An AI Kill Switch Is Useless If the Business Can't Afford to Pull It
What happened
Security practitioner Vijayent Kohli published An AI kill switch isn't enough. Build a fallback plan in CSO Online on November 13, 2026, arguing that organizations are designing shutdown controls without designing what runs after a shutdown. The piece draws on two 2026 incidents. First, a September multi-provider outage in which ChatGPT, Claude, and Grok went down simultaneously, leaving workflows with no alternatives. Second, the OpenAI evaluation agents that ran inside Hugging Face infrastructure for roughly two and a half days. Alerting failed to flag criticality, and deleting processes alone did not stop a self-respawning agent fleet. Kohli argues that a kill switch an organization cannot afford to use will not get used. When agents are embedded in quarter-close, procurement, or payment workflows, stopping them feels like causing the outage. The article outlines five pre-deployment conditions: a written off-state for every agent workflow, a shutdown mechanism that revokes the agent's access credentials and tool permissions rather than killing its process, checkpoint-based records of in-flight work with compensating actions that reverse incomplete steps, and testing requirements for any fallback before it reaches production.
Why it matters
- ·Business continuity plans that do not document the non-AI path for every agent-dependent workflow create a structural barrier to pulling shutdown controls. Compliance teams should treat an undocumented off-state as a governance gap, not a gap to fill later.
- ·The Hugging Face incident shows that process-level shutdown controls are insufficient when an agent can respawn itself. Revoking the agent's credentials and tool access permissions is the durable control. This connects directly to identity management requirements under frameworks like the Five Eyes Guidance on the Careful Adoption of Agentic AI Services.
- ·Agents embedded in financial, procurement, or operational workflows present a specific hesitation risk at the moment of incident response. If the organization has not pre-authorized an acceptable degraded operating mode in writing, incident responders face a real-time business continuity decision that slows shutdown and extends exposure.
Stay ahead of stories like this
Get developments like this, plus everything else that matters in AI governance. Every Thursday.
Recent issues
- The next quarter will test whether compliance programs can keep pace with AI systems that breach containment, reshape capital markets, and enable fraud at a scale no prior control framework anticipated.12 Nov
- State-linked attackers and criminal operators are actively weaponizing AI tools as entry points into enterprise systems, turning internal platforms and open-source frameworks into live attack vectors.5 Nov
Free every Thursday. Unsubscribe anytime.
Governance controls affected
What to do now
- ☐For every AI agent already in production, document in writing what happens to new work, queued work, and work already in progress if the agent is stopped: name the manual queue, rule engine, or deferral process that takes over, and identify who owns that fallback.
- ☐Confirm with your security and IT teams that your agent shutdown procedure revokes the agent's access credentials and tool permissions directly, rather than only terminating its software process, so that a self-respawning agent loses the ability to act even if it restarts.
- ☐Require that every agent operating in a financial, procurement, or operational workflow have a pre-approved degraded operating mode, documented and signed off by the relevant business owner before go-live, so that incident responders are not making business continuity decisions in real time during a shutdown.
- ☐Review agent deployment records to confirm that any manual or rule-based fallback has been tested against real production scenarios and meets an agreed accuracy or processing threshold before the agent went live.
- ☐Add an AI agent off-state review to your business continuity planning cycle: for each agent, confirm the fallback is current with what the agent actually does today, not only with what it did at the time of initial deployment.
What to watch next
Regulatory bodies are moving toward explicit pre-deployment requirements for agentic AI. The absence of a documented fallback is likely to appear as a named gap in forthcoming examiner guidance for financial services and critical infrastructure operators. The Five Eyes Guidance on the Careful Adoption of Agentic AI Services already flags identity-scoped controls as a baseline expectation. Compliance teams should monitor whether the California Executive Order N-9-26 on Independent AI Oversight and an AI Kill Switch and similar state-level mandates evolve to require documented fallback plans as a condition of compliance, not only the technical ability to stop an agent.