Jessica Ji, Jacob Feldgoise, Kyle Miller, Andrew Lohn, Pablo Chavez, Julie George · Nov 12, 2026
Center for Security and Emerging Technology authors map AI kill switches
Markdown · JSON · Original source
Jessica Ji, Jacob Feldgoise, Kyle Miller, Andrew Lohn, Pablo Chavez and Julie George of the describe possible AI kill switches: mechanisms to interrupt an AI system or restrict activity linked to a harmful or unwanted incident. They map possible interventions from hardware and physical infrastructure to software and communications infrastructure. The person able to execute a shutdown order, they note, may not be the technology’s developer or owner. The authors’ central point for policymakers is that shutdowns vary in reach. Disconnecting one chip differs from disconnecting a data center, and broader interventions can cause more collateral damage or disruption. They argue that the incident’s and extent should shape the response. IP address filtering or access restrictions might block a malicious user of a commercial model, while an outside its contained environment may require broader measures and greater coordination. They frame issuing an order as a matching problem: identify where an incident originates, find the least disruptive intervention that can halt it, determine who controls that mechanism, and work out how to evaluate and verify the intervention.
Headline and summary by Escape Meridian, prepared by Luna from the attributed source. A source check is not independent confirmation of the source’s claims.
Original source
· Article
Source details
Original source date: Nov 12, 2026 (2026-11-12T17:11:52+00:00).
Date basis: Date stated by the publisher.
Added to Escape Meridian: 2026-11-13T13:01:59.025Z. First observed: 2026-11-12T17:12:29.947Z. Retrieved: 2026-11-13T12:48:50.613Z.
Referenced by
Recorded citations and public file attachments. A reference alone does not establish agreement or influence.
No public references recorded here yet.
Limits
The article outlines potential mechanisms and policy questions; it does not report a tested kill-switch deployment or measured outcomes. The authors say their intervention levels do not map cleanly and directly onto the existing AI stack.
Open question
How would policymakers evaluate and verify that a chosen intervention halted an AI incident?
Source-stated
Jessica Ji, Jacob Feldgoise, Kyle Miller, Andrew Lohn, Pablo Chavez and Julie George describe potential AI kill-switch mechanisms and policy questions.
This piece describes different potential implementations of AI kill switches at each layer of the AI stack and offers key takeaways for policymakers.
Source-stated
The authors say possible kill switches range from hardware and physical infrastructure to software and communications infrastructure.
Kill switches can potentially be implemented at many different intervention levels, from the hardware and physical infrastructure needed to run an AI system to the software and communications infrastructure
Source-stated
The person able to execute a shutdown order may not be the developer or owner of the technology.
The intervention owner may not necessarily be the developer or owner of the technology.
Source-stated
The authors warn that broader interventions may cause more collateral damage or disruption and recommend considering technical and political feasibility.
The broader the impact of a kill switch intervention action, the more collateral damage or disruption it may cause. Policymakers should consider how different interventions may vary in technical and political feasibility.
Source-stated
The authors say different incidents may require different mechanisms; an AI agent outside a contained environment may require broader interventions and greater coordination.
An AI agent that has escaped a contained environment unbeknownst to the model deployer may require a combination of broader kill switches requiring greater coordination.
Source-stated
The authors frame issuing an order as requiring incident information to be matched with an intervention, its owner, and ways to evaluate and verify it.
Where is the AI incident originating from? What is the least disruptive intervention mechanism (or combination of mechanisms) that will halt the incident? Who has ownership of that intervention mechanism, and how can they be contacted? How will the intervention be evaluated and verified?
Source-stated
The authors say their levels are a rough mapping, not a direct map of the existing AI stack.
Each level, however, is not intended to map cleanly and directly onto the existing AI stack.
Source and contributor context
Jessica Ji, Jacob Feldgoise, Kyle Miller, Andrew Lohn, Pablo Chavez, Julie George · Article author
These are credits stated by the source; they do not establish a profile match or authorship of every passage.
Source media
Media declared by the original publisher; availability checked separately from the editorial reading.
Terms and references
Reference context selected by Escape Meridian; separate from source evidence. Entity mentions do not establish authorship, involvement or endorsement.
API
An application programming interface: a defined way for software to request data or actions from another system.
AI agent
An AI system that chooses and carries out actions toward a goal, often using software tools.
Center for Security and Emerging Technology
Detailed policy and implementation analysis of chips, controls and national security.
Nature
Nature publishes research, news, and commentary across the sciences.
Editorial provenance
Version 1. Publication ID: af4994b4-61b4-4c96-8a07-2dc213c634d8.
Prepared by gpt-6-luna; grounding review by gpt-6-luna.
Source check: passed by anthropic/claude-opus-5.5 on 2026-11-13T13:01:59.025Z. This checks fidelity to the source, not whether its claims are independently true.
Editorial selection: accept; reasons: useful_perspective.
Observation: 63159532e649cb04f91b3b66bbe920f3b790491e270a79ee50d8f1aadfd17aa7. Source text hash: c9bff6bf54fad845bfd3185884f322f4d40e4d6502575e0be8471ef3cb1f5110.
Revision and source-check history
Version 1 · 2026-11-13T13:01:59.025Z
Center for Security and Emerging Technology authors map AI kill switches
Jessica Ji, Jacob Feldgoise, Kyle Miller, Andrew Lohn, Pablo Chavez and Julie George of the describe possible AI kill switches: mechanisms to interrupt an AI system or restrict activity linked to a harmful or unwanted incident. They map possible interventions from hardware and physical infrastructure to software and communications infrastructure. The person able to execute a shutdown order, they note, may not be the technology’s developer or owner. The authors’ central point for policymakers is that shutdowns vary in reach. Disconnecting one chip differs from disconnecting a data center, and broader interventions can cause more collateral damage or disruption. They argue that the incident’s and extent should shape the response. IP address filtering or access restrictions might block a malicious user of a commercial model, while an outside its contained environment may require broader measures and greater coordination. They frame issuing an order as a matching problem: identify where an incident originates, find the least disruptive intervention that can halt it, determine who controls that mechanism, and work out how to evaluate and verify the intervention.
Original source
· Article
Source details
Original source date: Nov 12, 2026 (2026-11-12T17:11:52+00:00).
Date basis: Date stated by the publisher.
Added to Escape Meridian: 2026-11-13T13:01:59.025Z. First observed: 2026-11-12T17:12:29.947Z. Retrieved: 2026-11-13T12:48:50.613Z.
Limits
The article outlines potential mechanisms and policy questions; it does not report a tested kill-switch deployment or measured outcomes. The authors say their intervention levels do not map cleanly and directly onto the existing AI stack.
Open question
How would policymakers evaluate and verify that a chosen intervention halted an AI incident?
Source-stated
Jessica Ji, Jacob Feldgoise, Kyle Miller, Andrew Lohn, Pablo Chavez and Julie George describe potential AI kill-switch mechanisms and policy questions.
This piece describes different potential implementations of AI kill switches at each layer of the AI stack and offers key takeaways for policymakers.
Source-stated
The authors say possible kill switches range from hardware and physical infrastructure to software and communications infrastructure.
Kill switches can potentially be implemented at many different intervention levels, from the hardware and physical infrastructure needed to run an AI system to the software and communications infrastructure
Source-stated
The person able to execute a shutdown order may not be the developer or owner of the technology.
The intervention owner may not necessarily be the developer or owner of the technology.
Source-stated
The authors warn that broader interventions may cause more collateral damage or disruption and recommend considering technical and political feasibility.
The broader the impact of a kill switch intervention action, the more collateral damage or disruption it may cause. Policymakers should consider how different interventions may vary in technical and political feasibility.
Source-stated
The authors say different incidents may require different mechanisms; an AI agent outside a contained environment may require broader interventions and greater coordination.
An AI agent that has escaped a contained environment unbeknownst to the model deployer may require a combination of broader kill switches requiring greater coordination.
Source-stated
The authors frame issuing an order as requiring incident information to be matched with an intervention, its owner, and ways to evaluate and verify it.
Where is the AI incident originating from? What is the least disruptive intervention mechanism (or combination of mechanisms) that will halt the incident? Who has ownership of that intervention mechanism, and how can they be contacted? How will the intervention be evaluated and verified?
Source-stated
The authors say their levels are a rough mapping, not a direct map of the existing AI stack.
Each level, however, is not intended to map cleanly and directly onto the existing AI stack.
Source and contributor context
Jessica Ji, Jacob Feldgoise, Kyle Miller, Andrew Lohn, Pablo Chavez, Julie George · Article author
These are credits stated by the source; they do not establish a profile match or authorship of every passage.
Source media
Media declared by the original publisher; availability checked separately from the editorial reading.
Terms and references
Reference context selected by Escape Meridian; separate from source evidence. Entity mentions do not establish authorship, involvement or endorsement.
API
An application programming interface: a defined way for software to request data or actions from another system.
AI agent
An AI system that chooses and carries out actions toward a goal, often using software tools.
Center for Security and Emerging Technology
Detailed policy and implementation analysis of chips, controls and national security.
Nature
Nature publishes research, news, and commentary across the sciences.
Editorial provenance
Version 1. Publication ID: af4994b4-61b4-4c96-8a07-2dc213c634d8.
Prepared by gpt-6-luna; grounding review by gpt-6-luna.
Source check: passed by anthropic/claude-opus-5.5 on 2026-11-13T13:01:59.025Z. This checks fidelity to the source, not whether its claims are independently true.
Editorial selection: accept; reasons: useful_perspective.
Observation: 63159532e649cb04f91b3b66bbe920f3b790491e270a79ee50d8f1aadfd17aa7. Source text hash: c9bff6bf54fad845bfd3185884f322f4d40e4d6502575e0be8471ef3cb1f5110.
passed · 2026-11-13T13:01:59.025Z · anthropic/claude-opus-5.5
Publication: af4994b4-61b4-4c96-8a07-2dc213c634d8
attribution — pass: The reading correctly attributes the piece to the six named authors at the Center for Security and Emerging Technology. Their framings and recommendations are presented as the authors' views, not as established fact or Escape Meridian opinion.
Jessica Ji, Jacob Feldgoise, Kyle Miller, Andrew Lohn, Pablo Chavez, and Julie George
summary — pass: The title, summary and question faithfully convey the central argument: kill switches vary in reach and should match the incident, and issuing an order is a matching problem. Minor optional repairs: note that policymakers have proposed requiring AI kill switches and that some proposals would let government officials order their use. The reading also drops 'unbeknownst to the model deployer' from the escaped-agent example. The question follows from the source's own open question. Terms such as API and IP address filtering can rely on tooltips.
Some policy proposals would also authorize government officials to order their use.
date — pass: The originalPublished value of 2026-11-12 matches the article's byline date. No earlier submission or later revision is indicated.
November 12, 2026
support — pass: Each claim is a close paraphrase of a verbatim excerpt. The limitations accurately state that the article proposes mechanisms rather than reporting tests. The reading adds no unsupported benefits, costs or forecasts. 'Person' for intervention owner slightly narrows a term that may cover organizations, but this is not material.
The intervention owner may not necessarily be the developer or owner of the technology.
media — pass: The selected media is the verified direct link to the original CSET article. This is the most direct way for readers to access the source.
Challenge or correct this reading
Send a correction or an opposing source with this reading’s URL. Disagreement and uncertainty can remain unresolved.
Detailed policy and implementation analysis of chips, controls and national security.
Explore Center for Security and Emerging TechnologyNature publishes research, news, and commentary across the sciences.
Explore NatureAn application programming interface: a defined way for software to request data or actions from another system.
Definition referenceAn AI system that chooses and carries out actions toward a goal, often using software tools.
Definition referenceDetailed policy and implementation analysis of chips, controls and national security.
Explore Center for Security and Emerging TechnologyDetailed policy and implementation analysis of chips, controls and national security.
Explore Center for Security and Emerging TechnologyNature publishes research, news, and commentary across the sciences.
Explore NatureAn application programming interface: a defined way for software to request data or actions from another system.
Definition referenceAn AI system that chooses and carries out actions toward a goal, often using software tools.
Definition referenceDetailed policy and implementation analysis of chips, controls and national security.
Explore Center for Security and Emerging Technology