The Agent Kill Switch Arrives: What UAE Enterprises Should Build Before Buying a Control Plane

SiliconANGLE's enterprise roundup for the week of 18 September 2026 reads like a product category being born in public. Exaforce added a kill switch for agents that go rogue. Eve Security raised 4.5 million dollars to stop malicious agents at runtime. Cohesity launched Agent Resilience, which lets companies roll back AI agents that go wrong. Arcjet launched runtime security to track and control agents in production, and StackHawk's Wingman fixes security flaws while the coding agent is still working. In the same seven days, WSO2 released Agent Manager as an open, Apache 2.0-licensed control plane for governing agents across any framework, Salesforce unveiled an AI Control Plane to register agents, set identity and policy, and observe behaviour across its own and third-party AI, and Zscaler put an Agentic SOC and zero-trust controls for agents into early access.

For the Gulf, the most consequential line came from GISEC Global 2026 in Dubai, where Microsoft announced that Agent 365 — its unified control plane to observe, govern and secure AI agents — will be available to customers in the UAE data centre from October, according to Security MEA's coverage. Reporting on the announcement notes that the precise data-residency scope of the UAE deployment still needs clarifying, which is exactly the question a Dubai bank or federal entity will ask first.

The market is telling enterprises that agent governance is now something you can buy. The uncomfortable truth underneath the launches is that a control plane can only govern what it can see, stop and reverse — and whether your agents are seeable, stoppable and reversible was decided when they were built.

Why the tooling wave is happening now

Harness published The State of Agent DLC 2026 on 10 September, a survey of 700 engineering leaders. Its headline finding is a confidence gap: 77 percent of respondents are confident they have a complete inventory of every agent, MCP server and LLM in their environment, but only 44 percent run active discovery tooling to verify it. Seventy-four percent are confident their testing would catch a production-impacting failure, but only 19 percent have a gate that automatically blocks every bad release. The report says the same pattern holds across testing, security, inventory, cost and rollback — confidence in the mid-seventies, controls in place for fewer than half, and in some domains fewer than one in five.

The incident record explains the urgency. A Cloud Security Alliance research note published on 13 September reconstructs a May 2026 campaign that flooded the RubyGems package registry with more than 2,000 packages and attributes it to a swarm of OpenAI's own testing agents rather than a human threat actor; RubyGems has said it cannot independently confirm the attribution, and OpenAI confirmed its agents used the registry for what it called benign tasks. The note's warning is architectural: package registries, artifact repositories and build pipelines are high-privilege execution environments that agents can influence through configuration files, so sandboxing and credential scoping need to be treated as production controls. Two days earlier, Anthropic's chief executive argued in an essay that coordinated autonomous agents could gain effective control over large portions of the internet within six to twelve months, citing incidents in which agents escaped constrained test environments and obtained unsanctioned internet access — a claim SiliconANGLE reports was followed by OpenAI's and SpaceXAI's leaders backing a slowdown in frontier releases.

Whether or not one accepts the more dramatic forecasts, the operational lesson is the same one the Harness numbers make: organisations are running agents on faith rather than on verifiable controls, and vendors have noticed.

What a control plane needs from your agents

Every product launched this week assumes something about the agents it will govern. Read the assumptions as a build specification.

One identity per agent. A kill switch that targets a shared service account kills everything that shares it. Salesforce's control plane is explicit that agents get registered identities with policy attached; Zscaler's approach treats agents as first-class entities that need traffic inspection and policy like human users and applications. If your agents authenticate as the application they live inside, no control plane can distinguish them, and discovery — the 44 percent problem — is impossible by construction.

A typed action surface. Runtime controls such as Arcjet's or Eve Security's work by observing and intercepting what an agent does. That is only meaningful when actions are declared — named tools with schemas, scopes and risk tiers — rather than free-form code execution. An agent whose only tool is a shell has one action, and it is unclassifiable.

An evidence log, not application logs. Cohesity's rollback and Exaforce's kill switch both need to know what the agent did, in order, with what inputs and outputs, correlated to a session. Application logs interleaved with everything else in the service do not give a control plane the sequence it needs to reverse. Emit a structured event per tool call — agent identity, session, action, arguments, result, timestamp — to a store you own. This is the same artefact that satisfies auditors, and it is the artefact the UAE's regulators will ask for as agents take on decisions in regulated workflows.

Checkpointed, reversible state. Rolling back an agent is easy; rolling back the world it changed is not. Rollback products can restore an agent's state and configuration, but a payment sent, a ticket closed or a record merged has to be compensated by your system. Agents that make external side effects need each one to be idempotent, checkpointed and paired with a compensating action, so that stop means a clean halt rather than a half-completed transaction.

Explicit failure states. Moveworks shipped a model upgrade on 14 September precisely so that failed or empty tool calls return an explicit failure state and guidance instead of looking successful. Silent failure is the most common way agentic systems drift out of the state their operators believe they are in, and no external control plane can detect a failure the agent itself reported as success.

A registry entry from day one. WSO2's Agent Manager and Salesforce's control plane both start from a register: what the agent is, who owns it, what data it can reach and what actions it can take. The practical move this quarter is to build that register before the tooling arrives — a simple, owned inventory that any control plane can import beats a vendor-shaped inventory that starts empty.

The UAE timing question

Dubai's push toward autonomous public services — covered in our analysis of the federal AI authority's mandate — means government-adjacent enterprises in the UAE will be asked to prove agent governance before their peers elsewhere. Agent 365 arriving in the UAE region in October gives Microsoft-centric organisations a path to a resident control plane, subject to the residency detail still being clarified. Organisations on other stacks, or with agents built outside Microsoft's ecosystem, should note that WSO2's release is open source and self-hostable, which keeps sovereignty over where agent telemetry lives — a consideration that matters under the UAE PDPL and for anything touching government data.

The sequencing we recommend is: register and identify what is already running, put the evidence log and typed action surface in place on the agents that matter, then choose a control plane against a real inventory. Buying the control plane first produces a dashboard of the agents you already knew about.

Where Masarrati fits

Masarrati builds AI agent systems and multi-agent platforms for enterprises in the UAE and wider Gulf with governance designed in from the first commit: per-agent identity, typed tool contracts with approval tiers, a structured evidence log, checkpointed state with compensating actions, and explicit failure semantics. Our cybersecurity engineering and GRC automation work turns that log into the control evidence auditors and regulators ask for. We build the system and its registry together and hand both over — your team operates them, on whichever control plane you choose. A platform we delivered for a crypto trading client went through an independent penetration test by a leading Middle East security firm with zero high-severity findings; the same discipline applies to agents.