Firevault, offline secure storage, physically disconnected from the internet
Pricing
AI Kill SwitchPart of CP-08 Control AI Systems

AI Kill Switch hardware for physical AI shutdown.

For data centres and enterprise AI systems, built on Firebreak® and manufactured by Firevault. It severs a defined network path at Layer 1, on an out-of-band command, in milliseconds. The AI system stays powered for investigation while its ability to reach data, tools and critical infrastructure is removed.

  • Layer 1, not Layer 7
  • Out-of-band command
  • Stays powered
  • Every action recorded

As featured in

  • TechRadar Pro logo
  • Yahoo Finance logo
  • Channel Insider logo
  • Security Buyer logo
  • SecurityBrief logo
AI Kill SwitchOut of band

BoundaryOn the linkPath

  • GPU cluster egressIsolate the training or inference estate from the wider network while leaving the hardware poweredPath open
  • Data centre uplinksSever a hall, a suite or a tenant from its uplinks as a discrete, authorised actionPath open
  • Agent and tool pathsCut the specific link an autonomous agent uses to reach payment systems and production dataCut
  • OT and safety boundariesHold the boundary between an AI-driven decision layer and the plantHeld

The AI system stays powered for investigation

Every disconnect recordedWho, which port pair, when

Illustration

Physical
L1
Response
ms
Command
OOB
Binary state
1:0

Why software stops fail

Every software stop depends on the thing it is stopping.

Each of these is a reasonable operational step. None of them is a kill switch, because each one assumes the estate is still behaving.

Revoke the API key.

The key stops new callers. It does not stop a process that already holds a session, a cached token or a local copy of the weights.

Apply a firewall rule.

The rule is software on a device an attacker or a misconfiguration can reach. If the management plane is compromised, the rule is a suggestion.

Scale the cluster to zero.

That is an instruction sent through the same orchestration layer the workload runs on, and it depends on that layer still behaving.

Pull the power.

Cutting power to a GPU hall destroys state, risks hardware and takes an escorted human being to the floor. It is not a control you rehearse.

An attacker at a laptop beside a server rack

What it is

What is an AI kill switch? A way to stop a system without relying on that system to comply.

It is not a policy, a guardrail or a support ticket. Four properties separate a genuine AI kill switch from a control that only works while everything else is behaving.

A command path the AI system does not sit on.

The order to stop travels on a path that the system being stopped does not sit on.

An action at Layer 1, not Layer 7.

Policies, guardrails and API revocations are instructions. A kill switch is the physical removal of the link the workload depends on.

A defined and testable state.

Either the path is present or it is not. There is no partial enforcement, no queued rule and no cached credential to expire.

An authorised, recorded act.

Somebody with authority made a decision, the decision was executed, and the record shows who, what and when.

The command path

Illustration

Five scenarios

Five ways an AI system becomes the incident.

These are practical containment problems, not science fiction. In each case, the system acts through a network path. Removing that path stops the next action without asking the system to co-operate.

Scenario 1

An agent starts acting on production.

A tool-using agent is given write access to raise credit notes. A malformed instruction turns a refund loop into thousands of transactions before anyone reads the dashboard.

The cut: sever the link between the agent host and the payment estate. The loop has nowhere to send the next call, and the run stops.

Scenario 2

A model is talked into exfiltrating data.

Text in an uploaded document instructs the model to summarise a customer table and post it to an external endpoint. The model complies, because it was designed to comply.

The cut: remove the egress path, and the external endpoint is no longer reachable, whatever the model has been persuaded to do.

Scenario 3

A system leaves the environment it was tested in.

An evaluation run reaches beyond its sandbox, through a network route nobody documented, into an environment that was never in scope for the test.

The cut: take the sandbox estate off the network entirely, leaving it powered so investigators can see exactly what it did and how.

Scenario 4

A third-party model or provider is compromised.

An inference endpoint you do not own begins returning responses that drive automated actions inside your business, and you cannot see why.

The cut: break the path to the provider. Every dependent workload fails closed against a link that no longer exists.

Scenario 5

An AI decision layer reaches plant.

A model that optimises a process starts issuing set points that a human engineer would refuse, and the control loop is fast enough to matter.

The cut: hold the boundary at Layer 1 between the decision layer and the plant, so the model’s decisions stop at the boundary.

Runbook

The first sixty seconds, in six steps.

From the first alert to the restore. Pick a step, or play it through.

Step 1 of 6

Detection

Something is wrong.

A monitoring alert, a customer call or an engineer’s judgement.

Network path
Present
AI system
Powered, acting
Record
Nothing yet

Illustration.

CP-08 Control AI Systems

A kill switch is the physical removal of the link the workload depends on.

An action at Layer 1, not Layer 7
Discuss the AI Kill Switch

Policy

Two governments, one demand: be able to switch it off.

Neither measure is law yet, so nobody can claim compliance with a duty that has not been enacted. Both describe a technical shutdown capability rather than a policy statement.

Two governments, one demand: be able to switch it off.
Question United Kingdom United States
Status Amendment tabled, not enacted Introduced in the House, not enacted
The measure Cyber Security and Resilience Bill, amendment tabled 2 September 2026 AI Kill Switch Act, H.R. 9917, introduced 23 July 2026
Who would order it The government, where a powerful AI system or a data centre is judged to pose a threat to national security The Secretary of Homeland Security, in consultation with the Secretary of Commerce and the Director of National Intelligence
What it reaches The AI system itself, and the data centre the system runs in Developers and operators of covered frontier systems, through an amendment to the Homeland Security Act of 2002
Stated act Deactivation. Not throttling, not a policy undertaking, and not a licence condition An order to throttle or shut down a covered system, with reported penalties of up to twenty million dollars a day for defiance
What it means physically Somebody has to be able to stop compute in a specific building on an order, without dropping power to a live hall The capability has to exist and be demonstrable before the order arrives, because the deadline is set by the order, not by your roadmap

The units

Delivered on Firebreak® hardware.

Patented Layer 1 switching and an out-of-band command, manufactured by Firevault. Every unit runs fail-open or fail-closed.

Copper rack, 12 pairs

R1200-12E

1U, 19 inch rack. 12 × RJ45 port pairs.

Reed-switch Layer 1, millisecond response.

Fibre rack, 4 pairs

R1100-4F

1U, 19 inch rack. 4 × SFP / SFP+ / SFP28 pairs.

Physical optical switching, no inline buffer.

Copper rack, 4 pairs

R1200-4E

1U, 19 inch rack. 4 × RJ45 port pairs.

Reed-switch Layer 1, millisecond response.

Desktop edge unit

S1200

Small-form desktop. 4 × RJ45 port pairs.

Reed-switch Layer 1, millisecond response.

See the Firebreak® range

Questions

What boards and engineers ask about AI shutdown

It is the ability to stop a powerful artificial intelligence system from acting, on demand and on command. In practice, it removes the network path the system depends on, over a control channel the system does not sit on, and records the action.

It is the architecture that surrounds the switch: controlling the path into and out of AI compute, governing the agent, and holding model weights, training data and recovery points offline. CP-08 Control AI Systems sets it out, and the 2026 playbook covers it in depth.

Most AI systems do not. They rely on policy controls, rate limits, key revocation and orchestration commands, which all run in software. A kill switch is a physical act, and it has to be installed deliberately.

No. An emergency power off destroys state, risks hardware and is almost never rehearsed. The AI Kill Switch removes the network path while the estate stays powered for investigation.

A firewall inspects and decides, and it can be reached and reconfigured. A data diode enforces one direction permanently. The AI Kill Switch makes and breaks the physical link at Layer 1, with no inspection in the data plane.

The customer does. The command path is out of band and token-gated, and every disconnect and reconnect is recorded.

The UK amendment and the US bill are not law, so nobody can claim compliance with a duty that has not been enacted. The AI Kill Switch is the technical capability such a duty would call for.

Yes. A disconnect is a defined state on a defined port pair, so it can be exercised in a maintenance window, on a single segment or on a lab replica.

The objection assumes a software switch inside the model. It dissolves once the switch is moved off the estate and into the physical network path.

It is the same capability applied to an autonomous agent rather than a model provider: the agent’s network path is removed on command, without waiting for the agent to co-operate.

No. Any organisation running autonomous agents against production systems, or hosting AI workloads, faces the same question.

Superintelligence remains hypothetical. The practical question is whether an organisation can stop a consequential AI system without relying on that system’s own software.

All questions

Disconnect to Protect®

See the path cut in front of you.

A member of the team will show a live disconnect and restore, then map the right unit to the AI boundary you need to hold.