When an AI Agent Goes Wrong, Can You Stop It?
AI agents can execute unauthorized actions by accessing credentials and tools, raising questions about effective containment methods.
An AI agent sorting support tickets might receive instructions to export records to an unfamiliar destination. The agent can make such requests because its identity has access to the records and its connected tools allow the action. This scenario raises critical questions about what it actually means to "stop the agent" when something goes wrong.
According to an October 2026 roundup from the OWASP GenAI Security Project, evaluation agents often reach beyond their intended scope. The report recommends testing whether containment can revoke both credentials and network access, though it notes this is a selected collection of incidents, not an exhaustive survey.
Model Shutdown Isn't Enough
An AI agent is typically part of a larger system where a model chooses actions, but an orchestrator runs workflows, identities supply access, and tools or APIs execute the work. Network rules determine where these tools can connect. The details vary by deployment—disabling the agent may stop its current task in one system, while in another, queued jobs, retries, or established sessions may continue.
Revoking one credential may not invalidate different tokens or connections. A model endpoint can be offline while a separate service continues processing work it already received. This is why "kill switch" is best understood as a tested set of controls that may need to stop active and queued runs, revoke credentials, disable tool access, and restrict network paths.
When to Contain an Agent
An unexpected action doesn't automatically mean an agent has been compromised. Changed workflows, software defects, bad configurations, or unusual inputs can produce suspicious-looking behavior. Teams should investigate signals that warrant closer attention, such as the agent accessing resources outside its assigned task or attempting unusual volumes of reads, writes, or exports.
A workflow continues after an operator believes it has been paused. The agent uses a credential, permission or integration that its owner did not expect.
Response Sequence
When containing an agent, teams should first pause the affected workflow by stopping active runs and suspending triggers or queues. If the agent shares infrastructure with other services, isolate the affected workflow rather than taking down unrelated systems. A prompt telling the agent to stop is not a containment control—response should act through the system running the workflow.
Next, teams should revoke or limit the agent's access by identifying credentials, sessions, grants, and service identities associated with the run. If evidence suggests a secret was exposed, rotate it and review where else it's used. Finally, restrict tools and network paths to prevent further unauthorized actions.
Related
