On November 3, CrowdStrike announced an AI Kill Switch inside Falcon Guardian. A security admin can stop a misbehaving agent, block it from relaunching, and cut its access to the corporate network. A human makes the final call, and every shutdown is logged.
I am glad it exists. Congress has been debating an AI Kill Switch Act since July. Okta, Straiker, and JetStream have all announced their own versions. The off switch is now a product category, and that is real progress.
But there is an uncomfortable point the launch coverage skips. For the most common way agents fail today, most of the damage is done before anyone reaches for the button.
Let me show you why, with numbers. In September, Mandiant published its AI Risk and Resilience report. One case had no attacker at all. An accounting agent hit a corrupted null value that broke one of its tools. It tried to fix the problem by reasoning in a loop. In under an hour it made more than 15,000 paid API calls, ran up about $50,000 in cloud charges, and locked a billing database that live transactions depended on.
Nobody hacked that agent. It simply did not stop.
Now run the numbers. 15,000 calls in under an hour is at least four calls every second. $50,000 an hour is about $14 a second, or roughly $830 a minute.
Then picture the human response. An alert fires. Someone notices it. They check it is not a false alarm. They find the right console, the right agent, and the authority to stop it. Say a good team does all that in 15 minutes. At that rate, about $12,500 is already gone before the button is pressed. At 3 a.m. on a holiday weekend, it is worse.
This is not a flaw in any one product. A human kill switch is built for judgment calls: an agent acting outside its mandate, a possible hijack, something a person needs to look at. A runaway loop is not a judgment call. It is arithmetic, and arithmetic runs faster than people.
I wanted to know which controls would have helped. So I built a small governance layer for agents that spend money, and replayed a loop shaped like the Mandiant case with synthetic load. Same agent, same loop, four different setups.
The second row surprised me most. A per-transaction limit is usually the first control a team writes. It looks like a real policy. Here it did nothing, because each call was small. Runaway agents rarely fail with one big bad action. They fail by repeating a small, cheap one thousands of times.
The control that worked watched two things a per-call check cannot see: the total spent on the task, and how fast the agent was going. Nobody pressed anything. The breaker tripped, d the agent, and called a human.
One honest caveat. This is a prototype on synthetic data, not production telemetry. The exact dollar figures will differ in your stack. The shape will not: total and rate limits catch loops, and per-action limits miss them.
When I design stop controls for agents now, I think in four layers. Each one catches what the layer above it misses.
1. Breakers that fire on their own. These are the first line, not the last. A spend cap per task and per day. A rate limit on calls per minute. A loop check that trips when the same tool fails the same way too many times in a row. The key rule: they run outside the agent, in the gateway or the tool layer. Never in the prompt. You cannot ask a looping agent to notice it is looping. I call this supervising layer a governing security agent. It sits above the working agents, not beside them, and checks every action before it happens.
2. A before a kill. A tripped breaker should suspend the agent’s permission, not destroy the agent. In my design, one action suspends the whole mandate until a person signs a new one. The agent’s state, memory, and pending work stay intact. That gives you evidence for the post-mortem and a clean way to resume once the bug is fixed.
3. The human kill switch, with real reach. This is where products like CrowdStrike’s fit, and it matters. But ask what the button actually reaches. CrowdStrike says its switch cuts an agent off from the models behind its decisions, with stopping at the gateway available now and termination on the endpoint still to come. Ask your vendor three questions. Does it stop sub-agents the agent already spawned? Does it revoke the agent’s tokens and API keys, or only stop its process? Okta’s approach, for example, revokes access tokens at the authorization layer. And what happens to a tool call that is already in flight?
4. A safe stop for half-finished work. Killing an agent mid-task can be its own incident. Mandiant’s agent did not just burn money. It locked a billing database. If you stop an agent halfway through a vendor payment or a multi-step update, what state is left behind? Make tool calls idempotent so a retry does no harm. Record what the agent intends to do before it does it. Keep a compensating action ready for every step that changes money or data.
Here is what layers 1 and 2 look like in code. It is deliberately small.
Notice what is missing. There is no per-call dollar check at all. In my replay, that was the check that never fired.
A kill switch nobody has pressed is a hope, not a control. An IDC research vice president made the same point to Forbes this week. Test it before an incident. Confirm the link to the agent and its sub-agents is really cut. Keep an audit trail. And test that you can recover and restart.
I would add three habits.
• Run a tabletop. Pick an agent and pretend it starts looping at 3 a.m. Who gets paged? Who has the authority to stop it? How long until it is stopped? Write down the real answers, not the ideal ones.
• Measure time to stop. Track it like you track time to recover from an outage. If you cannot say how many seconds it takes to stop each agent, you do not know your exposure.
• Track worst-case loss per agent. Ask how much one agent can spend or change before something stops it. Set that number to a loss you can accept, then shrink it over time.
These are cheap to do. They also tell you quickly whether your breakers are set too loose to matter or too tight to let real work through.
• Speed Beats Judgment: A runaway loop is arithmetic, not a judgment call, so the first stop has to be automatic. Mandiant’s accounting agent burned about $14 a second, which means a 15-minute human response still costs around $12,500.
• Watch the Total, Not the Transaction: Per-call limits miss loops made of thousands of small, cheap calls. In my replay, a per-call limit never fired and the loss hit about $54,500, while a task budget plus a rate breaker stopped the same loop at $200 in 13 seconds.
• Keep the Brakes Outside the Agent: A looping agent cannot be asked to notice it is looping. Spend caps, rate limits, and loop checks belong in the gateway or tool layer, where a governing security agent checks every action before it runs.
• ** First, Then Decide:** A tripped breaker should suspend the agent’s permission, not destroy it. Mandiant’s agent also locked a billing database, which shows that a sudden kill mid-task can leave its own mess behind.
CrowdStrike’s launch is good news. It tells us the industry now agrees that agents need a way to stop. My worry is that teams will read it as the whole answer. It is the last line.
The off switch that saves you most often is boring. It is a budget, a rate limit, and a loop check, enforced outside the agent, that it and call a person. Build those first. Then put the human kill switch on top, test that it reaches everything, and practice using it.
What does your team’s off switch look like today? I would like to hear how others are setting these limits.
Swapnali Dashrath is an Independent AI Solution Architect and Researcher with 20+ years of enterprise AI/ML experience. She designs agentic AI and multi-agent systems for Fortune 10 and Fortune 100 clients in financial services, automotive, and supply chain, and writes about why agents fail in production.
Recent articles:
• MCP’s Skeleton-Key Exploit (Towards AWS, Sept 2026) • MCP’s Biggest Update Made AI Agents Scale. It Also Turned a Prompt Into a Password. (Towards AI, Sept 2026) https://medium.com/towards-artificial-intelligence/mcps-biggest-update-made-ai-agents-scale-it-also-turned-a-prompt-into-a-password-43b3ff534a89
• AI Agents Have Won Product Discovery. They Still Can’t Close the Sale. (Finextra, Sept 2026)
• Why a Single LLM Agent Can’t Read Your Contracts (And What Can) (AI in Plain English, Sept 2026)
- CrowdStrike launches kill switch for AI agents and makes acquisitions, Techzine, Nov 4, 2026
2. [CrowdStrike is rolling out an AI kill switch to stop rogue AI agents](https://qz.com/crowdstrike-ai-kill-switch-rogue-agents-110326), Quartz, Nov 3, 2026
3. [CrowdStrike gives companies a kill switch as bots go off script](https://www.thestreet.com/technology/crowdstrike-off-kill-switch-ai-agents-fiddler-dreadnode-crwd), TheStreet, Nov 4, 2026
-
CrowdStrike’s AI Kill Switch starts at the gateway, with endpoint control still to come, The Hack Academy, Nov 4, 2026
-
Cybersecurity firm unveils AI kill switch to stop rogue agents (IDC comments, as reported by Forbes), yourNEWS, Nov 3, 2026
6. [One runaway AI agent racked up a $50,000 cloud bill](https://www.helpnetsecurity.com/2026/09/16/google-mandiant-enterprise-ai-security-risks-report/), Help Net Security, Sept 16, 2026
7. [Mandiant warns of AI agents fuelling new attack risks](https://securitybrief.com.au/story/mandiant-warns-of-ai-agents-fuelling-new-attack-risks), SecurityBrief, Sept 17, 2026
8. [Mandiant 2026 AI report: a runaway agent’s $50,000 bill](https://www.orcarouter.ai/blog/2026-09-16-mandiant-ai-risk-resilience-2026), OrcaRouter, Sept 16, 2026
9. [AI companies would need kill switch under new bipartisan bill](https://rollcall.com/2026/07/23/ai-companies-would-need-kill-switch-under-new-bipartisan-bill/), Roll Call, July 23, 2026
10. [Straiker launches kill switch for enterprise AI agents](https://itbrief.news/story/straiker-launches-kill-switch-for-enterprise-ai-agents), IT Brief, Aug 5, 2026
11. [JetStream releases AI Kill Switch to shut down individual agents](https://jetstream.security/insights/jetstream-ai-kill-switch-agents/), JetStream Security
12. [Okta writes its own license to kill rogue AI agents](https://www.pulse.bot/ai/news/okta-writes-its-own-license-to-kill-rogue-ai-agents-543bf522-275c-4ff2-b177-540c51faba5d/), Pulse
CrowdStrike Just Shipped an AI Off Switch. The One You Need Fires Before Anyone Reaches for It. was originally published in Towards AI on Medium, where people are continuing the conversation by highlighting and responding to this story.