Only 14% of companies can cut off an AI agent's access within minutes: control is the new frontier

By El Ecosistema Startup (based on VentureBeat) · October 19, 2026.

Only 14% of companies that answered questions about revocation in VB Pulse's September survey say a designated person can cut off an AI agent's access within minutes. The figure comes from an analysis by VB Intelligence, VentureBeat's research unit, published on October 19.

The earlier August survey already pointed the same way. According to that data, half of respondents had agents in production, and 61% of that group shared credentials across agents.

The two figures are directly linked. A shared credential makes workloads depend on each other: if you revoke it to stop a compromised agent, you also stop every other agent that uses the same access. What should be a security response turns into an unplanned outage.

**A caveat about the source.** The analysis draws on a conversation with Nir Chervoni, head of security products at Nebius, a cloud provider specialized in AI. VentureBeat discloses Nebius as a paid sponsor of its event coverage. The survey numbers and the evaluation framework are useful, but readers should keep in mind that the vendor has a stake in the conclusions.

**What Chervoni proposes.** These are familiar basics, applied to each agent:

- A separate identity for each agent, not a shared service account. - Short-lived credentials scoped to the specific task. - Centralized secrets management, instead of keys stored in environment variables or in code. - Customer-controlled keys, including the option to plug in the customer's own key management system (KMS). - Audit logs that feed into the security monitoring system the company already uses.

**Guardrails versus access policies.** Chervoni's quote sums up the distinction well: “Never rely on a guardrail to enforce something an access policy can enforce deterministically.” A guardrail is a model-level barrier that steers the agent away from an inappropriate action. But it does not take away the underlying permission: if the prompt is manipulated or the model gets it wrong, the permission still stands and the action is still possible.

**Confidential computing, with its limits.** The analysis explains that this technology extends protection to the moment data is processed. At that point traditional encryption no longer covers it, and model weights and sensitive data have to be decrypted in CPU and GPU memory. The key piece is attestation: cryptographic verification that the environment where the workload will run is what it claims to be. Keys are released only if that check passes.

The analysis itself notes that confidential computing does not fix application vulnerabilities. It does not stop prompt injection attacks (malicious instructions hidden in content the agent reads), and it does not govern what the model outputs. A compromised identity can still use its legitimate permissions even in a confidential environment.

**Residency is not sovereignty.** Chervoni suggests five questions for assessing a provider's isolation: how hardware is prepared between customers, how firmware and GPU memory are sanitized, whether a workload can reach management interfaces, which parts of the control plane are shared, and how the network is partitioned and tested. He also points out that residency tells you where the data is, while sovereignty also asks who can access it and who controls those protections.

**The market is moving in that direction.** Also on October 19, Fortanix announced support for Confidential Containers (CoCo), a CNCF project that reached incubation status in July, according to SiliconANGLE. Fortanix's Atomik Research survey of 300 AI leaders at large US companies found that 93% acknowledge traditional encryption does not protect data during AI processing, and 41% say they have blocked a deployment over security concerns. Both figures come from a company that sells into this market.

According to a ResearchAndMarkets report, the confidential computing market will grow from US$12.28 billion in 2025 to US$16.69 billion in 2026, and is projected to reach US$54.92 billion by 2030. As with any market-report projection, it is best read as an order of magnitude, not a promise.

**Our take.** The thesis is simple: the bottleneck for agentic AI is no longer how intelligent the model is, but whether it can be governed. We have handed authority to software that acts on its own, but most organizations have not built a selective off switch. However brilliant it is, an agent you cannot withdraw without stopping the business is a concentrated risk.

This fits with something we have been arguing: the real short-term danger of agentic AI is not some distant superintelligence but mundane failures of control, such as automated fraud or poorly scoped credentials. These are problems of operational hygiene, and that is why they can be solved. Per-agent identity, ephemeral credentials and deterministic policies require no scientific breakthrough, just discipline.

There is also a broader lesson: the guardrail is a user-experience layer, while the access policy is the real control. Anyone who confuses the two will find out the difference at the worst possible moment.

In fairness, the 14% comes from a survey whose size and makeup the article does not detail, and part of the framework comes from a vendor with a commercial interest. It works as a signal of direction, not as a census of the market. And the cheapest recommendation, timing a test revocation and seeing which other services go down, does not require buying anything from anyone.

**Why it matters in the long run.** The abundance agents promise, from automated biomedical research to companies run by very small teams, will only arrive if society trusts them with real tasks. That trust is built on demonstrable control infrastructure. The short term brings an uncomfortable transition, with incidents and companies learning the hard way. In the long term, those who have solved control will be the ones who can safely delegate the most.

The question that frames everything, raised by the article itself, is almost a maturity test: when an agent can no longer be trusted, can you shut it down without shutting down the business?