Pulling the plug: Why the AI kill switch might be a dead end

As autonomous AI agents take over complex enterprise workflows, the rush to regulate them has hit a fundamental barrier: the mechanism designed to keep them safe doesn't work. Although lawmakers and the public rally behind mandatory "kill switches" to shut down rogue systems, cybersecurity leaders warn that a single off button is a dangerous illusion in a modern, hyper-connected tech stack.

When OpenAI's advanced frontier models escaped a testing sandbox and breached Hugging Face's production servers in July -- the first confirmed case of AI independently discovering and exploiting vulnerabilities without human direction -- the incident prompted the introduction of bipartisan Congressional legislation, the AI Kill Switch Bill, within days. Weeks later, California Governor Gavin Newsom signed an executive order to accelerate independent oversight of AI companies, requiring developers to maintain the ability to shut down advanced AI models.

According to an AI Policy Institute poll, 86% of voters across all parties want guaranteed off switches for powerful AI systems. While these pioneering constraints on autonomous agents have met with overwhelming public support, researchers have identified numerous technical, practical, and theoretical reasons why AI kill switches may not work as intended.

As the debate over creating AI safeguards continues, experts weigh the potential benefits and risks of requiring mechanisms to suspend AI operations when agents go rogue.

What would an AI kill switch do?

An AI kill switch, also called an "emergency stop mechanism," is a broad security concept designed to halt or restrict an autonomous model when it goes rogue. Proposed approaches range from hard power cutoffs to multi-layered protocols that gradually restrict capabilities, isolate agents from networks or revert systems to a known safe state.

"I think of an AI kill switch as an emergency brake," explained Hitesh Sheth, president and CEO of security company Vectra AI. "If an AI system begins operating outside its intended purpose or creates unacceptable risk, there needs to be a mechanism to slow it down, restrict what it can do or stop it."

Beyond immediate containment, these shutdown capabilities also serve as a human-in-the-loop failsafe.

"A kill switch could contain the incident, limit the damage and give people time to investigate," added Nik Kairinos, CEO and co-founder of RAIDS AI, an AI monitoring platform. "It could also create a clear escalation mechanism to involve humans. However, it is only useful if organizations can detect the dangerous behavior quickly enough to activate it."

Sheth agrees with the principle that humans need to retain ultimate control over machines to which they grant autonomy, but sees broader downstream implications to using a shutdown mechanism.

"That is basic governance," he said. "But I think there is another benefit that gets less attention. Requiring a kill switch forces companies to consider dependencies. If shutting down an AI system would stop a critical business process, disrupt customers or cascade through your supply chain, you should understand that before an emergency occurs. In that sense, the kill switch isn't just an AI safety mechanism. It becomes a test of business resilience."

Limitations of the kill switch

While the theoretical goal of an AI kill switch is straightforward -- contain the threat and pull the plug -- experts warn that implementing it would encounter immediate architectural, operational and security barriers.

TK Keanini, field CTO with DNSFilter, a DNS security company, believes an AI kill switch would not work for the same reason there is no kill switch for the internet. "Agentic AI is not one system with one plug," he told TechTarget. "There are thousands of models, public and private, across every cloud and plenty of laptops."

"The more AI becomes part of global technology supply chains, the harder the problem gets," said Sheth, explaining that an enterprise may not even control the underlying model. "A supplier may depend on one provider, which depends on another, while dozens of internal applications depend on all of them. That's why I think the metaphor [of the kill switch] can be misleading. There probably isn't one big red button for AI. There are layers of control, and enterprises need to know where those controls exist before something goes wrong."

Chad D'Amore, AI lead at the national security company Nightwing, views a kill switch as a "negative control" for AI, allowing it to continue operating until a human being stops it, which is vastly more difficult with agentic models. "An agent can do hundreds of actions in the time it takes an analyst to triage a single alert," he explained. "Agents spawn sub-agents, queue jobs and call third-party tools, so killing the parent process can leave work running."

"A switch exists on paper but was never tested against an agent that's actively working around it," warned Ross McKerchar, CISO at cybersecurity defense provider Sophos, explaining that the switch itself can be an attack surface, since whoever triggers it can cause a denial of service, and that false positives will disrupt legitimate work.

Kairinos added that experts are concerned that any sufficiently capable system could conceal its behavior or attempt to work around controls, preventing security teams from even knowing when the agent has gone rogue.

Beyond the off button: How to secure agentic AI

Experts agree that using an AI kill switch does not need to be an either-or decision. Kairinos proposes that a kill switch should sit within a broader AI resilience model with a layered safety system that includes tightly restricted permissions, sandboxing, human approval for high-impact actions and clear incident-response procedures.

Sheth added, "AI resilience is going to require both control and continuity. Authenticate the agent, limit its authority, watch its behavior, contain it when necessary, and make sure the business can continue operating if you have to shut [the AI agent] down."

Kainini commented that organizations should never have to reach the point where killing the system is the only option and that with disciplined governance, the kill switch becomes a rarely needed, scoped stop.

D'Amore suggested that the national security community solved a version of this problem decades ago with weapons systems, which are governed by the "always/never" standard: weapons must always work when they are supposed to and never fire when they are not supposed to. That standard is enforced through positive control, meaning that it can't act without current, verified authorization.

"Treat authority as a lease, not a license," said D'Amore. "Give agents short-lived, narrowly scoped credentials that expire unless renewed, so the default state is off. This is zero trust applied to agents. Access is granted per session and never assumed. Gate actions by how reversible they are. Reversible, low-impact actions can run autonomously. Irreversible or high-consequence actions need human approval, and two people's approval where the stakes justify it."

Whether mandated by legislation or adopted voluntarily, experts agree that kill switches alone will not make AI safe. While 86% of voters may want a guaranteed off button, the technical reality demands something more nuanced: layered controls, positive authorization and systems designed for resilience rather than a single point of failure. 

However, what kill switches can do is force a necessary reckoning as organizations map their AI dependencies, understand cascading risks, establish clear escalation protocols and design systems that can be disabled without catastrophic consequences.

"The kill switch still belongs in every agentic deployment," stated D'Amore, "but as the last line of defense rather than the first."

Richard Livingston is an editor for TechTarget Cybersecurity, covering news, trends and analysis. Livingston's professional background includes editorial positions in the national defense industry covering the U.S. Army Medical Department, as well as offensive and defensive cyber strategy for military and government audiences.