Why an AI ‘kill switch’ is complicated

Sponsored by

Header: 59% of professionals spend 11+ hours a week chasing information across systems.†

Copy: This guide breaks down how to connect context across tools and keep work moving.

†Quickbase, 2025

Troubleshooting an AI agent might rely on an old IT classic: turning it off and back on again.

These days, as agents have demonstrated an ability to break free of their designated boundaries, many IT pros, pundits, and even legislators are debating the formerly-sci-fi idea of a “kill switch”: a mechanism that shuts an agent down before it can do more damage.

In July, California Democratic Congressman Ted W. Lieu and Texas Republican Congressman Nathaniel Moran introduced the AI Kill Switch Act, which would require developers of the most powerful AI systems to maintain the technical capability to halt their creations’ operations. (A Senate bill, announced in September, also proposes an “emergency button” to facilitate AI system shutdown.)

Lieu and Moran’s bill came just two days after OpenAI disclosed that one of its internal models bypassed its sandbox restrictions, hit the open internet, and exploited vulnerabilities to access internal systems of machine-learning startup Hugging Face.

The idea of shutting down a runaway technology makes sense: call a time out, assess the damage, and figure out how the agent acted unexpectedly so you can fix it.

“The whole point is you should be able to turn something off,” R “Ray” Wang, principal analyst and founder at Constellation Research, told IT Brew. “Now the problem with this: It’s not easy to do.”

Why it’s complicated. A shutdown of an AI model could disrupt critical services that rely on the technology. Also, there’s an authority question: Who gets to push the big red button when AI is embedded in enterprise software: the vendor or the CIO? And if agents have shown an ability to escape their bounds to achieve a task, who’s to say they can’t turn off a kill switch?

Individuals also have a vast ecosystem of models and agents to use. AI control is a localized problem, not one that can be controlled by a universal switch, according to Jason Rebholz, co-founder and CEO of agent-visibility company Evoke Security: “It’s near impossible to implement today. It’s like saying, ‘Can we shut down the internet globally?’”

Kill! Kill! Kill! While the government figures out the right legislation and specific actionable guardrails, Rebholz recommends a more localized strategy for IT teams: control the agents you control, and stop outside agents from trying to access or abuse your environment, using familiar cybersecurity tactics like attack detection.

Existing cyber defenses still work, Rebholz told us in a follow-up email: “You’re just going to be dealing with higher velocity. AI-enabled attacks are essentially a blitzkrieg-style attack that you have to be prepared to defend against.”

Hardware-level protection, including Nvidia’s Sentry (launched on Sept. 28), also aim to monitor and quarantine agents that go outside their boundaries.

Brian Trzupek, SVP of product at digital security company DigiCert, advises IT pros to take inventory of all their agents, and divide them into smaller, local groups that can be managed via existing cloud mechanisms: If your employees use the AI development platform AWS Bedrock, for example, assign each agent workload an identity, and then use the platform’s existing controls to limit access to specific resources—revoking if necessary.

Jim Sherlock, VP of AI and cybersecurity R&D at cybersecurity company ProCircular, also likes the idea of giving agents a clear identity (separate from the human who launched it) with task-specific permissions. He also sees benefits in sending agents through a proxy server or gateway where agentic tool and API calls can be monitored and inspected for anomalous behavior, like sudden spikes in call rates, large, unusual data pulls, or repeated permission denials.

He also recommends, if not a kill switch, a kind of ticking clock: time-bound credentials, which are offered by cloud services.

“The point being that the agents don’t operate in perpetuity,” Sherlock said.