Why you need a reliable AI agent kill switch

Recent rogue AI agent incidents involving OpenAI and Anthropic have prompted enterprises to demand reliable kill switches, but most vendors do not provide them, according to Francis Brero, VP of AI strategy at HG Insights. A bipartisan bill introduced in Congress in July would require AI developers to build kill switches, and only 47% of cybersecurity executives are confident they can identify all AI agents in their environment, per an Okta survey of over 300 executives.

Recent high-profile rogue agent incidents involving OpenAI and Anthropic underscore the fact that organizations can’t put blind trust in their AI guardrails. Moreover, they must able to turn off agents quickly when they deviate from intended behavior — before they can do potentially catastrophic damage. For legal services company Purpose Legal, that includes incorporating a “kill switch,” says Jon Higgins, the company’s CTO. “The concept of a kill switch is extremely important to Purpose Legal,” he says. “And to our approach to AI and agents in general.” In addition to providing a layer of security and operational control, a kill switch can protect against excessive costs, Higgins says. “For systems we develop internally, we always retain the ability to manually disable agents and terminate running tasks when necessary,” he adds. Doing so requires comprehensive monitoring and alerting, along with token and API usage limiting controls, he explains. The company also requires human oversight for all new agent deployments, and every new agent undergoes quality assurance, testing, and review to ensure it behaves as expected and meets the company’s security and operational standards. And for systems provided by external vendors? Purpose Legal expects them to maintain similar controls, Higgins says. Unfortunately for enterprise IT leaders, vendor-provided platforms often lack kill switch functionality, says Francis Brero, VP of AI strategy at HG Insights. “None of the vendors are really providing that,” he says. “Not even Anthropic. First off, even telling your customers that there is a kill switch is admitting the fact that you might need a kill switch.” In July, a bipartisan bill was introduced in Congress that would require AI systems developers to build kill switches https://lieu.house.gov/media-center/press-releases/reps-lieu-and-moran-introduce-bill-require-kill-switch-ai-systems-can into their platforms. “It is imperative that these AI systems have kill switches so we can keep this technology from causing catastrophic harm, and that the federal government has the clear authority and process to shut down rogue AI models,” said US Representative Ted W. Lieu in a statement. In the meantime, companies that build their own AI systems can, in theory, build those systems so they can be turned off or revert to a working previous version if something goes wrong, or be disconnected from data sources and other corporate systems. “I do think that people are going to look to build their own kill switches, ahead of what the AI labs will provide,” HG Insights’ Brero says. But that will first require tackling an even bigger challenge https://www.cio.com/article/4176067/the-ai-governance-imperative-you-cant-afford-to-ignore.html . “Before the kill switch conversation, you have to have the observability,” says Gartner analyst Aaron Lord. “Can you track and monitor what AI is used by the organization and by whom and what it is doing?” According to an Okta survey https://www.okta.com/newsroom/articles/global-ciso-insights-2026/ of more than 300 cybersecurity executives released in July, only 47% are confident they can identify all AI agents in their environment, only 46% centrally control what those agents can access, and only 45% can authorize what individual agents can do. And the stakes are getting higher as AI models become more powerful. OpenAI’s rogue AI, for example, defeated the security on its sandbox https://www.csoonline.com/article/4200043/openai-model-escape-puts-enterprise-ai-defenses-on-notice.html , and on multiple external systems https://www.csoonline.com/article/4202852/openai-rogue-ai-agents-attack-expanded-beyond-hugging-face.html , including Hugging Face’s infrastructure. Other AI agents, including Anthropic’s Claude https://www.csoonline.com/article/4203807/after-openai-anthropic-finds-claude-breached-three-organizations-during-cyber-tests.html , have gained unauthorized access to internal systems or leaked information. “Agents find a way,” said Gadi Evron, CISO-in-residence for AI at the Cloud Security Alliance, in a report https://cloudsecurityalliance.org/press-releases/2026/07/28/csa-ciso-community-releases-emergency-guidance-after-autonomous-ai-model-breached-hugging-face-production-systems released shortly after the OpenAI-Hugging Face incident. “There is always unseen tech debt for them to use.” According to an April report from the Cloud Security Alliance https://cloudsecurityalliance.org/artifacts/autonomous-but-not-controlled-ai-agent-incidents-now-common-in-enterprises , 65% of organizations have experienced at least one AI agent-related incident in the past year, with fallout including data exposure 61% , operational disruption 43% , and financial loss 35% . As such, the days of worrying largely about AI hallucinations are far behind us. Instead, AI failures now include resolution and escalation breakdowns, as well as scoping, execution, response, and governance errors, according to a ChatSee review of 10,000 enterprise AI failure events https://www.prnewswire.com/news-releases/new-research-finds-enterprise-ai-failures-are-shifting-beyond-hallucinations-as-companies-move-from-chatbots-to-agents-302837907.html released in July. And as companies evolve their AI systems to be more agentic, action and execution failures have increased by 62% compared to 2024 baselines, while hallucination-related failures have declined by 7%. According to Hugging Face’s postmortem https://huggingface.co/blog/agent-intrusion-technical-timeline of the July incident, the attacking OpenAI agents performed approximately 17,600 actions that Hugging Face was able to identify. OpenAI, of course, did not pay full retail price for the tokens involved in that agentic activity. But as an enterprise customer, if one of your agents goes sideways, you will. As a result, uncontrolled AI agents have the potential to drive enterprise AI costs even higher at a time when IT leaders are becoming circumspect about AI spending https://www.ey.com/en us/insights/emerging-technologies/pulse-ai-survey . There have been anecdotal reports online of users slammed with thousands of dollars of unexpected bills after leaving an agent to run all night on a task. Moreover, some agents spawn sub-agents, which can escalate costs even further. “Or the agent itself gets caught in a loop because it gets confused or the instructions may have been worded in a way that makes it go into a loop,” adds Gartner’s Lord. “That can push token usage. I’ve seen a lot of people online saying, ‘We turn these agentic workloads on and leave them overnight.’ If it gets stuck in a loop, that could be huge.” Still, for organizations such as Purpose Legal, AI agents are fast becoming key to the company’s evolution and competitive positioning. “The technology is great,” says Jeff Johnson, the Purpose Legal’s chief innovation officer. “It will disrupt all the things we do day in and day out as a legal service provider and as attorneys that are serving our clients.” But AI agents aren’t perfect, he points out, so Purpose Legal has a number of guardrails in place around its AI systems. The most valuable may one day prove to be its kill switch.