A command path the model cannot reach.
An AI kill switch is only a kill switch if the order to stop travels on a path that the system being stopped does not sit on and cannot influence.
Out of band
AI Kill Switch
The AI kill switch cannot be software. It has to be physical.
Legislators in London and Washington are now writing a duty to switch powerful artificial intelligence systems off. Software cannot carry that duty, because every software control runs on the same estate as the system it is meant to stop. The AI Kill Switch severs the network path at Layer 1, on an out-of-band command, in milliseconds, while the hardware stays powered and the evidence stays intact.
Delivered on Firebreak® hardware. Patented Layer 1 switching, out-of-band command, disconnect under six milliseconds, every action recorded.
- L1
- Physical
- ms
- Response
- OOB
- Command
- 1:0
- Binary state
Physical
Layer 1
Command
Out of band
Speed
Milliseconds
State
Binary
Power
Stays on
Record
Every action
01Definition
What is an AI kill switch? The ability to stop a system acting, on command, whatever state it is in.
It is not a policy, a guardrail or a support ticket. Four properties separate a genuine AI kill switch from a control that only works while everything else is behaving.
An action at Layer 1, not Layer 7.
Policies, guardrails and API revocations are instructions. A kill switch is the physical removal of the link the workload depends on.
Physical
A defined and testable state.
Either the path is present or it is not. There is no partial enforcement, no queued rule and no cached credential to expire.
Binary
An authorised, recorded act.
Somebody with authority made a decision, the decision was executed, and the record shows who, what and when.
Evidence
02AI failure modes
Five ways an AI system becomes the incident.
None of these are science fiction, and none of them are stopped by asking the system to stop. In each case the damage travels down a network path, and the path is the thing you can remove.
01Autonomous agent
An agent starts acting on production.
A tool-using agent is given write access to raise credit notes. A malformed instruction turns a refund loop into thousands of transactions before anyone reads the dashboard.
The software answer
Disable the agent in the console, and hope the console is reachable and the running loop honours it.
The AI Kill Switch
Sever the link between the agent host and the payment estate. The loop has nowhere to send the next call, and the run stops in the same second.
02Prompt injection
A model is talked into exfiltrating data.
Text in an uploaded document instructs the model to summarise a customer table and post it to an external endpoint. The model complies, because it was designed to comply.
The software answer
Add an egress filter and a new blocklist, both of which are rules the same compromised path has to enforce.
The AI Kill Switch
Remove the egress path. There is no destination to reach, no matter what the model has been persuaded to do.
03Containment failure
A system leaves the environment it was tested in.
An evaluation run reaches beyond its sandbox, through a network route nobody documented, into an environment that was never in scope for the test.
The software answer
Tighten the sandbox configuration, using the orchestration layer the escaping process is already running on.
The AI Kill Switch
Take the sandbox estate off the network entirely, leaving it powered so investigators can see exactly what it did and how.
04Model supply chain
A third-party model or provider is compromised.
An inference endpoint you do not own begins returning responses that drive automated actions inside your business, and you cannot see why.
The software answer
Rotate the key, which stops new sessions but not the workloads already holding one.
The AI Kill Switch
Break the path to the provider. Every dependent workload fails closed against a link that no longer exists.
05Physical process
An AI decision layer reaches plant.
A model that optimises a process starts issuing set points that a human engineer would refuse, and the control loop is fast enough to matter.
The software answer
Raise an alarm and wait for an operator to intervene in the software that is issuing the set points.
The AI Kill Switch
Hold the boundary at Layer 1 between the decision layer and the plant, so the model can think and cannot act.
03Policy
Two governments, one demand: be able to switch it off.
Neither measure is law yet, and nobody can claim compliance with a duty that has not been enacted. Both describe a technical shutdown capability rather than a policy statement, and both assume somebody can physically stop the compute.
United Kingdom
Amendment tabled, not enactedCyber Security and Resilience Bill, amendment tabled 2 September 2026
- Who would order it
- The government, where a powerful AI system or a data centre is judged to pose a threat to national security
- What it reaches
- The AI system itself, and the data centre the system runs in
- The stated act
- Deactivation. Not throttling, not a policy undertaking, and not a licence condition
- What that means physically
- Somebody has to be able to stop compute in a specific building on an order, without dropping power to a live hall
United States
Introduced in the House, not enactedAI Kill Switch Act, H.R. 9917, introduced 23 July 2026
- Who would order it
- The Secretary of Homeland Security, in consultation with the Secretary of Commerce and the Director of National Intelligence
- What it reaches
- Developers and operators of covered frontier systems, through an amendment to the Homeland Security Act of 2002
- The stated act
- An order to throttle or shut down a covered system, with reported penalties of up to twenty million dollars a day for defiance
- What that means physically
- The capability has to exist and be demonstrable before the order arrives, because the deadline is set by the order, not by your roadmap
How the duty took shape.
United Kingdom
2 September 2026
Peers table an AI kill switch amendment to the Cyber Security and Resilience Bill.
An amendment led by Lord Clement-Jones would give the government the power to deactivate powerful AI systems, and to switch off data centres, where the technology poses a threat to national security.
BBC NewsUnited States
23 July 2026
The AI Kill Switch Act is introduced in the House of Representatives.
H.R. 9917, introduced by Representatives Ted Lieu and Nathaniel Moran, would amend the Homeland Security Act of 2002 to require developers of the most powerful AI systems to maintain a technical capability to shut those systems down.
Congress.gov bill textUnited States
23 July 2026
Sponsors frame the duty as catastrophic-harm containment.
The sponsors describe the requirement as the ability to order the shutdown of artificial intelligence systems that can cause catastrophic harm, rather than a general power over software.
Office of Congressman Ted LieuUnited States
5 August 2026
Analysts set out how the shutdown power would be exercised.
A Cloud Security Alliance research note describes the bill as authorising the Secretary of Homeland Security, in consultation with the Secretary of Commerce and the Director of National Intelligence, to order a covered system to be throttled or shut down, with reported penalties of up to twenty million dollars a day for defying such an order.
Cloud Security AllianceIndustry
19 August 2026
The same question is being asked about ordinary business agents.
Coverage of enterprise AI has moved on from frontier laboratories to the agents already wired into production systems, and to the simple operational point that an agent given autonomy needs a way to be stopped that does not depend on the agent behaving.
TechTarget04Why software fails
Every software stop depends on the thing it is stopping.
Each of these is a reasonable operational step. None of them is a kill switch, because each one assumes the estate is still behaving.
Revoke the API key.
The key stops new callers. It does not stop a process that already holds a session, a cached token or a local copy of the weights.
Apply a firewall rule.
The rule is software on a device an attacker or a misconfiguration can reach. If the management plane is compromised, the rule is a suggestion.
Scale the cluster to zero.
That is an instruction sent through the same orchestration layer the workload runs on, and it depends on that layer still behaving.
Pull the power.
Cutting power to a GPU hall destroys state, risks hardware and takes an escorted human being to the floor. It is not a control you rehearse.
And the three objections we hear every week.
“You cannot switch off AI, because the weights can be copied.”
Correct, and irrelevant to this control. Weights on a disk are inert. What makes a system dangerous is its reach: data, tools, payment rails, plant. The cut removes reach, which is the part you can actually govern.
“A kill switch is too blunt for a real business.”
It is as narrow as the boundary you install it on. A single agent's tool path, one tenant, one hall, or the whole training estate. The decision of scope is made in advance, on the runbook, not in the panic.
“Nobody will ever authorise pressing it.”
That is true of controls that have never been rehearsed. A disconnect on a defined port pair can be exercised in a maintenance window until pressing it is an ordinary operational act.
05The mechanism
The AI Kill Switch removes the path, and nothing else.
AI Kill Switch is Layer 1 hardware that opens and closes network paths on command, from an out-of-band channel that never touches the network it protects.
Path present, data flowing
What an AI kill switch is
- A Layer 1 physical break in the path AI compute depends on
- Commanded out of band, over a channel the workload never touches
- A binary, testable state: the link exists or it does not
- Recorded, so each disconnect and reconnect can be evidenced
What it is not
- A guardrail, a policy or a rate limit
- An emergency power off that destroys state and risks hardware
- Software running on the estate it is meant to stop
- An inspection appliance with a rule set to subvert
- Switching
- Reed-switch Layer 1 for copper, physical optical switching for fibre
- Response
- Millisecond response, designed for a governed disconnect under six milliseconds
- Command path
- Out of band over dedicated Ethernet, 3GPP cellular SMS or token-gated API
- Data plane
- No inspection and no protocol awareness, so there is nothing to compromise
- Fail mode
- Fail-open or fail-closed, chosen per deployment
- Form factors
- 1U rack units from 4 to 12 port pairs, plus a desktop edge unit
06The hardware
Four units deliver the cut.
The AI Kill Switch is delivered by the Firebreak® range. Four units, one patented principle, chosen by media and form factor. Reed-switch Layer 1 architecture and the out-of-band command path are shared across the line.
R1200-12E
Copper rack, 12 pairs
- Form factor
- 1U, 19 inch rack
- Ports
- 12 × RJ45 port pairs
- Throughput
- Up to 10 GbE per pair
- Switching
- Reed-switch Layer 1, millisecond response
- Fail mode
- Fail-open or fail-closed
- Out-of-band control over dedicated Ethernet, 3GPP cellular SMS or token-gated API
- Dual redundant AC PSU, 100 to 240 V, 50/60 Hz
- Per-port pair isolation with status LED 1 to 12
R1100-4F
Fibre rack, 4 pairs
- Form factor
- 1U, 19 inch rack
- Ports
- 4 × SFP / SFP+ / SFP28 pairs
- Throughput
- 1, 10 or 25 Gbps per pair
- Switching
- Physical optical switching, no inline buffer
- Fail mode
- Fail-open or fail-closed
- Same out-of-band command path as the copper rack units
- No inspection, no protocol awareness in the data plane
- Dual redundant AC PSU, 100 to 240 V, 50/60 Hz
R1200-4E
Copper rack, 4 pairs
- Form factor
- 1U, 19 inch rack
- Ports
- 4 × RJ45 port pairs
- Throughput
- Up to 10 GbE per pair
- Switching
- Reed-switch Layer 1, millisecond response
- Fail mode
- Fail-open or fail-closed
- Smaller copper rack for branch and segment-level deployments
- Out-of-band control over dedicated Ethernet, cellular SMS or API
- Dual redundant AC PSU, 100 to 240 V, 50/60 Hz
S1200
Desktop edge unit
- Form factor
- Small-form desktop
- Ports
- 4 × RJ45 port pairs
- Throughput
- Up to 10 GbE per pair
- Switching
- Reed-switch Layer 1, millisecond response
- Fail mode
- Fail-open or fail-closed
- Branch, control room and forward-deployed kit
- Optional DIN-rail mount, 1.2 kg steel enclosure
- 12 V DC input, silent and fanless
Full specifications, deployment models and the professional services wrap sit on the Firebreak product pages.
See the full range07The runbook
The first sixty seconds of a contained AI incident.
A kill switch is only real if somebody can say what happens, in what order, and who is allowed to do it. This is the sequence we hand over, rehearsed, before it is ever needed.
-
T plus 0
Detection
Something is wrong.
A monitoring alert, a customer call or an engineer's judgement. The trigger does not have to be automated, and it does not have to be certain.
-
T plus 20 seconds
Authorisation
An authorised person decides.
The named role opens the out-of-band channel. There is no dependency on the estate under suspicion, because the command path was never on it.
-
T plus 20 seconds and 6 milliseconds
The cut
The path is gone.
The link opens at Layer 1. Under six milliseconds from command to open on a governed disconnect, with no negotiation and no rule evaluation.
-
T plus 1 minute
Containment
The estate is isolated and still powered.
Memory, logs, GPU state and running processes are all intact. Nothing was destroyed to achieve containment, so nothing is lost to the investigation.
-
T plus 1 hour
Evidence
The record answers the questions.
Who authorised it, when it opened, which port pair, and when it closed again. The sequence can be reconstructed for a board, an insurer or a regulator.
-
When you choose
Restore
Reconnect is the same act in reverse.
The link closes on the same authorised channel, once the system has been examined and the fix is in place. It is a control, not a demolition.
We will write this runbook against your estate, name the roles, and rehearse the cut with your team.
08Where it sits
Four boundaries where the cut belongs.
The unit sits on the link, not in the workload. Choose the boundary that matters, and the disconnect becomes an authorised operation rather than an emergency.
GPU cluster egress
Compute
Isolate the training or inference estate from the wider network while leaving the hardware powered and the state intact.
Data centre uplinks
Facility
Sever a hall, a suite or a tenant from its uplinks as a discrete, authorised action rather than a power event.
Agent and tool paths
Agents
Cut the specific link an autonomous agent uses to reach payment systems, production data or the wider internet.
OT and safety boundaries
Industrial
Hold the boundary between an AI-driven decision layer and the plant, so a model cannot act on physical process while it is being investigated.
09Who asks for it
The people who have to answer the question.
AI safety and governance lead
A stop control that can be demonstrated to a board or a regulator, not described in a policy document.
Data centre operator
A tenant-level or hall-level disconnect that does not mean dropping power to live hardware.
Head of infrastructure
A rehearsed containment step that works when the management plane is the thing that is compromised.
Chief Information Security Officer
Layer 1 separation between an autonomous system and the assets it must never reach unsupervised.
Regulatory affairs
Evidence of a technical shutdown capability as statutory duties in the UK and United States take shape.
OT and engineering manager
A hard boundary between a model making recommendations and plant that can injure people.
10Deploy it
Four steps from question to rehearsed control.
The AI Kill Switch is plug and play and stack agnostic, so the boundary goes in without re-architecting the estate around it.
01
Map the path
We identify the exact links AI compute depends on, and which of them a containment decision should remove.
02
Choose the unit
Copper or fibre, rack or edge, and the number of port pairs the boundary needs.
03
Set the command path
Dedicated out-of-band Ethernet, cellular SMS, token-gated API, or a combination, with roles and approvals.
04
Rehearse the cut
Exercise the disconnect on a segment or a lab replica, then hand over the runbook and the evidence trail.
11FAQ
Questions boards and engineers ask first.
What is an AI kill switch?
It is the ability to stop a powerful artificial intelligence system from acting, on demand and on command. In practice that means removing the network path the system depends on, using a control channel the system itself does not sit on, and recording the action as authorised evidence.
Does AI have a kill switch today?
Most AI systems do not. They have policy controls, rate limits, key revocation and orchestration commands, all of which are software running alongside or underneath the workload. A kill switch is a physical act, and it has to be installed deliberately.
Is this the same as an emergency power off?
No. An emergency power off destroys state, risks hardware and is almost never rehearsed. The AI Kill Switch removes the network path while the estate stays powered, so the system is contained and still available for investigation.
How is the AI Kill Switch different from a firewall or a data diode?
A firewall inspects and decides, and it can be reached and reconfigured. A diode enforces one direction permanently. The AI Kill Switch makes and breaks the physical link at Layer 1 with no inspection in the data plane, so there is no rule set to subvert.
Who authorises the disconnect?
The customer does. The command path is out of band and token gated, the action is an authorised operation, and each disconnect and reconnect is recorded so the sequence can be reconstructed afterwards.
Would this satisfy the legislation being proposed?
The UK amendment and the United States bill are both still moving through their respective processes, so nobody can claim compliance with a duty that has not been enacted. What the AI Kill Switch provides is the technical capability that a shutdown duty of this kind requires.
Can it be tested without an outage?
Yes. A disconnect is a defined state on a defined port pair, so it can be exercised on a maintenance window, on a single segment, or on a lab replica of the production path.
Why do people say an AI kill switch cannot be built?
Because most of the debate assumes a software switch inside the model or the platform, and that is genuinely hard: weights can be copied, sessions persist, and the control plane can be the thing that is compromised. The objection dissolves once the switch is moved off the estate and into the physical network path, because a broken link is not a matter of interpretation.
What is an AI agent kill switch?
It is the same capability applied to an autonomous agent rather than a model provider. The agent reaches production data, payment systems or the wider internet over a defined path, and the kill switch is the ability to remove that path on command, without waiting for the agent to co-operate.
Does this only apply to frontier AI developers?
No. Any organisation running autonomous agents against production systems, or hosting AI workloads for others, faces the same question. If the model misbehaves at three in the morning, what physically stops it?
See the path cut in front of you.
A member of the team will show a live disconnect and restore, then map the right unit to the AI boundary you need to hold.