AI Kill SwitchA command path the AI system cannot reach.
An AI kill switch is only a kill switch if the order to stop travels on a path that the system being stopped does not sit on and cannot influence.
Out of band
AI Kill Switch
AI Kill Switch hardware for physical AI shutdown.
The Firevault AI Kill Switch is a physical product for data centres and enterprise AI systems. It severs a defined network path at Layer 1, on an out-of-band command, in milliseconds. The AI system stays powered for investigation while its ability to reach data, tools and critical infrastructure is removed.
Part of CP-08 · Control AI Systems, the Control Blueprint for AI infrastructure.
Delivered on Firebreak® hardware. Patented Layer 1 switching, out-of-band command, disconnect under six milliseconds, every action recorded.
- L1
- Physical
- ms
- Response
- OOB
- Command
- 1:0
- Binary state
Physical
Layer 1
Command
Out of band
Speed
Milliseconds
State
Binary
Power
Stays on
Record
Every action
01Definition
What is an AI kill switch? A way to stop a system without relying on that system to comply.
It is not a policy, a guardrail or a support ticket. Four properties separate a genuine AI kill switch from a control that only works while everything else is behaving.
An action at Layer 1, not Layer 7.
Policies, guardrails and API revocations are instructions. A kill switch is the physical removal of the link the workload depends on.
Physical
A defined and testable state.
Either the path is present or it is not. There is no partial enforcement, no queued rule and no cached credential to expire.
Binary
An authorised, recorded act.
Somebody with authority made a decision, the decision was executed, and the record shows who, what and when.
Evidence
02AI failure modes
Five ways an AI system becomes the incident.
These are practical containment problems, not science fiction. In each case, the system acts through a network path. Removing that path stops the next action without asking the system to co-operate.
01Autonomous agent
An agent starts acting on production.
A tool-using agent is given write access to raise credit notes. A malformed instruction turns a refund loop into thousands of transactions before anyone reads the dashboard.
The software answer
Disable the agent in the console, and hope the console is reachable and the running loop honours it.
The AI Kill Switch
Sever the link between the agent host and the payment estate. The loop has nowhere to send the next call, and the run stops in the same second.
02Prompt injection
A model is talked into exfiltrating data.
Text in an uploaded document instructs the model to summarise a customer table and post it to an external endpoint. The model complies, because it was designed to comply.
The software answer
Add an egress filter and a new blocklist, both of which are rules the same compromised path has to enforce.
The AI Kill Switch
Remove the egress path. There is no destination to reach, no matter what the model has been persuaded to do.
03Containment failure
A system leaves the environment it was tested in.
An evaluation run reaches beyond its sandbox, through a network route nobody documented, into an environment that was never in scope for the test.
The software answer
Tighten the sandbox configuration, using the orchestration layer the escaping process is already running on.
The AI Kill Switch
Take the sandbox estate off the network entirely, leaving it powered so investigators can see exactly what it did and how.
04Model supply chain
A third-party model or provider is compromised.
An inference endpoint you do not own begins returning responses that drive automated actions inside your business, and you cannot see why.
The software answer
Rotate the key, which stops new sessions but not the workloads already holding one.
The AI Kill Switch
Break the path to the provider. Every dependent workload fails closed against a link that no longer exists.
05Physical process
An AI decision layer reaches plant.
A model that optimises a process starts issuing set points that a human engineer would refuse, and the control loop is fast enough to matter.
The software answer
Raise an alarm and wait for an operator to intervene in the software that is issuing the set points.
The AI Kill Switch
Hold the boundary at Layer 1 between the decision layer and the plant, so the model can think and cannot act.
03The mechanism
The AI Kill Switch removes the path, and nothing else.
The AI Kill Switch is Layer 1 hardware that opens and closes network paths on command, using an out-of-band channel that is separate from the network it protects.
Severed at Layer 1, compute still powered
What an AI kill switch is
- A Layer 1 physical break in the path AI compute depends on
- Commanded out of band, over a channel the workload never touches
- A binary, testable state: the link exists or it does not
- Recorded, so each disconnect and reconnect can be evidenced
What it is not
- A guardrail, a policy or a rate limit
- An emergency power off that destroys state and risks hardware
- Software running on the estate it is meant to stop
- An inspection appliance with a rule set to subvert
- Switching
- Reed-switch Layer 1 for copper, physical optical switching for fibre
- Response
- Millisecond response, designed for a governed disconnect under six milliseconds
- Command path
- Out of band over dedicated Ethernet, 3GPP cellular SMS or token-gated API
- Data plane
- No inspection and no protocol awareness, so there is nothing to compromise
- Fail mode
- Fail-open or fail-closed, chosen per deployment
- Form factors
- 1U rack units from 4 to 12 port pairs, plus a desktop edge unit
04Why software fails
Every software stop depends on the thing it is stopping.
Each of these is a reasonable operational step. None of them is a kill switch, because each one assumes the estate is still behaving.
Revoke the API key.
The key stops new callers. It does not stop a process that already holds a session, a cached token or a local copy of the weights.
Apply a firewall rule.
The rule is software on a device an attacker or a misconfiguration can reach. If the management plane is compromised, the rule is a suggestion.
Scale the cluster to zero.
That is an instruction sent through the same orchestration layer the workload runs on, and it depends on that layer still behaving.
Pull the power.
Cutting power to a GPU hall destroys state, risks hardware and takes an escorted human being to the floor. It is not a control you rehearse.
Three common objections.
“You cannot switch off AI, because the weights can be copied.”
Correct, and irrelevant to this control. Weights on a disk are inert. What makes a system dangerous is its reach: data, tools, payment rails, plant. The cut removes reach, which is the part you can actually govern.
“A kill switch is too blunt for a real business.”
It is as narrow as the boundary you install it on. A single agent's tool path, one tenant, one hall, or the whole training estate. The decision of scope is made in advance, on the runbook, not in the panic.
“Nobody will ever authorise pressing it.”
That is true of controls that have never been rehearsed. A disconnect on a defined port pair can be exercised in a maintenance window until pressing it is an ordinary operational act.
05Policy
Two governments, one demand: be able to switch it off.
Neither measure is law yet, so nobody can claim compliance with a duty that has not been enacted. Both describe a technical shutdown capability rather than a policy statement.
United Kingdom
Amendment tabled, not enactedCyber Security and Resilience Bill, amendment tabled 2 September 2026
- Who would order it
- The government, where a powerful AI system or a data centre is judged to pose a threat to national security
- What it reaches
- The AI system itself, and the data centre the system runs in
- The stated act
- Deactivation. Not throttling, not a policy undertaking, and not a licence condition
- What that means physically
- Somebody has to be able to stop compute in a specific building on an order, without dropping power to a live hall
United States
Introduced in the House, not enactedAI Kill Switch Act, H.R. 9917, introduced 23 July 2026
- Who would order it
- The Secretary of Homeland Security, in consultation with the Secretary of Commerce and the Director of National Intelligence
- What it reaches
- Developers and operators of covered frontier systems, through an amendment to the Homeland Security Act of 2002
- The stated act
- An order to throttle or shut down a covered system, with reported penalties of up to twenty million dollars a day for defiance
- What that means physically
- The capability has to exist and be demonstrable before the order arrives, because the deadline is set by the order, not by your roadmap
How the duty took shape.
United Kingdom
2 September 2026
Peers table an AI kill switch amendment to the Cyber Security and Resilience Bill.
An amendment led by Lord Clement-Jones would give the government the power to deactivate powerful AI systems, and to switch off data centres, where the technology poses a threat to national security.
BBC NewsUnited States
23 July 2026
The AI Kill Switch Act is introduced in the House of Representatives.
H.R. 9917, introduced by Representatives Ted Lieu and Nathaniel Moran, would amend the Homeland Security Act of 2002 to require developers of the most powerful AI systems to maintain a technical capability to shut those systems down.
Congress.gov bill textUnited States
23 July 2026
Sponsors frame the duty as catastrophic-harm containment.
The sponsors describe the requirement as the ability to order the shutdown of artificial intelligence systems that can cause catastrophic harm, rather than a general power over software.
Office of Congressman Ted LieuUnited States
5 August 2026
Analysts set out how the shutdown power would be exercised.
A Cloud Security Alliance research note describes the bill as authorising the Secretary of Homeland Security, in consultation with the Secretary of Commerce and the Director of National Intelligence, to order a covered system to be throttled or shut down, with reported penalties of up to twenty million dollars a day for defying such an order.
Cloud Security AllianceIndustry
19 August 2026
The same question is being asked about ordinary business agents.
Coverage of enterprise AI has moved on from frontier laboratories to the agents already wired into production systems, and to the simple operational point that an agent given autonomy needs a way to be stopped that does not depend on the agent behaving.
TechTarget06The hardware
Four boundaries, four units.
The unit sits on the link, not in the workload. Choose the boundary that matters, then the unit that matches the media and the form factor. Reed-switch Layer 1 architecture and the out-of-band command path are shared across the Firebreak® range.
GPU cluster egress
Compute
Isolate the training or inference estate from the wider network while leaving the hardware powered and the state intact.
Data centre uplinks
Facility
Sever a hall, a suite or a tenant from its uplinks as a discrete, authorised action rather than a power event.
Agent and tool paths
Agents
Cut the specific link an autonomous agent uses to reach payment systems, production data or the wider internet.
OT and safety boundaries
Industrial
Hold the boundary between an AI-driven decision layer and the plant, so a model cannot act on physical process while it is being investigated.
The units that deliver the cut.
R1200-12E
Copper rack, 12 pairs
- Form factor
- 1U, 19 inch rack
- Ports
- 12 × RJ45 port pairs
- Switching
- Reed-switch Layer 1, millisecond response
- Fail mode
- Fail-open or fail-closed
R1100-4F
Fibre rack, 4 pairs
- Form factor
- 1U, 19 inch rack
- Ports
- 4 × SFP / SFP+ / SFP28 pairs
- Switching
- Physical optical switching, no inline buffer
- Fail mode
- Fail-open or fail-closed
R1200-4E
Copper rack, 4 pairs
- Form factor
- 1U, 19 inch rack
- Ports
- 4 × RJ45 port pairs
- Switching
- Reed-switch Layer 1, millisecond response
- Fail mode
- Fail-open or fail-closed
S1200
Desktop edge unit
- Form factor
- Small-form desktop
- Ports
- 4 × RJ45 port pairs
- Switching
- Reed-switch Layer 1, millisecond response
- Fail mode
- Fail-open or fail-closed
Full specifications, deployment models and the professional services wrap sit on the Firebreak product pages.
See the full range07Runbook and deployment
The first sixty seconds, and the four steps that get you there.
A kill switch is only real if somebody can say what happens, in what order, and who is allowed to do it. This is the sequence we hand over, rehearsed, before it is ever needed.
-
T plus 0
Detection
Something is wrong.
A monitoring alert, a customer call or an engineer's judgement. The trigger does not have to be automated, and it does not have to be certain.
-
T plus 20 seconds
Authorisation
An authorised person decides.
The named role opens the out-of-band channel. There is no dependency on the estate under suspicion, because the command path was never on it.
-
T plus 20 seconds and 6 milliseconds
The cut
The path is gone.
The link opens at Layer 1. Under six milliseconds from command to open on a governed disconnect, with no negotiation and no rule evaluation.
-
T plus 1 minute
Containment
The estate is isolated and still powered.
Memory, logs, GPU state and running processes are all intact. Nothing was destroyed to achieve containment, so nothing is lost to the investigation.
-
T plus 1 hour
Evidence
The record answers the questions.
Who authorised it, when it opened, which port pair, and when it closed again. The sequence can be reconstructed for a board, an insurer or a regulator.
-
When you choose
Restore
Reconnect is the same act in reverse.
The link closes on the same authorised channel, once the system has been examined and the fix is in place. It is a control, not a demolition.
Four steps from question to rehearsed control.
The AI Kill Switch is designed to work independently of the software stack, so it can be installed at a defined network boundary without rebuilding the estate around it.
01
Map the path
We identify the exact links AI compute depends on, and which of them a containment decision should remove.
02
Choose the unit
Copper or fibre, rack or edge, and the number of port pairs the boundary needs.
03
Set the command path
Dedicated out-of-band Ethernet, cellular SMS, token-gated API, or a combination, with roles and approvals.
04
Rehearse the cut
Exercise the disconnect on a segment or a lab replica, then hand over the runbook and the evidence trail.
We will write this runbook against your estate, name the roles, and rehearse the cut with your team.
The wider architecture
A kill switch on its own is a component.
CP-08 · Control AI Systems is the Blueprint around it: what is cut, who is allowed to cut it, and what the cut is protecting. The 2026 playbook covers the same ground in forty pages for boards, CISOs and AI programme leads.
08FAQ
Questions boards and engineers ask first.
What is an AI kill switch?
It is the ability to stop a powerful artificial intelligence system from acting, on demand and on command. In practice that means removing the network path the system depends on, using a control channel the system itself does not sit on, and recording the action as authorised evidence.
What is an AI Control Blueprint?
It is the architecture that surrounds the switch. Layer one controls the path into and out of AI compute. Layer two governs the agent, so authority, time limits and evidence are explicit. Layer three protects the asset, holding model weights, training data and recovery points offline. Firevault publishes the full blueprint as a forty-page 2026 playbook.
Does AI have a kill switch today?
Most AI systems do not. They have policy controls, rate limits, key revocation and orchestration commands, all of which are software running alongside or underneath the workload. A kill switch is a physical act, and it has to be installed deliberately.
Is this the same as an emergency power off?
No. An emergency power off destroys state, risks hardware and is almost never rehearsed. The AI Kill Switch removes the network path while the estate stays powered, so the system is contained and still available for investigation.
How is the AI Kill Switch different from a firewall or a data diode?
A firewall inspects and decides, and it can be reached and reconfigured. A diode enforces one direction permanently. The AI Kill Switch makes and breaks the physical link at Layer 1 with no inspection in the data plane, so there is no rule set to subvert.
Who authorises the disconnect?
The customer does. The command path is out of band and token gated, the action is an authorised operation, and each disconnect and reconnect is recorded so the sequence can be reconstructed afterwards.
Would this satisfy the legislation being proposed?
The UK amendment and the United States bill are both still moving through their respective processes, so nobody can claim compliance with a duty that has not been enacted. What the AI Kill Switch provides is the technical capability that a shutdown duty of this kind requires.
Can it be tested without an outage?
Yes. A disconnect is a defined state on a defined port pair, so it can be exercised on a maintenance window, on a single segment, or on a lab replica of the production path.
Why do people say an AI kill switch cannot be built?
Because most of the debate assumes a software switch inside the model or the platform, and that is genuinely hard: weights can be copied, sessions persist, and the control plane can be the thing that is compromised. The objection dissolves once the switch is moved off the estate and into the physical network path, because a broken link is not a matter of interpretation.
What is an AI agent kill switch?
It is the same capability applied to an autonomous agent rather than a model provider. The agent reaches production data, payment systems or the wider internet over a defined path, and the kill switch is the ability to remove that path on command, without waiting for the agent to co-operate.
Does this only apply to frontier AI developers?
No. Any organisation running autonomous agents against production systems, or hosting AI workloads for others, faces the same question. If the model misbehaves at three in the morning, what physically stops it?
How does an AI kill switch relate to superintelligence?
Superintelligence remains hypothetical. The practical control question already exists: can an organisation stop a consequential AI system without relying on that system or its software management plane? Firevault uses the physical Firebreak hardware device for that independent disconnect within the wider CP-08 AI Control Blueprint.
See the path cut in front of you.
A member of the team will show a live disconnect and restore, then map the right unit to the AI boundary you need to hold.