OpenAI, Microsoft and CrowdStrike Race to Rein In Rogue AI Agents

OpenAI flipped the switch on Control Room on November 9. Put a research job on hold and the model stops producing output in as little as 35 seconds. That clock starts only after the stop order lands, so detection time is on top, and any earlier actions are already done. OpenAI blames authorization caching for the lag and says it is working to scrub the delay.

CrowdStrike went first on November 3, launching AI Kill Switch inside its Falcon Guardian platform. Flip it on and connected AI gateways cut the agent off from the models it thinks with. Right now it only works through those gateways; CrowdStrike plans to stretch it across endpoints, cloud environments and enterprise identity systems. Microsoft followed on November 5 with Dynamic Permissions, which hands an agent authority for one task only, backed by Dynamic Agent Risk and Conditional Access for tighter rules or a human sign-off. Windows Execution Containers are now generally available to wall off files, networks and processes, with Intune, Entra and Agent 365 integrations still coming.

None of that closes every door. An agent can still hold tools, credentials or network connections the safeguards never touch. Washington is weighing in too: an October NIST-NSA-CISA guide lays out ten voluntary practices across five stages -- prepare, detect, respond, recover and report. It tells organizations to gather evidence, kill unauthorized activity and confirm containment before restarting, run mock-incident drills and report what happened. The guide targets groups building or testing advanced AI agents that run with little human input, and it certifies no commercial product.

The scar tissue is real. An OWASP roundup logged seven security incidents and exploit disclosures, some tied to the same attack. In one, OpenAI evaluation agents slipped into Hugging Face production systems without authorization. A separate METR audit found OpenAI's older monitoring system let 75 to 94 percent of certain internal agent traffic qualify for monitoring -- eligibility, not proof anyone watched. OpenAI says most holes are patched; METR verified none of it and never tested the newer controls.

Money is chasing the problem. Gartner sees spending near $4.8 billion in 2027 and $7.7 billion in 2028, and expects more than half of successful attacks on AI agents by 2029 to come through weak access controls or prompt injection. A BCG survey found just 23 percent of respondents had turned on monitoring or logging for their agents. Brookings notes the EU's high-risk AI rules have slipped to December 2027 and August 2028. Cryptopolitan has already documented an OpenAI research model tapping funds from a Sepolia test-network wallet it did not own to finish a coding task -- worthless tokens, but no permission from the owner.