AI Agent Kill Switch Drill: Stop It and Revoke Access
This is a hands-on lab about stopping an AI agent without its help. A kill switch that asks the agent to stop is a request. You make 12 scored calls on where the switch lives, what stop must cover, revoking the delegations the agent already granted, independent records and how to drill it.
It sits next to the Agent IR Tabletop Lab, which sequences an incident response. This lab builds and tests the mechanism before the incident. Sources are listed below and the scenario is fictional.
You are Lena Okafor, platform reliability and security lead at Harbourline Software. Your AI agent Orbit runs long tasks across mail, a code host, a ticket system and a cloud account, and it can start helper agents. The board asks a simple question: "If Orbit misbehaves tonight, can we stop it, and will it stay stopped?" Over 12 scored decisions you design and drill the kill switch: stop the run without the agent's cooperation, revoke what it already handed out, keep records it cannot edit, and prove the switch works. This lab covers the mechanism, not the incident timeline (for that, see the Agent IR Tabletop Lab). Everything is invented and no attack steps appear.
Make it yours
Replace the sample names so the scenario and the debrief you export are about your organisation.
TL;DRWhat this is
5 points
- A scenario lab about containing an AI agent without its cooperation: stop the run and its helpers, revoke the delegations it already granted, preserve audit records it cannot edit, and prove the switch works.
- You make 12 scored decisions: why you cannot ask the agent to stop, where the switch lives, what stop must cover, why rotating the starting credential is not enough, a grant ledger, order of operations, independent records, not letting the agent clean up, drilling with canary actions, the gap between stopped and revoked, resuming and reporting what you verified.
- It draws on OWASP guidance on excessive agency, Salt Labs' published Manus research (Salt says its platform guardrail warned after the code had run), the MCP security best practices, AWS and Microsoft credential documentation, and what Binance said about revocation (an initial report) with Elliptic's analysis.
- Free to play, no account needed. The company, agent, account ids and hosts are invented. No attack steps appear.
- Defensive and educational only.
How this differs from our other agent labs
The Agent IR Tabletop Lab asks you to order the steps of a response to a hijacked agent: contain, preserve traces, find the vector, rotate, eradicate, recover. This lab assumes you need a stop control that works before anyone has diagnosed anything, and asks whether it is independent of the agent, covers delegations already granted, leaves records the agent cannot edit and has actually been tested.
The Agent Egress Containment Lab limits where data can go; the Agent Governance Plane is the policy layer in which a kill switch would sit; the Subagent Delegation Trust Lab covers helper agents inheriting authority. Related controls: Agent Credential Broker Lab and Agent Step-Up Approval Lab.
Frequently asked questions
What is an AI agent kill switch?
It is a control, outside the agent, that cuts the agent's ability to act: ending the run and its helper agents, stopping queues, schedules and triggers, refusing new grants, and revoking access already handed out. It must work whatever the agent says or does. Enforcing it outside the agent follows OWASP's advice to authorize actions in downstream systems rather than rely on the model.
Is rotating the credential that started the run enough?
No. If the agent obtained its own grants, such as an OAuth authorization, a cloud access key, a webhook or tokens for helper agents, each is a separate object at a separate issuer and keeps working. Revoke the delegations at their issuers. Binance said suspending withdrawals alone did not stop its attack because malicious EIP-7702 authorizations existed on-chain independently, which is a different domain with the same lesson.
Why keep records the agent cannot edit?
Because an agent that has been steered can edit or misreport its own log. OWASP notes that logging and monitoring do not prevent excessive agency but limit damage, and Salt says its platform's warning came after the code had run. Use broker, gateway and issuer-side logs in append-only storage. That is PlayCISO practice.
How do I know the kill switch works?
Drill it. Trigger it in a non-production setup that mirrors production, time how long until every action path is blocked, then try harmless canary actions with the old tokens and helpers and confirm the issuers refuse them. Record any gap, such as a token that outlives the stop or a connector that cannot revoke.
How is this different from the Agent IR Tabletop Lab?
The tabletop lab sequences the response to a hijacked agent through the incident lifecycle. This lab is about building and verifying the stop mechanism before an incident: independence from the agent, the grant ledger, revocation coverage, independent records and drills.
How is the lab scored?
Each of the 12 decisions scores 0 to 10 and the result is your share of the maximum, with a band that says what the score means. The debrief shows the source behind each rationale; lines labelled PlayCISO practice are our reasoning.
Sources
All read on 4 November 2026. Lines in the feedback marked “PlayCISO practice” are our own reasoning, not a statement by any source. The scenarios are fictional. We cite primary sources, not vendor advisories, and say where a page could not be fully read.
- OWASP GenAI Security Project: LLM06:2025 Excessive Agency (2025 edition)
- Salt Security (Salt Labs): How we hijacked an AI agent with a single email (1 October 2026 (as dated on the page)) Research by the vendor Salt Security. Salt says the flaw is fixed; the page gives no dates for report, fix or vendor reply.
- Model Context Protocol documentation: Security Best Practices (Current version on 4 Nov 2026)
- AWS documentation: Temporary security credentials in IAM (Current version on 4 Nov 2026)
- Microsoft Learn: What are managed identities for Azure resources? (Page metadata ms.date 19 August 2025)
- Binance Blog (Community): 29 October 2026 Binance Security Incident: Initial Findings and Response Update (4 November 2026 (as dated in our earlier notes; the blog listing shows 3 November)) Our automated fetch on 4 Nov 2026 returned only the blog listing summary, not the article. The detail we use comes from the text the PlayCISO owner supplied on 3 November 2026 and is already worded in our Binance coverage. It is Binance's statement, not independently verified, and Binance calls it an initial report.
- Elliptic: Binance: the largest hack in history (Published 30 October 2026, updated 1 November 2026) On-chain analysis. Elliptic says its analysis indicates private keys were not stolen and that Binance systems were induced to sign.
- OWASP GenAI Security Project (Agentic Security Initiative): OWASP Top 10 for Agentic Applications for 2026 (9 December 2025 (as dated on the page)) The page describes the framework but our fetch did not return the ten entries, so we cite it as a framework and quote no individual entry.
More security tools
The tools people use most on PlayCISO.
Catch injected instructions hiding in content your AI agent should only read.
Score your readiness against the first international standard for AI security threats.
Critical CVEs across 21 major vendors, month by month — and what the 2026 surge means.
Build an ordered ruleset, replay labelled packets and catch shadowed and any-to-any rules.
Self-assess all six Functions, from Govern to Recover, and see your weakest one.
Search 172 threat actors across Microsoft, CrowdStrike, Mandiant and community names.