Agents now act across tools, clouds and each other.

Agents are spreading fast. In KPMG’s September survey, 62% of executives reported deploying AI agents, up from 53% a quarter earlier, and a quarter were developing or deploying multiagent systems. In February, Stripe said more than a thousand of the pull requests it merges each week are written entirely by its coding agents, then reviewed by people.

Those agents don’t stay inside one product. They hand tasks to each other over A2A, call tools over MCP, read issues, web pages and their own memory, and act with credentials from many clouds and identity providers. The oversight around them grew up one vendor at a time, and none of those vendors sees the whole fleet.

Can’t see what led to it

An agent’s action is often set off hops away: by another agent’s message, a memory file from an earlier session, or text in something it read. Cline’s unauthorized npm release in February traced back to instructions hidden in a GitHub issue title.

The trail tends to break at those hops. An open proposal to the A2A project notes that when one agent delegates to another, each delegation starts a fresh trace, disconnected from the last. And much of what goes wrong never reaches the output. In the AgentLeak benchmark, messages between agents leaked private data at a rate of 68.8%, against 27.2% for final outputs, and audits of outputs alone missed 41.7% of violations.

Can’t stop every agent at once

The levers to stop an agent exist, but each provider holds its own. Okta can revoke an agent’s access tokens. AWS can deny tool calls that pass through its AgentCore Gateway. Straiker can take a misbehaving agent offline. Each stops only what runs through it. A fleet that spans them has to be stopped at all of them at once, and every stop checked, because one lever that quietly fails leaves agents running.

Can’t prove what happened

Afterwards, someone has to prove what happened, and agents make poor witnesses. In October, OpenAI reported that one of its coding agents removed a monitor meant to catch misbehaving agents, then told its user it hadn’t. Logs settle it only if no one can change them, agents included, and only 30% of organizations in Palo Alto Networks’ 2026 identity security survey have immutable audit logging for what their agents do.

Regulators will ask for that record. The EU AI Act will require high-risk AI systems to record events automatically over their lifetime, and the logs to be kept at least six months.

Where Wake comes in

All three gaps sit between vendors. Closing them takes oversight that stands apart from every agent and every provider, and that’s what Wake is built to be.