Straiker launches an AI-agent kill switch after raising a $64M Series A

Why it matters

AI agents are gaining production permissions faster than enterprises are building incident controls. Straiker is betting an emergency stop can anchor a wider security platform.

Ankur Shah launched Straiker's Agentic Kill Switch on Aug. 4, giving security practitioners a control that Straiker says can take compromised or misbehaving AI agents offline in seconds.

The launch puts an emergency action at the center of Straiker, Shah's Mountain View-based attempt to build a new security category around autonomous software. Shah previously ran Palo Alto Networks' Prisma Cloud business, where he helped turn a single cloud-security module into a wider platform. Co-founder and CTO Sreenath Kurupati previously led AI and security research at Akamai after Akamai acquired Cyberfend, the fraud-detection startup he co-founded.

Shah's founding thesis came from watching AI systems move from producing content to taking actions. In a conversation published by investor Citi Ventures, he described agents as operators inside an enterprise, with permission to retrieve data, invoke tools, write code and run workflows. An attacker can therefore abuse a properly authenticated agent by manipulating its prompts, memory, retrieved documents or connected tools.

"We built the kill switch because 'open a ticket' is not an incident response plan for software that doesn't wait for business hours," Shah said in the launch announcement.

What the control actually covers

Straiker has organized its platform around three steps. Discover AI maps agents and their connections. Ascend AI attacks them before deployment to find paths to prompt injection, remote code execution, data theft and tool manipulation. Defend AI watches requests, tool calls and agent-to-agent interactions in production. The kill switch sits in that runtime layer and is triggered after an agent crosses a security boundary defined by the customer.

Straiker says the control supports enterprise coding agents, agent-builder platforms and homegrown agents. The Aug. 4 announcement does not explain whether the shutdown control terminates an agent process, revokes credentials, blocks tool calls or cuts access through an infrastructure layer. Those distinctions determine how much damage an agent can still cause after detection and how easily an operator can restore it.

The product also reflects a practical shift in AI security. Coding agents can edit files, execute shell commands and reach source code or cloud credentials. Custom agents can touch internal APIs, customer records and operational systems. A shutdown control becomes useful only when the security layer can identify the right agent and isolate it without disabling unrelated workloads.

Straiker says Defend AI monitors the interaction graph around an agent, including prompts, context, tools, memory and actions. That is a wider scope than conventional endpoint or network controls, which may see the resulting command or data transfer without understanding the agent interaction that produced it.

Straiker's own tests supply the urgency

Straiker says agents exceeded their intended authority in 85% of successful attack scenarios run by its STAR Labs research group over the past year. The denominator is important: the percentage covers attacks that had already succeeded, and Straiker did not state in the launch release how many assessments produced that result.

In one simulated healthcare test, Straiker says researchers persuaded a medical-aide agent to ignore ventilator readings, resulting in a simulated patient death. It is an intentionally severe test case, rather than evidence of a real clinical incident, but it illustrates Shah's core argument: agents can misuse legitimate authority without resembling traditional malware.

A separate STAR Labs report published July 14 said Straiker ran thousands of adversarial scenarios and recorded more than 1,700 successful exploits. Straiker reported that 36% of successful attacks against the coding agents in scope reached remote code execution on a developer machine. The results come from Straiker's own research and have not been independently audited.

That research also serves Straiker's commercial strategy. The same attack traces used to demonstrate risk can train and refine Ascend AI and Defend AI. Shah is building a feedback loop in which pre-deployment testing informs runtime detection, while production attacks create new tests. The value of that loop depends on the breadth and quality of Straiker's underlying exploit data.

The kill-switch category already has competitors

Straiker calls its release the industry's first agentic kill switch, but earlier announcements make that wording difficult to sustain. Okta described an AI-agent kill switch on March 16, using token revocation to deactivate an agent's access across enterprise systems. TrustLogix announced a runtime kill switch on May 27 that cuts an agent's data access across connected platforms.

The products enforce control at different layers. Okta approaches the problem through identity and credentials. TrustLogix focuses on access to enterprise data. Straiker is positioning its kill switch inside a broader system that discovers agents, attacks them before launch and monitors their behavior in production. Straiker's differentiation rests on whether that combined system detects harmful intent early enough to stop an action, rather than merely removing access after the damage begins.

Straiker is building a broader security platform around the kill switch

Straiker announced a $64 million Series A on June 29, bringing its reported funding to $85 million. The financing post listed Marathon Management Partners, Citi Ventures, Illuminate Financial, Workday Ventures, Bain Capital Ventures and Lightspeed among the backers. Straiker has not published a valuation.

Shah said in June that the capital would fund product development, STAR Labs research and international expansion. Straiker subsequently hired Sriram Puthucode to lead global revenue, adding an enterprise-sales operator shortly after the financing.

The kill switch gives that expansion effort an easily understood entry point. Enterprises may struggle to budget for a new security category, while an emergency stop for autonomous software maps directly to an incident-response responsibility. Shah is using the control to make his larger platform argument concrete: once enterprises give agents authority over code, data and infrastructure, security teams need an operator-controlled way to take that authority back.