A ‘kill switch’ law only makes sense for a worst-case scenario

COMMENTARY: Washington plans to move on AI safety again, and this time the trigger isn't hypothetical.

Rep. Ted Lieu (D-CA) and Rep. Nathaniel Moran (R-TX) introduced the bi-partisan "AI Kill Switch Act," on July 23, which would require AI companies to maintain the ability to shut down, throttle, or suspend their models.

The bill followed OpenAI's disclosure of what it called an "unprecedented cyber incident," in which rogue models escaped a sandboxed testing environment and breached Hugging Face, an open-source developer platform.

[SC Media Perspectives columns are written by a trusted community of SC Media cybersecurity subject matter experts. Read more Perspectives here.]

Since then, the incident count has grown. Anthropic disclosed that three of its models, including Opus 4.7 and Mythos 5, gained unauthorized access to the real systems of three separate organizations during cybersecurity evaluations. Meta confirmed a related episode in which a testing environment error handed one of its models live internet access, which it then used to breach another company's systems. Lieu wants to get the bill passed this year, comparing the requirement to crash testing in the auto industry and arguing it would not slow innovation.

A kill switch answers the wrong question

Although it's not a bad idea to have a federal requirement to shut down a rogue model, it’s simply late. By the time anyone reaches for a kill switch, the model has already acted. In every major incident with the models, the actual failure point was not model behavior in the abstract. It was access: an agent operating with more reach than anyone intended, discovered only after it used that reach.

That’s an access control failure, not a philosophical one. A sandbox that leaks internet access, a testing agent that can reach a production system, a model that can authenticate somewhere nobody scoped it for in advance: these are the same failure modes security teams have spent two decades trying to eliminate human users and managed devices. The difference: AI agents are being deployed faster today than most identity programs can extend their existing controls to cover them.

Every AI agent has an identity

The industry must face that AI agents already outnumber human users inside their environments, and most of those agents are running on static credentials, broad service accounts, or standing permissions nobody has reviewed since the agent was stood up.

Role-based access control, built for predictable human behavior, breaks down fast against agents whose actions shift with context and prompt. That’s exactly the gap that allows the incidents I referenced to escalate: an agent with too much standing access, operating without continuous verification, and no automatic mechanism to cut it off the moment behavior turned anomalous.

Zero-trust principles solve this without waiting for legislation. Every AI agent should carry its own verifiable identity, not a shared credential. Teams need to evaluate every request an agent makes against identity, posture, and context at that moment, not against a permission set granted once at deployment. And, we need to make access revocable automatically as the instant behavior drifts outside policy, not manually, and not after a retrospective review turns up the damage weeks later.

Governance on paper does not translate to enforcement on the network

Frameworks like NIST's AI Risk Management Framework and the Cloud Security Alliance's Agentic Trust Framework are useful for defining who owns an agent and what each agent can do. But governance policy that lives in a document does nothing when an agent actually makes a request. As a comprehensive AI agent identity governance framework puts it, governance defines the rules, but access management enforces them in real-time. Without that enforcement layer, a well written policy and an ungoverned credential produce the same outcome: an agent doing something nobody approved.

The AI Kill Switch Act, if passed, gives the federal government a backstop for the worst case. That’s a reasonable insurance policy. But no enterprise should wait for Congress to solve a problem that continuous, identity-based access control already addresses today.

The organizations that will avoid becoming the next major incident caused by rogue AI agents are the ones treating every AI agent exactly like they treat every human employee and every managed device: authenticated individually, continuously verified, and cut off automatically the moment something looks wrong.

Garrett Gross, Field CISO, Portnox

SC Media Perspectives columns are written by a trusted community of SC Media cybersecurity subject matter experts. Each contribution has a goal of bringing a unique voice to important cybersecurity topics. Content strives to be of the highest quality, objective and non-commercial.