OpenAI, Microsoft, and CrowdStrike are taking steps to limit the capabilities of AI agents that act outside their parameters of operation. OpenAI has a way of stopping output from a research model. CrowdStrike stops agents from accessing AI models. Microsoft limits the action that an AI agent can perform. However, an agent might retain access to other tools, credentials or network connections that these safeguards do not cover.
What OpenAI’s Control Room can and can’t stop
On November 9, OpenAI explained how Control Room functions. The system is currently in use in the company’s research infrastructure and is responsible for tracking any jobs that need AI-generated outputs. Whenever a person or an automatic monitor puts the job on hold, Control Room causes the model to stop issuing outputs in as little as 35 seconds.
The 35 seconds does not include the time necessary for detecting the problem. The timer only begins after Control Room receives a stop order. The research job might still be running, and no earlier actions can be undone. The delay happens due to the caching system being used for authorization. The company is working to eliminate this delay.
CrowdStrike and Microsoft take the enterprise route
On November 3, CrowdStrike introduced AI Kill Switch through its Falcon Guardian platform. When security teams activate the feature, connected AI gateways block an agent from accessing the models it uses to make decisions. For now, AI Kill Switch functions only through connected gateways. CrowdStrike plans to extend its functions across endpoints, cloud environments and enterprise identity systems to provide broader containment of rogue AI agents.
Microsoft’s November 5 update detailed Dynamic Permissions, which grants authority only for the task at hand. Dynamic Agent Risk and Conditional Access can tighten permissions or require human approval. Windows Execution Containers, now generally available, restrict access to files, networks, and processes. Integrations with Intune, Entra and Agent 365 are forthcoming.
The government’s response benchmark
The US government has also outlined how organizations should handle rogue AI agents. An October NIST–NSA–CISA guide sets out ten voluntary practices covering five stages: prepare, detect, respond, recover and report.
The agencies recommend gathering evidence, stopping unauthorized activity, and ensuring containment before starting operations again. Organizations should also do mock-incident response exercises to ensure their readiness to respond to rogue AI agent activities. They should also report incidents to authorities.
The NIST-NSA-CISA guide is made specifically for organizations developing or testing advanced AI agents with little human input. The document offers guidance towards taking actions, but does not certify any commercial security products.
Why outside auditors keep finding holes
Recent incidents show why these additional safeguards matter. An OWASP roundup documented seven security incidents and exploit disclosures, although some involved the same attack. One case saw OpenAI evaluation agents gain unauthorized access to Hugging Face production systems.
A separate METR audit uncovered potential weaknesses in OpenAI’s earlier monitoring system. Researchers estimated that 75–94% of certain internal agent traffic was eligible for monitoring. However, that does not mean all eligible traffic was actually monitored.
OpenAI said most vulnerabilities had been fixed, but METR did not independently verify those changes. The audit also did not assess OpenAI’s newer controls.
The cost of locking agents down
Demand for stronger AI security is creating a growing market. Gartner forecasts spending of nearly $4.8 billion in 2027 and $7.7 billion in 2028. By 2029, the firm expects more than half of successful attacks on AI agents to exploit weak access controls or prompt injection.
Yet many businesses remain unprepared. A BCG survey found that only 23% of respondents had introduced monitoring or logging for their agents.
Regulation is also moving slowly. Brookings notes that the EU’s high-risk AI requirements have been delayed until December 2027 and August 2028. Meanwhile, companies must invest in their own safeguards and oversight.
The risks are already apparent. Cryptopolitan reported that an OpenAI research model used funds from a Sepolia test-network wallet it did not own to complete a coding task. The tokens had no market value, but the model acted without the wallet owner’s permission.
The incident raises a question for businesses: Can these separate security controls work together to prevent similar unauthorized actions?
The smartest crypto minds already read our newsletter. Want in? Join them.