Orchid Security gives enterprises a kill switch for rogue AI agents

Identity security startup Orchid Security Inc. today added identity drift detection and application-level kill switches for artificial intelligence agents to its Identity Control Plane.

The controls are meant to let security teams strip an agent of its authority the moment its behavior moves outside what was approved.

Agents rarely have to defeat a security control to exceed their intended scope, according to the company. They inherit the problem instead. Hard-coded credentials, dormant accounts and unmanaged authentication paths are already sitting across most enterprise application estates, and an agent working at machine speed can chain them into elevated access in seconds to minutes.

Orchid’s report “The Identity Gap: 2026 Snapshot,” published in May, found invisible identity outnumbering the visible kind 57% to 43%. Two-thirds of nonhuman accounts in that sample had been provisioned inside applications, out of view of identity and access management tooling.

Five capabilities are available now. Orchid tags applications, identities and access paths with an AI readiness status. Orphaned, dormant, over-permissioned and suspicious accounts are surfaced as hygiene findings. Drift detection runs continuously, comparing what an agent was built to do against what it is actually doing. Response is orchestrated through whatever identity and security tooling the customer already runs, and an audit generator documents the agent activity, the identity behind it, the drift detected and the action taken.