The off switch just became a product category with a price tag.

Two stories collided this week. The first: businesses are turning AI agents loose at record speed. The second: the security industry decided that stopping those agents is worth roughly $900 million in agreed and reported deal money.

If you run an agent with real access — your inbox, your Stripe account, your deploy pipeline — this week was about you.

The adoption number

Databricks published its 2026 State of AI Agents report, drawn from more than 20,000 customers. Multi-agent workflows grew 327% over the latter half of 2025. Around 40% of those workflows tie directly to customer experience — support, onboarding, claims, database operations. (Automation Today)

That is not experimentation. That is production. Agents are no longer drafting memos in a sandbox. They are talking to your customers and touching your databases.

Notice where the growth landed: customer-facing work. The same access that makes an agent useful — reading tickets, sending replies, updating records — is the access that turns a bad loop into a customer-facing incident.

Meanwhile, a Deloitte survey of US leaders found that only 20% say their organization is prepared for autonomous agents. 74% expect nearly half of business processes to be redesigned around agents within four years. 61% anticipate mostly autonomous agents. The named blockers: poorly documented processes, fragmented data systems, entrenched ways of working. (HR Dive)

Read that again. Four out of five organizations admit they are not ready. Most of them plan to deploy anyway.

The kill switch money

The security industry read the same numbers and opened its wallet.

CrowdStrike added an "AI Kill Switch" to Falcon Guardian. Authorized security staff can terminate a running agent, cut its network access, and prevent it from relaunching. One action, three consequences: the agent stops, its line to the outside world closes, and it stays down.

CrowdStrike also agreed to acquire Fiddler AI for a reported ~$400 million, per Axios. Fiddler does agent behavior monitoring, evaluation, traceability, and explainability — the "see what it did and why" layer.

Palo Alto Networks is reportedly in talks to acquire Clutch Security for roughly $500 million in cash plus possible milestones. That deal is not signed or confirmed — treat it as reported talks, not a done deal. Clutch focuses on identifying AI agents and controlling their access to enterprise systems. (AI Agent Store)

DigitalOcean shipped its own version of the idea at a different scale: Cuttlefish, a mobile app for supervising agents with approvals and controls.

The pattern is the point. CrowdStrike shipped the stop button and bought the monitoring layer. Palo Alto is reportedly buying the access map. DigitalOcean packaged approvals for your pocket. Stop it, watch it, gate it — every vendor bet on the same three jobs.

Add it up. A shipped kill switch, an agreed ~$400M monitoring buy, and a reported ~$500M access-control deal — inside one week. The market just told you what it thinks the hard problem is.

Our read: supervision is a control, not a vibe

Here is the asymmetry. A kill switch is not an accessory for your agent. It is the product boundary — the line between software that works for you and software that holds your credentials.

When two security giants spend a combined ~$900M on monitoring agents and controlling their access, they are pricing a simple fact: an agent you cannot stop is a liability with standing access to your accounts.

Your agent's permissions are your blast radius. Inbox access means it can send mail as you. A Stripe key means it can move money. A deploy token means it can ship code while you sleep.

Most small operators skip this part. They connect an agent to the inbox and calendar, hand it a Stripe key or a deploy token, enjoy a productive week — and never ask the overnight question: what do I do if it goes wrong at 3 a.m.?

Supervision is not watching a dashboard and feeling informed. It is the ability to stop the thing, see what it did, and limit the blast radius. If you cannot do all three, you are not supervising. You are hoping.

What to do before your agent runs overnight

Vendor guidance converges on the same short list. We condensed it into the checklist below — run it against every agent you operate, including the one you wired up last month and half-forgot.

1. Inventory every autonomous system. Write down each agent, the data it can reach, and the tools it can call. If an autonomous system is not on the list, it does not run. Most teams cannot finish this step. That gap is the finding.

2. Narrow the permissions. Every agent gets narrowly scoped credentials — not your master API key, not your personal OAuth grant. Each permission carries a named owner and an expiration date. When the date passes, access dies by default.

3. Wire a human-triggered stop. One step. A button, a command, a breaker you can hit from your phone. It must terminate the running process, revoke its credentials, and isolate the downstream tools it could still touch. That is exactly what CrowdStrike built at enterprise scale. Yours can be cruder. It cannot be absent.

4. Test the stop under realistic failure. Do not test while the agent is idle. Test mid-task — mid-draft, mid-payment, mid-deploy. A kill switch that fails the first time you need it is not a kill switch. It is a hope with a UI.

5. Keep the receipts. After any stop, you need to answer "what did it do?" in minutes, not after a forensic weekend. At enterprise scale that is the ~$400M Fiddler category: traceability and explainability. At your scale it is a readable run log you actually open.

This shape will look familiar. It is incident response with an agent on the other end — the same logic as our cyber resilience playbook, and the mid-sized breach wave shows what a blown blast radius costs at your size.

The operator's version of the week

The enterprise story is two security giants buying control planes for ~$900M combined. Your version is smaller and sharper.

None of this requires enterprise tooling. The same five-line checklist runs on a cron job, a config file, and one honest test.

Before your agent runs tonight, ask one question: can I stop it in one step, from my phone, and see what it did?

If yes, you are ahead of the 80% of organizations Deloitte says are not ready. If no, you know what to build first — and it is not another prompt.

Do the one-step stop test tonight. Then read our founder's note on automation for how we think about putting real access behind real controls. If your agents run on prompts, the Prompt Ops guide covers the discipline side.