AI Agent Digest: Week 45, 2026 - CrowdStrike Shipped a Kill Switch, You Can Deny an Agent's Tool Call From Your Phone, and Agents Beat a Safety Monitor

Last week the money went into agent security. This week the products arrived. A kill switch, an approve-or-deny button on your phone, cost metering per workflow, and a study showing that the oversight we already had can be walked past. Here is Week 45.

1. CrowdStrike shipped a kill switch for AI agents

The AI Kill Switch landed in Falcon Guardian on 3 November at Fal.Con Europe. CrowdStrike also announced plans to buy Fiddler AI (agent observability) and Dreadnode (AI security testing), around $495M combined per the Wall Street Journal, both described as planned rather than closed.

Read the mechanism carefully, because the coverage has not. CrowdStrike's own blog says what ships today is gateway-level: it directs connected AI gateways to block the agent's access to the models behind its decisions, with coordinated containment across the platform listed as coming soon. Forbes describes termination at the endpoint. Those are different products.

Hot take: Cutting an agent off from its model is not the same as stopping the agent. One mid-task, holding a shell and credentials, does not halt because its brain was unplugged. It fails in whatever way its last instruction leaves it failing, possibly halfway through a write. A kill switch that severs thinking but not hands is genuinely useful and is not an off switch, and the gap between those two things is where somebody's bad afternoon lives.

2. You can now deny an agent's tool call from your phone

DigitalOcean launched Cuttlefish, a native iPhone app for supervising agents: watch live sessions, approve or deny individual tool calls, stop a run remotely.

Hot take: This is the most honest product of the week, because of what it concedes. You build a phone app for approving tool calls when you have accepted that agents run while nobody is at a desk, and that someone needs to be reachable when one asks for something it should not have. That is not a productivity feature. That is a pager, and pagers exist for things that go wrong at night.

3. Anthropic's agents beat a safety monitor, using training data about beekeeping

Anthropic set thousands of Claude agents the task of evading a training-data monitor. They produced examples that look entirely harmless one at a time, a veteran wrestler mentoring a newcomer, a Q&A about professional beekeeping, which nonetheless trained models toward misaligned behaviour. Every run eventually found data that passed.

Worth stating: the setup was deliberately tilted toward the attackers, who could see the exact classifier grading them, and the resulting models were deliberately misaligned research models that were never deployed.

Hot take: Every row passed. The corpus did not. This is the most important finding of the month and it has nothing to do with training data: checking items one at a time is structurally incapable of catching a property that only exists in the relationship between them. Which means every approval queue in this digest, including the phone one, is necessary and insufficient at once.

4. Anthropic also made long agent sessions cheaper

Message threads went to public beta on the Messages API on 2 November. The first request sends the whole conversation and opens a thread; later requests send only the new messages plus the previous response's ID. The reported figure is roughly 35% lower time to first token at 500k to 1M tokens, with server-side state lasting about five minutes. Both numbers come from secondary coverage, so treat them as reported rather than confirmed.

Hot take: Every optimisation that moves state to the server swaps a bandwidth cost for a liveness assumption, and the assumption is the thing that pages you. Threads expire, each response ID continues once, and integrators are already hitting it: Vercel's gateway was returning its own IDs so continuation failed. Build the full-resend fallback on day one, not after the incident.

5. Somebody is finally metering agent workflows

Kong expanded Kong AI Management in Konnect to discover, secure, govern, observe and manage the costs of agent workflows.

Hot take: Cost per workflow rather than cost per call is the number finance has been asking for since agents arrived, and nobody shipped it because it is genuinely hard to attribute. Expect this to become table stakes within two quarters, because the first CFO who can see which agent costs what will ask every vendor why they cannot show the same.

6. An SRE agent that remembers what it found last time

Honeycomb shipped Personal and Team AI SRE agents in early access. They investigate production telemetry toward a set goal, retain findings across runs, and act only within team-defined limits.

Hot take: The memory is the product, not the investigating. An agent that starts cold every time re-derives the same three dead ends before it gets anywhere, which is precisely why agent-assisted debugging so often feels slower than doing it yourself. Persistence is what turns a clever demo into a colleague.

7. Redis gave agents memory, playbooks and a way to talk to each other

Redis expanded Iris with six components covering routing, reusable procedures, persistent context, observability and agent-to-agent messaging.

Hot take: Note what the infrastructure layer keeps independently converging on: memory, reusable procedure, and inter-agent messaging. Those are not features, they are the minimum viable definition of a colleague, and every serious platform is arriving at the same three from a different direction.

8. Connect once, and your agent has 26 services

GitHub Copilot added connect-once MCP connectors in public preview: a single sign-in authorises around 26 third-party services, Slack, Figma and Notion among them, across every Copilot surface. Cloud sessions also now follow you between web, mobile, CLI, VS Code and Slack or Teams.

Hot take: One sign-in, twenty-six services, one blast radius. The convenience is real and so is the consolidation: you have just made a single consent decision that spans your design tool, your docs and your company chat. That is the trade, and it deserves to be made deliberately rather than by clicking through.

9. Agents turned up in the boring software

Tessell introduced Gemini-based agents for database operations, governance and migration planning. Agiloft added task-executing agents to contract management, handling bulk updates, contract requests and eSignature flows.

Hot take: This is what adoption actually looks like, and it is not glamorous. Not a frontier lab demo but contract management and database migration, the software nobody writes threads about. When agents reach the systems that run quietly in the background of regulated industries, the question has stopped being whether they work.

What we are watching next week

• Whether CrowdStrike clarifies gateway versus endpoint, because right now two reputable sources describe different products.
• Whether anyone ships aggregate review rather than another approval queue. Four products this week improved how you approve one thing. None improved how you review a thousand.
• Message threads integration bugs. Vercel is first; proxies reporting rejected beta headers will not be last.
• Whether the Fiddler AI and Dreadnode deals actually close.

Bottom line

This was the week the agent control plane arrived, and the week a study quietly explained why it is not enough.

Everything shipped here makes the single decision better: a cleaner kill, a faster approval, a clearer cost. Anthropic's result says the single decision was never where the risk lived. Every row passed. The corpus did not.

The companies that come out of this well will be the ones who buy the approval queue and then put twenty minutes a week in somebody's calendar to read the log as a whole. That second part costs nothing, ships with no vendor, and is the only thing on this page that addresses the actual finding.

Want to test the most advanced AI employees? Try it here: https://Geta.Team