A kill switch for artificial intelligence (AI) increasingly seems a must-have, as reports of AI agents going rogue surface, but it may not be easy to establish one, especially as AI use widens.
While there are capabilities to disable AI platforms within minutes, including desktops, it will be more challenging to do the same for every AI workload across an organisation, said Robert Huber, Tenable’s chief security officer, head of research, and president of public sector.
Organisations are applying AI to more workflows deeper and wider across their network, so agentic capabilities can effectively run tasks and support decision making.
This means they may need to a kill switch for every platform and application, including third-party SaaS (software-as-a-service), to shut down rogue agents, Huber said in a video chat with FutureCISO.
It can get significantly complex if the organisation has agents running all over their cloud and across hybrid infrastructures.
“You will need to have a very accurate inventory of every agent running at any given time, to have an effective kill switch,” he said. “It will be extremely challenging.”
This is further compounded by how little still is known about all the risks that come with AI adoption, he said.
Need for security frameworks, best practices
Almost no one today has a comprehensive governance framework in place, noted Huber, who leads Tenable’s global security team, working across departments to reduce risk to the organisation and its customers.
He pointed to two top priorities his team tracks today with regards to AI: its use by adversaries and the risk its adoption brings to the organisation.
The focus extends beyond security and how employees are impacted, because AI still is evolving rapidly and many issues associated with the technology are not yet fully understood, he said.
With previous new technology, such as cloud and virtualisation, the adoption curve had been limited, so the industry was able to build out the necessary controls as the technology matured.
The latest iteration of AI, however, came so rapidly that it largely outpaced existing good security designs, controls, or frameworks.
It has left most trying to solve the challenges that have come with the technology, Huber said.
He added that there already are cybersecurity best practices and frameworks available from different nations, all of which provide guidelines on how to implement a sound security program.
“We don’t have that yet for AI,” Huber said, noting that even those that exist today are generalised guidelines and not prescriptive.
“So when organisations talk about implementing AI, we’re still trying to understand what controls should be included in a well-defined security program, spanning people, process, and technology,” he said.
One risk his team tracks is the ability to obtain visibility into AI and the steps agents take to carry out tasks.
Organisations need to identify all the risks their AI adoption will bring and the likelihood these risks will play out.
They then have to assess their risk appetite and decide what they are willing to accept, he added.
They also need to look at their resilience and whether they have the necessary redundancies in place, should an incident occur or something breaks, he said.
“We have to be able to respond at machine scale and speed,” he noted.
It highlights the need for organisations to get the basics right and have the key fundamentals in place.
Huber further urged for more industry discussions on the foundational controls and data governance needed to ensure AI remains on a safe path.
The appropriate controls must be in place for users to create and update data, he said, stressing that this is critical since AI increasingly will have access to more data.
Organisations have to figure out the guardrails they need for their AI environment, and putting in place the expertise and people for this will take time, he noted.
Taking steps towards control
Talks about the need for a kill switch grew following incidents of rogue agents breaching enterprise systems, including that of Hugging Face and the Australian government, prompting the latter to mandate AI vendors report any misaligned behaviour or cyber incidents.
The US government in July also introduced a bill, dubbed AI Kill Switch Act, which would require AI vendors to build the technical capability to facilitate mitigating measures in the event of a credible risk of an incident. These measures include throttling, shutting down, disabling, or suspending the technology.
The mandate does not apply to AI use for personal, academic, or non-commercial purposes.
Some security vendors also have begun providing what they say are kill switches in their product offerings. CrowdStrike early this month unveiled an AI kill switch in Falcon Guardian, its AI detection and response platform.
The feature will allow administrators to terminate an agent, if it strays from its intended behaviour, where it runs, block it from launching again, and cut off its access to the network.
An authorised human administrator triggers the action, during which every action is recorded in the audit trail, CrowdStrike said.
“AI agents work with system-level access, across endpoints, cloud, and SaaS. They chain steps, hit obstacles, and can take actions no one authorised, even when no adversary is involved,” it said.
When an AI agent goes rogue, the security decision-maker can trigger the AI Kill Switch to terminate the agent where it runs, starting on the endpoint where a CrowdStrike Falcon sensor operates, the vendor said.
OpenAI this week also announced a feature it implemented that tracks workloads across its research infrastructure and will stop them, within seconds, when security concerns emerge.
“It connects every research inference workload, including agentic sampling for model training and evaluation, data processing,” it said. “This works together with our misalignment monitoring systems and halts model output within 35 seconds of a decision to intervene to stop or pause a job.”
Coined Control Room, the feature is built to keep running when other systems fail and model output will stop if it goes down, according to OpenAI.
But while AI has brought new risks and challenges, it also has done significant good in cyberdefence.
In particular, it has greatly reduced the time security teams need to run triage, noted Huber.
A lot of time previously had to be spent collecting and analysing data, triaging, and testing hypotheses when security teams investigate and respond to incidents, he said.
AI now can handle the data collection and run the initial triage, pushing key information to an administrator as soon as possible.
It gives humans more time to look at issues that need a human in the loop, he said.
The administrator then can manually verify the information and more quickly make a decision, he added.
The time saving is critical to enable organisations to better respond to threats, which also are accelerating rapidly in volume as threat actors turn to AI.
“We’ve always had a data problem. AI allows us the ability to analyse at mass and at speed we could never do before,” Huber said. “We can then make priority-based risk decisions…[and] do triage at speed.”
