Detect compromised agents and revoke them instantly with signed proof.
An AI agent goes rogue. You need to stop it immediately.
A rogue agent is one that has been compromised, is behaving maliciously, or is causing harm. MOSS detects rogue agents through anomaly detection and gives you a kill switch: instant revocation with signed proof. The revocation is recorded in the audit trail so you have evidence of when and why it was stopped.
const alerts = await fetch('https://api.mosscomputing.com/v1/rogue-alerts?limit=50', {
headers: { 'Authorization': 'Bearer ' + access_token },
}).then(r => r.json());
alerts.items.forEach(a => {
console.log(a.severity, a.agent_id, a.description, a.status);
});{
"items": [
{
"alert_id": "alert_001",
"agent_id": "agt_abc123",
"severity": "critical",
"description": "Agent exfiltrating PII to external endpoint",
"status": "active",
"detected_at": "2026-08-25T12:00:00Z"
}
]
}Revoke immediately stops the agent from signing any new actions. The revocation is signed with ML-DSA-44 and recorded in the audit trail.
await fetch('https://api.mosscomputing.com/v1/agents/{agent_id}/revoke', {
method: 'POST',
headers: {
'Authorization': 'Bearer ' + access_token,
'Content-Type': 'application/json',
},
body: JSON.stringify({
reason: 'Rogue agent: exfiltrating PII',
revoke_credentials: true,
notify: ['security@acme.com'],
}),
});// Suspend (temporary, can reactivate)
await fetch('https://api.mosscomputing.com/v1/agents/{agent_id}/suspend', {
method: 'POST',
headers: { 'Authorization': 'Bearer ' + access_token },
});
// Reactivate (undo suspend)
await fetch('https://api.mosscomputing.com/v1/agents/{agent_id}/reactivate', {
method: 'POST',
headers: { 'Authorization': 'Bearer ' + access_token },
});
// Rotate keys (compromised token, agent still trusted)
await fetch('https://api.mosscomputing.com/v1/agents/{agent_id}/rotate', {
method: 'POST',
headers: { 'Authorization': 'Bearer ' + access_token },
});Rogue Agent Defense complete!