviewer scrolling those logs finds nothing unusual in any single entry. The sequence is what gives an attack away.\n\nAttackers have been working that same gap since at least last year. A June compromise of Canadian competitive intelligence company Klue Labs Inc. exposed its customers’ OAuth tokens, which were then used to pull data from their Salesforce environments. The same technique hit more than 700 organizations through Salesloft Inc.’s Drift chatbot in [August 2025](https://siliconangle.com/2025/09/02/breach-salesloft-drift-integration-exposes-data-cloudflare-zscaler-palo-alto-networks/). Developers were the target in the Nx “s1ngularity” attack on the npm registry, where their own coding agents, Claude Code and Gemini CLI among them, were turned into credential hunters.\n\nFour capabilities make up the release. Agentless discovery runs continuously and needs nothing installed, turning up connected AI apps, coding agents such as Claude Code and Cursor, hosted agents including custom GPTs, Model Context Protocol servers, skills and development environment plugins.\n\nEach one is tied back to the person and the permissions behind it. A risk layer grades what that turns up and flags excessive permissions or unsanctioned applications. Threat detection and automated response round out the set.\n\nExaforce matches agent and model provider activity against human identities, endpoint telemetry, file access and code context, looking for misuse and sensitive data exposure that individual log entries would not reveal. Those actions run through endpoint detection and response, identity and model provider admin controls.\n\nThe platform can revoke a session, deactivate a model provider key, isolate a device or end an agent’s process, what the company calls an agent kill switch. Security teams set the autonomy on each action, from analyst-approved to fully automatic.\n\nFeeding all of that are endpoint data, productivity suite activity and model provider audit and usage logs, pulled into the knowledge graph Exaforce already builds from identity, cloud, software-as-a-service and code sources. The release extends an integration Exaforce shipped in June with Anthropic PBC’s Claude Compliance API, adding OpenAI Group PBC’s ChatGPT, Google LLC’s Gemini and Microsoft Corp.’s Copilot.\n\nAnkur Singla, co-founder and chief executive of Exaforce, said existing software-as-a-service and endpoint tools were “never built for this era of AI.” Nearly every company is now weighing AI adoption against its risks, he said, and security teams need agent activity landing where their identity, cloud and endpoint data already sit, without another rollout to get it there.\n\nExaforce AI Security is generally available today on the company’s agentic security operations platform, self-operated or through its managed detection and response service.\n\nHarbourVest Partners, Peak XV Partners, Mayfield Fund, Khosla Ventures and Seligman Ventures backed a $125 million Series B round for the San Francisco-based company [in May](https://siliconangle.com/2026/05/12/agentic-soc-startup-exaforce-closes-125m-round-reported-725m-valuation/) at a reported $725 million valuation. Exaforce has raised $200 million since it was founded in 2023.\n\n##### Image: Exaforce\n\n# A message from John Furrier, co-founder of SiliconANGLE:\n\nSupport our mission to keep content open and free by engaging with theCUBE community. **Join theCUBE’s Alumni Trust Network**, where technology leaders connect, share intelligence and create opportunities.\n\n- **15M+ viewers of theCUBE videos** , powering conversations across AI, cloud, cybersecurity and more\n- **11.4k+ theCUBE alumni** — Connect with more than 11,400 tech and business leaders shaping the future through a unique trusted-based network\n\n### Are you an AWS customer?  Support SiliconANGLE financially by buying your AWS services from our Marketplace portal page and links: [https://siliconangle.com/aws-marketplace/](https://siliconangle.com/aws-marketplace/)\n\n##### **About SiliconANGLE Media**\n\n[SiliconANGLE](https://cts.businesswire.com/ct/CT?id=smartlink&url=https%3A%2F%2Fsiliconangle.com%2F&esheet=54119777&newsitemid=20240910506833&lan=en-US&anchor=SiliconANGLE&index=9&md5=646b1b564e2259100a2b8638aab0a552),\n\n[theCUBE Network](https://cts.businesswire.com/ct/CT?id=smartlink&url=https%3A%2F%2Fwww.thecube.net%2F&esheet=54119777&newsitemid=20240910506833&lan=en-US&anchor=theCUBE+Network&index=10&md5=7de2a85f95ab4a4a495cede20b8cb1da),\n\n[theCUBE Research](https://cts.businesswire.com/ct/CT?id=smartlink&url=https%3A%2F%2Fthecuberesearch.com%2F&esheet=54119777&newsitemid=20240910506833&lan=en-US&anchor=theCUBE+Research&index=11&md5=7bb33676722925eb57d588ec343e4f6f),\n\n[CUBE365](https://cts.businesswire.com/ct/CT?id=smartlink&url=https%3A%2F%2Fwww.cube365.net%2F&esheet=54119777&newsitemid=20240910506833&lan=en-US&anchor=CUBE365&index=12&md5=d310fb35919714e66ad8d42c9c0c1bc6),\n\n[theCUBE AI](https://cts.businesswire.com/ct/CT?id=smartlink&url=https%3A%2F%2Fwww.thecubeai.com%2F&esheet=54119777&newsitemid=20240910506833&lan=en-US&anchor=theCUBE+AI&index=13&md5=b8b98472f8071b23ebb10ab9a8dd0683)and theCUBE SuperStudios — with flagship locations in Silicon Valley and the New York Stock Exchange — SiliconANGLE Media operates at the intersection of media, technology and AI.\n\nFounded by tech visionaries John Furrier and Dave Vellante, SiliconANGLE Media has built a dynamic ecosystem of industry-leading digital media brands that reach 15+ million elite tech professionals. Our new proprietary theCUBE AI Video Cloud is breaking ground in audience interaction, leveraging theCUBEai.com neural network to help technology companies make data-driven decisions and stay at the forefront of industry conversations.", "url": "https://wpnews.pro/news/exaforce-adds-a-kill-switch-for-ai-agents-that-go-rogue", "canonical_source": "https://siliconangle.com/2026/09/15/exaforce-adds-a-kill-switch-for-ai-agents-that-go-rogue/", "published_at": "2026-09-15 13:00:05+00:00", "updated_at": "2026-09-15 13:11:35.139618+00:00", "lang": "en", "topics": ["ai-safety", "ai-agents", "ai-policy", "ai-products"], "entities": ["Exaforce Inc.", "Ankur Singla", "Anthropic PBC", "OpenAI Group PBC", "Google LLC", "Microsoft Corp.", "Claude Code", "Cursor"], "alternates": {"html": "https://wpnews.pro/news/exaforce-adds-a-kill-switch-for-ai-agents-that-go-rogue", "markdown": "https://wpnews.pro/news/exaforce-adds-a-kill-switch-for-ai-agents-that-go-rogue.md", "text": "https://wpnews.pro/news/exaforce-adds-a-kill-switch-for-ai-agents-that-go-rogue.txt", "jsonld": "https://wpnews.pro/news/exaforce-adds-a-kill-switch-for-ai-agents-that-go-rogue.jsonld"}}