Enterprises Can Watch Their AI Agents. Most Still Cannot Stop Them.
Enterprises are getting better at seeing what their AI agents do. They are much less prepared to stop them. Monitoring can show that an agent changed a permission, sent an email, or executed a command, but once the action appears in a dashboard, it may already be complete. The harder problem is constraining agent behavior before execution.
Kiteworks' 2026 Data Security and Compliance Risk Forecast puts numbers around that gap. The survey covered 225 security, IT, and risk leaders across ten industries. Every respondent has agentic AI on the roadmap, and half are already running agents in production. The oversight picture looks healthy at first glance, with roughly six in ten organizations reporting continuous monitoring and human-in-the-loop review. Then the containment questions arrive, and the picture inverts. Sixty percent cannot quickly terminate a misbehaving agent. Sixty-three percent cannot enforce purpose limitations, meaning an agent granted access to a system for one task faces no technical barrier to using that access for another. Fifty-five percent cannot isolate an AI system from the broader network if something goes wrong. Across the board, the controls built to watch AI run fifteen to twenty points ahead of the controls required to stop it.
How the industry ended up here
The sequencing makes sense when you trace it. Monitoring was the natural first investment because it was cheap to add, it satisfied the early governance checklists, and it borrowed directly from the observability practice teams already knew. So enterprises built logging, tracing, and dashboards, and those tools generally work. They produce a complete, organized record of an incident. The record just begins after the action has already executed.
That ordering was a defensible trade when the output of an AI system was text, because the worst case was a bad answer and a human sat between the model and any real consequence. Agents removed the human from that position, and the nature of the action changed with them. Once an agent is changing an access permission, sending an external email, modifying a customer record, or running a shell command, the action completes at machine speed, and the log entry describing it arrives afterward. No amount of dashboard quality changes that ordering.
These failure modes are now documented in realistic, tool-connected environments rather than isolated benchmarks. In February, a research team spanning Northeastern, Harvard, MIT, Stanford, Carnegie Mellon, and other institutions published the results of a red-team study called "Agents of Chaos" involving twenty AI researchers in a live laboratory environment. They watched agents disclose Social Security numbers through an apparently routine forwarding request, comply with spoofed identities requesting privileged actions, and turn a short-lived monitoring task into persistent background processes with no termination condition. That last failure required no adversary at all, just an agent with broad permissions and an ambiguous instruction.
What matters most is not that the agents failed, but that their behavior was inconsistent. The same agents, under the same conditions, also produced genuine safety behavior, including one agent that correctly refused fourteen consecutive prompt-injection attempts. The failures and the successes came from the same underlying model behavior. An agent that resists an attack today may comply with a rephrased version tomorrow or after a model update. You cannot build a control on behavior that varies. You can only build a control on something that evaluates that behavior from outside it.
Why the fix can't live in the prompt
The instinctive response is to constrain the agent through its instructions, with tighter system prompts and behavioral guidelines. But instructions are inputs to the same model that processes untrusted content. They can be overridden by prompt injection, invalidated by a model update, or lost under a sufficiently confusing task. A prompt is a request. It is not a control, because nothing verifies it was honored.
The external pressure is moving in the same direction. Six national cybersecurity agencies, including CISA, the NSA, and the UK's NCSC, jointly published agentic AI guidance this spring that puts least-privilege enforcement and the ability to constrain and terminate agents at the top of the expected control set. On July 27, 2026, the EU’s Digital Omnibus on AI entered into force, just days before additional provisions of the AI Act become applicable on August 2. The AI Act, as amended, requires covered systems to address risk management, logging, human oversight, and cybersecurity. Meeting that standard will require more than prompts and post hoc visibility. Enterprises will need controls that can evaluate and constrain agent actions before they execute.
What enforcement at that boundary requires
Intercepting an agent action before it executes makes enforcement possible, but it does not determine whether the action should be allowed. That requires policy and evaluation. The policy should exist independently of the application code and define what is permitted, which agents and users it applies to, and the business context in which it should be enforced. Evaluation then determines whether the proposed action violates that policy. A pattern can detect an account number, but it cannot determine whether an agent has quietly expanded the task it was given. Different questions require different evaluation methods, and those results have to be combined into a decision.
That decision should not always be allow or block. In many cases, the better response is to redact sensitive data, require human approval, restrict the action, or record the event for review. A customer support agent drafting an external email with account details may not need to be stopped entirely. The sensitive fields could be removed, or the message could be held for approval. The goal is not simply to prevent actions. It is to apply policy before execution while allowing legitimate work to continue.
Why existing platforms may not close the gap
Existing security platforms will add more AI controls, and some will become meaningful competitors in this category. But most begin from architectures built for traffic inspection, access control, posture management, or observability. Those foundations are useful, but they do not automatically provide a policy model that reasons about each agent action in business context, can be versioned independently of application code, and supports responses beyond allow or deny. Whether incumbent platforms can extend into that model remains an open question. Adding AI inspection is not the same as creating runtime governance.
Enterprises have built visibility faster than control. Kiteworks projects that a quarter to a third of organizations will still lack basic termination capability at the end of 2026. The question is no longer whether enterprises can see agent behavior. It is whether they can act on it in time.
Sources: Kiteworks 2026 Data Security and Compliance Risk Forecast Report (n=225); "Agents of Chaos," Shapira et al., arXiv:2602.20021, February 2026; CISA, NSA, ASD’s ACSC, Canadian Centre for Cyber Security, NCSC-UK, and NCSC-NZ, “Careful Adoption of Agentic AI Services,” April 2026; Regulation (EU) 2026/1744, Digital Omnibus on AI, July 2026.
