Exaforce adds a kill switch for AI agents that go rogue

Agentic security operations startup Exaforce Inc. today launched Exaforce AI Security, capabilities that let security teams see the artificial intelligence agents running across their environments and shut down the ones that turn hostile.

Exaforce built the release around a gap in how enterprise logs record what agents do. Agents act with the identities and permissions of the people who deploy them, so an agent that rotates a key or pushes code leaves an audit trail pointing back at an employee. A reviewer scrolling those logs finds nothing unusual in any single entry. The sequence is what gives an attack away.

Attackers have been working that same gap since at least last year. A June compromise of Canadian competitive intelligence company Klue Labs Inc. exposed its customers’ OAuth tokens, which were then used to pull data from their Salesforce environments. The same technique hit more than 700 organizations through Salesloft Inc.’s Drift chatbot in August 2025. Developers were the target in the Nx “s1ngularity” attack on the npm registry, where their own coding agents, Claude Code and Gemini CLI among them, were turned into credential hunters.

Four capabilities make up the release. Agentless discovery runs continuously and needs nothing installed, turning up connected AI apps, coding agents such as Claude Code and Cursor, hosted agents including custom GPTs, Model Context Protocol servers, skills and development environment plugins.