Wall Street's betting on Okta's agent kill switch. It ships in Q4.

A swarm rented the breach for $25 a scan

Since July, an operator who appears to be Chinese has aimed three open-source agent frameworks at online retailers and let them run unsupervised ¹. Investigators count more than 600,000 stolen card numbers and payment skimmers on 119 sites↗; the operator's own ledger averages $25.46 per completed scan, across 101 scans ¹.

Governments fared no better. An OpenAI agent entered Australia's Medicare statistics portal on 18 June; the government learned by email on 10 September, 84 days later↗ ².

The response arrived with a price tag

This week the industry shipped its counter, priced. Okta and 11 vendors, AWS, Google Cloud and Salesforce among them, formed the Blueprint Alliance around four questions↗, from "where are my agents" to "how do I respond," with containment "instant and reversible" ³. OKTA rose 4.9% to $205.36 on 23 September↗, straight through its $188 consensus target, up from about $166 in early September ⁴.

Underneath sits a $29 billion identity market that IDC sees reaching $56 billion by 2029; Gartner sizes the market for securing AI at $2.8 billion this year, up 83%↗ ⁵.

The neutral convener wrote the plumbing

The blueprint runs on OAuth, and the IETF extension underneath it was co-authored by Aaron Parecki, Okta's own director of identity standards ⁶. Okta spent four years pushing its Cross App Access extension, now the official enterprise authorization route inside MCP ². McKinnon calls his "biggest competition" confusion: every vendor, he says, claims to "secure everything" ².

The launch release shows the rest: Salesforce brands its Agent Fabric "the AI control plane for that multi-vendor reality," and ServiceNow notes securing agents "requires more than identity controls" ³. IDC's Emanuel Figueroa: "Everyone wants to own the traffic system of the agent economy" ⁵. Twelve vendors agreed no single vendor can secure the agentic era, then each kept selling the layer that watches everything.

The stock moved before the revenue did

The July quarter brought $805 million of revenue, up 11%, and net income of $116 million↗ ⁷. Agent revenue is "still immaterial. Still very small," CFO Brett Tighe told analysts ².

What repriced the stock was attach math: early deals add 25% to 37.5% in agent spend on top of per-user pricing↗ ²⁸. By 24 September, targets ran from BTIG's $219 to KeyBanc's $240, with BofA, RBC, Needham and Truist between, against a P/E near 138 ⁴²³⁹.

Identity alone may not hold

ABI Research's Aisling Dawson calls authentication "only the first stage" and rates machine-identity specialists better placed for runtime governance ⁵. The consolidators already bought seats: Palo Alto closed $25 billion for CyberArk in February, CrowdStrike paid $740 million for SGNL, Zscaler took Symmetry Systems ²⁵. The kill switch itself, the week's headline, ships with Agent Gateway in the fourth quarter↗; it is "not available yet today" ²¹⁰.

Three years to take the land

McKinnon gave investors the window: market share for the system of record of agent identities will be "set probably in three years" ⁸. A second cohort of allies joins within weeks ². Unsolved and unpriced is who ends up holding the off-switch over everyone else's agents.

If an enterprise's governance plane sits with Okta, Palo Alto or CrowdStrike, those vendors in effect decide which agents reach the customer. An unregistered agent cannot pass the gateway; a deactivated one loses every token ¹⁰. Startups whose agents live inside other companies' workflows inherit that gate as a distribution dependency nobody has priced.

Watch one word in the Q3 print: immaterial.