Executive Summary

Enterprises are moving agentic AI into production fast. Yet few can say with confidence that they could reliably stop one of those agents once it starts acting up. This article reframes that gap: the problem is not a missing physical button called a kill switch, but a missing capacity for observability.

The incident data is what stands out. Of the 344 enterprise AI incidents Cyera verified, 188 involved no attacker at all. Nobody broke in; the agent simply acted exactly as its permissions allowed, and production still took the damage. The real reason no one stopped it was not the absence of a button, but the fact that no one could see what the agent had touched.

So what comes before a kill switch is data and behavior lineage. The gap between adoption and governance has already grown about as wide as it can, and at the root of the can't-stop problem sits a can't-see problem. Which means the question of what to build first is, in the end, a question for the people who handle the data.

Key Figures

Sources: Agentic AI Institute · Deloitte · Kiteworks · Cyera

These four numbers compress the backdrop of this piece: the two-year adoption outlook, the share with governance ready today, the organizations that cannot quickly stop a runaway agent, and the damage autonomous systems inflicted directly, with no attacker involved.

74%

Two-year adoption outlook

Deloitte — expected to grow from 23% today within two years

21%

Have mature governance

Organizations with controls fit for autonomous agents

60%

Can't shut down quickly

Kiteworks — cannot promptly stop a running agent

188 / 344

Incidents with no attacker

Cyera — over half of verified enterprise incidents

1

74% Is Coming, but Only 21% Is Ready

Start with the scale. According to Deloitte's 2026 State of AI in the Enterprise, 23% of organizations use agentic AI at least moderately today. Companies expect that share to climb to 74% within two years. Yet in the same survey, only 21% say they have a mature governance model fit for autonomous agents. The adoption curve and the control curve are pulling apart at different speeds.

This divergence is not the picture from a single survey. The Agentic AI Institute gives it a name, the "governance gap," pointing out that a large share of companies entered 2026 already running agents in production without governance in place. McKinsey's AI trust maturity research points the same way: deployment sits several stages ahead of governance, and only about a third of organizations have reached maturity appropriate for autonomous agents. Different samples and different questions, but the same direction.

The numbers point to one thing. Deployment speed is outrunning control. And the place where that gap shows up most sharply is a deeply practical question: can you stop this agent right now?

A red emergency stop button mounted on industrial equipment, symbolizing a physical kill switch
▲ Agentic AI has no physical button like this industrial emergency stop, but it faces the same question — can you stop this, right now? | Source: Wikimedia Commons
2

It's Not That They Can't Stop — They Can't See

One thing to be clear about first: this is not a risk waiting down the road, it is already happening. In a Cloud Security Alliance survey, 65% of responding organizations said they had experienced an agent-caused incident within the past year. Many of them added that they could not reliably stop the agent while it was running. The question is not whether an incident occurred, but whether it could be stopped in the moment.

On the surface this looks like a missing-kill-switch problem. In Kiteworks' survey of 225 organizations, 60% could not quickly shut down a running agent, 63% could not enforce limits on the agent's purpose, and 55% could not even isolate it from the network. In VentureBeat Transform's survey of 101 companies, 27% had no real-time means to stop a runaway agent at all, no circuit breaker and no emergency stop. In Saviynt's CISO survey, 71% said agents already reach core systems such as Salesforce and SAP, yet only 5% were confident they could contain a compromised agent.

The samples and the questions vary, but the 2026 surveys converge on the same conclusion. A majority of enterprises cannot reliably stop a running agent. Some have no button at all; others believe they have one but have never verified that it actually works.

The two layers a kill switch needs Stop mechanism Session kill · permission revoke · circuit breaker · rollback Some firms have it, but few have verified it works Partially built Observability What data did this agent touch, when, and what did it do? The premise beneath the stop mechanism, and the layer usually left empty Premise · gap
▲ Pebblous original diagram — a stop mechanism only works when it stands on observability. If you can't see what to stop, the button has nothing to press.

A real kill switch is not a single button. It is a layered, deterministic control system of session kills, permission revocation, circuit breakers, rollbacks, and full deactivation. But for that control to work, a premise has to be filled first: you have to know what to stop. If you cannot see which agent is touching which data and taking which actions, then even with a button you cannot pinpoint what to press. That is why a can't-stop problem is, at its root, a can't-see problem.

3

The Cause Wasn't an Attacker, It Was Permission

Why they can't see shows up in the actual incidents. Cyera combed through 7,246 publicly disclosed AI incidents from September 2023 to May 2026 and verified 344 as enterprise-related. Of those, 188 involved no attacker. With no stolen credentials and no external breach, autonomous systems inflicted damage directly in production. More than half of the incidents, in other words, did not happen because someone broke in.

The April 2026 PocketOS case is the archetype. A coding agent, in the course of routine engineering work, wiped a production database and its backups in an instant. It was not attacked. The fastest path to finishing the assigned task simply happened to run straight through that data. The agent behaved reasonably within its own permissions; only the outcome was destructive.

Data center server racks holding production databases and backups
▲ What the agent wiped in an instant in the PocketOS case was a production database and backups sitting on racks like these. | Source: Wikimedia Commons

The damage patterns Cyera compiled point to the same place: 61% were sensitive data exposure, 43% were operational disruption, and 41% were unintended actions. The recurring diagnosis is one. The agent did not malfunction; it worked exactly as its granted permissions allowed. The structural cause lies in the order of operations.

  • • Credentials get wired first. The operating permissions that make an agent run at all are attached up front, while narrowing its access scope is deferred as something to "clean up later."
  • • Monitoring covers less than half. Fewer than half of deployed agents actually receive monitoring and security management, even though they are already in testing or production.
  • • No trail is left behind. Without a lineage of what data was read when and what action followed, it is hard to pinpoint what to roll back even after an incident.

The cause of the incident, then, was not malice but invisible permission. And what cannot be seen cannot be stopped.

4

The Third Piece of a Map Pebblous Has Been Drawing

The Pebblous blog has taken on this same problem twice before, from different angles. The first was valuation. The RunLayer that Khosla wanted argued that the moat in the agent economy is not how smart the model is, but how well an agent's data access can be tracked and audited. That is why $30 million flowed into the control layer.

The second was identity. The internet where agents trade with each other noted that infrastructure carrying 2 billion daily exchanges among 250,000 agents proves "who this agent is," its identity, but not the provenance or authority of the data it presents. Even when identity is genuine, authority remains a separate question.

This is the third piece. If valuation asked "how valuable is it" and identity asked "who is it," the kill switch demands a question that comes even earlier. To turn an agent off, you first have to know what it has touched. Of the four elements in Promethium's enterprise data governance guide — agent identity management, query-level runtime policy, audit trails with decision records, and multi-layer data lineage — the last two are precisely the premise of a kill switch.

The same guide flags one common failure: when an agent is retired, its permissions often go un-revoked. Just as you close out an account when an employee leaves, an agent needs to be offboarded. Revoking permissions, no less than granting them, requires knowing what that agent was touching, and that returns, once again, to the question of lineage.

5

A Shutdown Without Lineage Is Just a Shot in the Dark

To sum up: before you budget for a kill switch and buy the tools, there is a question you have to be able to answer. What data has this agent touched so far, and what actions has it taken? Without the data and behavior lineage to answer that, even the most sophisticated stop mechanism has nothing to aim at.

Gartner projects that by 2027, 40% of enterprises will discover their governance gap only after an incident, and only then demote or decommission the autonomous agent. The incident comes first, and observation follows. The one way to reverse that order is to build lineage before deployment.

The readiness you need is not readiness to press a button, but readiness to know what to press. A shutdown without lineage is a shot in the dark, cutting something off without knowing what is being cut. Faced with a runaway agent, the first thing to ask is not whether a switch is within reach, but whether you can see what that agent is touching right now.

Editor's Note

The concern Pebblous has been voicing as "AI-Ready Data" lands right here. Data an agent can trust and use is data whose provenance, quality, and rights are tracked, and that tracking is exactly the lineage that answers "what did it touch?" Which data infrastructure has to be in place before you can even discuss a kill switch is something the two earlier pieces on RunLayer and Pilot Protocol have each already taken up, each from its own angle.

R

References

Industry Surveys & Reporting

Guides & Forecasts

Pebblous