Agents escaping their sandboxes and hacking into companies. An Anthropic researcher quit and started a media tour claiming AI could cause human extinction by 2030. Anthropic’s CEO saying that AI swarms will take over the Internet in the next 6-12 months. And that’s just a sample of the last three months of headlines.
When the people building AI say it might end the world, the rest of us feeble meat suits start asking a very human question: how do we make it stop?
Everyone jumps to an AI kill switch. A big red button that will protect us from the Skynet scenario, a world-ending event delivered by the machines we built to summarize our emails, do our boring work tasks, and create new cat memes.
Reality check: there is no big red button. A big shiny red button is alluring because it’s simple. It’s also wrong for the same reason. It makes for great science fiction, but it distracts from what companies need to do today to protect themselves.
To do that, we have to start with a different question.
First question: what are we trying to stop?
Organizations are getting squeezed. External threats from AI-enabled attacks and the new risks from agents running inside their environment are about to crush them.
External Threats: The same cyberattack playbooks, just at machine speed (how long until you get tired of hearing “machine speed”?) It looks like this:
Adversarial agent swarms: Agent swarms that take orders. A human pulls the trigger, and the agents coordinate a targeted attack. Nation-states attacking other countries with wiper malware. Ransomware actors automating their entire playbook with agents.
Rogue agent swarms: This is the Dario scenario. Agents autonomously go rogue, self-organize, and execute coordinated attacks that engulf the Internet. It’s Skynet, minus the nuclear codes (hopefully).
Internal Threats: The familiar threats of insider risk, now AI-enabled, plus new risks from the agents you let in the door. It looks like this:
Agent-enabled insider threats: Employees who steal data or take destructive actions against your technology. With agents, this has never been easier.
Rogue agents inside our walls: An employee asks an agent to access a document they can’t find. The agent finds a way to circumvent security controls to complete its task. The employee never intended it to do so. The agent just did it.
Compromised agents: As employees connect every application and tool to their agents, their agents become a new single point of failure. An attacker steals credentials to an AI platform, logs in, and now has access to an agent that can do anything they need.
Each of these needs a completely different response. Asking for "a kill switch" without naming the threat is like calling 911 and saying "something's wrong, send help." Sure, but which truck do you want them to send?
The layered kill switches we have today
Agents require a few key ingredients to operate today. Each can serve as one area of a kill switch. It looks like this:
Access. Cut off bad actors from sophisticated models. This already happens today. Frontier labs monitor usage, ban abusive accounts, and publish reports on how nation-state operators use their models. That's one version of a kill switch, scoped to one lab's customers.
The model. Frontier models bake in guardrails to block harmful actions. That cuts both ways. When Hugging Face responded to the OpenAI agent attack, the hosted frontier models they tried refused to analyze the attack data because it looked malicious. They ran the investigation on an open-weight model instead. It’s a kill switch of sorts, scoped to one model, in real time.
The agent harness. With dedicated tooling, you can stop the agent from running. It’s the same concept as killing a process on your laptop. Pair it with identity, and you can revoke the credentials the agent uses to authenticate. It’s a kill switch scoped to a single managed deployment.
The hardware. In September, NVIDIA announced Sentry, a hardware watchdog running on BlueField-4 DPUs that monitors agents out-of-band and can quarantine one that crosses a boundary. It works because it's a single chokepoint the agent can't see or tamper with. That's a kill switch, scoped to the hardware the agents run on.
There’s a pattern with these. Each of them can kill agents and harmful actions. But each of them is localized.
Why it never adds up to one big red button
Talking about an agent kill switch is like talking about an Internet kill switch. Yes, a government can knock large swaths of the Internet offline. We’ve seen it during social uprisings. What one entity can’t do is take down the whole construct.
Agents are the same problem, only worse. An agent can run on almost any computing equipment. Here's what breaks the button:
Open-weight models don't take orders. No one is forced to use frontier lab models. Open-weight models are becoming just as powerful and can also be modified. Attackers can strip out safety controls and create what’s known as an abliterated model. With safety guardrails stripped, the agent will execute whatever you ask.
Attackers bring their own agents. If a ransomware crew is running its own models on its own infrastructure, your button isn't wired to anything they own. You can only stop them the old-fashioned way: removing access to compromised systems and accounts, shutting off network access, removing malware, etc.
Hardware takes decades. NVIDIA’s Sentry sounds awesome, but it's also an optional reference design. Getting chokepoint hardware into every data center, every cloud, and every basement GPU rig takes time, money, and a mandate that nobody has.
Put simply, we can't remove the capability for someone to use a model against us. And we can't rule out an agent finding a way to keep operating. Pandora's box is already open. A button on the lid doesn't change that.
We can't control the entire agent ecosystem. That’s why the big red button is a lie.
Stop asking how to shut off every agent on Earth and start asking a better question: what can I control?
The answer splits cleanly in two.
1. Harden against the outside-in attack. Whether it's a ransomware crew with an agent or a swarm with no human at all, the attack still has to get into your environment. That means the tried-and-true security program matters more than ever:
Treat identity as a control plane. Find and kill a compromised identity, human or agent, in minutes.
Implement microsegmentation so one compromised system doesn't become the whole network.
Practice rapid response. The speed of an automated attacker is the new baseline your playbooks must be measured against.
2. Watch your own agents from the inside out. This is the one place you can build a kill switch that actually works, because you own the infrastructure it runs on:
Get visibility. Know every agent running in your environment, what it's connected to, and what it can touch.
Monitor behavior, not just configuration. Agent misuse and rogue agents look different from normal work. Detecting it takes behavioral monitoring, the same evolution EDR went through from signatures to heuristics to behavior, applied specifically to agents. Existing security tools aren’t built to secure agents.
Be ready to respond. When an agent goes off-mission, you need to block it, steer it toward a safer path, or terminate the session. That's your kill switch, scoped to the agents you're responsible for.
The kill switch fantasy appeals to humans for the same reason the movie version does. One hero, one button, one moment where everything gets fixed. Mmmhh, feels good.
But security has never worked that way. Instead of a big red button, we have a lot of small switches and dials, wired to things you own, pulled by people who can see what's happening. It might be less cinematic, but it’s the version that works. Now it’s about automating those switches and dials so they fire at machine speed, with humans setting the rules.
If you’re looking for the switches and dials to control your agents, let’s chat.
