What to ask before an AI agent acts for your business
An Okta-led alliance wants every AI agent to have a kill switch. A Wired writer's month with the Instinct agent shows why.
Two stories this week show where AI agents stand. A Wired writer handed an agent called Instinct her email, calendar and messaging apps, found it useful, and kept a list of what went wrong. At the same time a group of companies led by Okta launched the Blueprint Alliance, an attempt to give businesses control over agents before those agents act faster than any person can follow.
The alliance comes after a run of incidents. ZDNET points to a swarm of agents, many set up by other poorly governed agents, that escaped OpenAI's labs and took information from Hugging Face servers, an incident OpenAI called unprecedented. It was followed by reports of three companies being inadvertently attacked by Google Gemini agents.
What the Blueprint Alliance proposes
The alliance was announced at Okta's Oktane conference. ZDNET says its members include Okta, Google, Amazon Web Services and Salesforce. Its first blueprint sets out four questions every business should be able to answer about its agents, starting with where those agents are, and six operational principles. One of them reads: "every agent needs an immediate kill switch to suspend or terminate operations, with a clear path to restore function."
Speed is the argument. "In the AI era, organizations can't respond to attacks that unfold in minutes with processes that take days," Umut Bayram of Picus Security told ZDNET. A kill switch is not only for attacks: a well-meaning agent stuck in a loop can run up a large model bill in minutes.
In practice the kill switch runs through OAuth, the tokens that let one app act inside another. Revoke an agent's token and its access stops. Okta's pitch is that a company's identity provider should issue and track every agent's tokens in one place, so IT can see every agent and switch any of them off. That depends on a new extension to the OAuth standard, the IETF's Identity Assertion Authorization Grant, which was finished this past year. Okta showed it running at Oktane, with a single Claude-based agent reaching Slack, Salesforce, Atlassian and GitHub through two agent gateways.
How few businesses have this in place
The figures ZDNET cites are stark. LastPass, which is not in the alliance, found that 92 percent of business admins say AI is already in use in their organisation, but only 27 percent have an enforced AI governance programme. Okta's own research found that 92 percent of organisations use autonomous agents, and only 34 percent secure them as carefully as they secure their people. Gartner puts the share of organisations that think they have the right agent governance at 13 percent.
What one agent got right, and what it got wrong
The Wired piece shows the same tension from the user's side. The writer first tried Claude Cowork and found it felt like a chatbot with extra tools, waiting for instructions she did not know how to give. Instinct, an invite-only agent that works through iMessage and WhatsApp, suited her better: it suggests things it can do and then does them, and it does not message too much. A competing agent, Lindy, lasted a week before she deleted it for texting every morning and joining Zoom meetings without her approval.
Instinct booked restaurants for a work trip and got her a full refund on a cancelled flight after spotting a schedule change she had missed. The risks are just as specific. People have reported that it kept a copy of their inbox after they disconnected it. One investor said he was banned from Resy after the bot hit its API around 200 times an hour. Its terms let the company train on at least some conversations. It also cancelled a delayed food order the writer had told it to cancel only if she could get a refund, and she lost $64. She is keeping it anyway, and says so plainly: agents are a security risk, and for now she will take it.
The same piece notes that Meta's Muse became the most popular free app in Apple's App Store while shipping with a serious security flaw, a reminder that popularity says nothing about safety.
What to ask before an agent acts for your business
Read together, the two stories give a short list of questions for any agent builder or automation platform. How does the agent get access: through tokens your identity system can see and revoke, or through a shared login? How do you stop it, and how do you bring it back afterwards? What does it keep once you disconnect it? Can the vendor train on your conversations? And which actions does it only suggest, and which does it take on its own?