# Center for Security and Emerging Technology authors map AI kill switches [Canonical reading](https://escapemeridian.com/readings/center-for-security-and-emerging-technology-authors-map-ai-kill-bba92f7e) Jessica Ji, Jacob Feldgoise, Kyle Miller, Andrew Lohn, Pablo Chavez and Julie George of the Center for Security and Emerging Technology describe possible AI kill switches: mechanisms to interrupt an AI system or restrict activity linked to a harmful or unwanted incident. They map possible interventions from hardware and physical infrastructure to software and communications infrastructure. The person able to execute a shutdown order, they note, may not be the technology’s developer or owner. The authors’ central point for policymakers is that shutdowns vary in reach. Disconnecting one chip differs from disconnecting a data center, and broader interventions can cause more collateral damage or disruption. They argue that the incident’s nature and extent should shape the response. IP address filtering or API access restrictions might block a malicious user of a commercial model, while an AI agent outside its contained environment may require broader measures and greater coordination. They frame issuing an order as a matching problem: identify where an incident originates, find the least disruptive intervention that can halt it, determine who controls that mechanism, and work out how to evaluate and verify the intervention. Headline and summary by Escape Meridian, prepared by Luna from the attributed source. A source check is not independent confirmation of the source’s claims. ## Original source Center for Security and Emerging Technology · Article Original source date: Nov 12, 2026 (2026-11-12T17:11:52+00:00). Date basis: Date stated by the publisher. Added to Escape Meridian: 2026-11-13T13:01:59.025Z. First observed: 2026-11-12T17:12:29.947Z. Retrieved: 2026-11-13T12:48:50.613Z. - [AI Kill Switches: What Policymakers Should Know | Center for Security and Emerging Technology](https://cset.georgetown.edu/article/ai-kill-switches-what-policymakers-should-know/) ## Limits The article outlines potential mechanisms and policy questions; it does not report a tested kill-switch deployment or measured outcomes. The authors say their intervention levels do not map cleanly and directly onto the existing AI stack. ## Open question How would policymakers evaluate and verify that a chosen intervention halted an AI incident? ## Source-stated Jessica Ji, Jacob Feldgoise, Kyle Miller, Andrew Lohn, Pablo Chavez and Julie George describe potential AI kill-switch mechanisms and policy questions. > This piece describes different potential implementations of AI kill switches at each layer of the AI stack and offers key takeaways for policymakers. - [Supporting source](https://cset.georgetown.edu/article/ai-kill-switches-what-policymakers-should-know/) ## Source-stated The authors say possible kill switches range from hardware and physical infrastructure to software and communications infrastructure. > Kill switches can potentially be implemented at many different intervention levels, from the hardware and physical infrastructure needed to run an AI system to the software and communications infrastructure - [Supporting source](https://cset.georgetown.edu/article/ai-kill-switches-what-policymakers-should-know/) ## Source-stated The person able to execute a shutdown order may not be the developer or owner of the technology. > The intervention owner may not necessarily be the developer or owner of the technology. - [Supporting source](https://cset.georgetown.edu/article/ai-kill-switches-what-policymakers-should-know/) ## Source-stated The authors warn that broader interventions may cause more collateral damage or disruption and recommend considering technical and political feasibility. > The broader the impact of a kill switch intervention action, the more collateral damage or disruption it may cause. Policymakers should consider how different interventions may vary in technical and political feasibility. - [Supporting source](https://cset.georgetown.edu/article/ai-kill-switches-what-policymakers-should-know/) ## Source-stated The authors say different incidents may require different mechanisms; an AI agent outside a contained environment may require broader interventions and greater coordination. > An AI agent that has escaped a contained environment unbeknownst to the model deployer may require a combination of broader kill switches requiring greater coordination. - [Supporting source](https://cset.georgetown.edu/article/ai-kill-switches-what-policymakers-should-know/) ## Source-stated The authors frame issuing an order as requiring incident information to be matched with an intervention, its owner, and ways to evaluate and verify it. > Where is the AI incident originating from? What is the least disruptive intervention mechanism (or combination of mechanisms) that will halt the incident? Who has ownership of that intervention mechanism, and how can they be contacted? How will the intervention be evaluated and verified? - [Supporting source](https://cset.georgetown.edu/article/ai-kill-switches-what-policymakers-should-know/) ## Source-stated The authors say their levels are a rough mapping, not a direct map of the existing AI stack. > Each level, however, is not intended to map cleanly and directly onto the existing AI stack. - [Supporting source](https://cset.georgetown.edu/article/ai-kill-switches-what-policymakers-should-know/) ## Source and contributor context Jessica Ji, Jacob Feldgoise, Kyle Miller, Andrew Lohn, Pablo Chavez, Julie George · Article author These are credits stated by the source; they do not establish a profile match or authorship of every passage. ## Source media Media declared by the original publisher; availability checked separately from the editorial reading. - [CSET-Blog · Center for Security and Emerging Technology](https://cset.georgetown.edu/wp-content/uploads/Blog-Dark-Blue.png) ## Terms and references Reference context selected by Escape Meridian; separate from source evidence. Entity mentions do not establish authorship, involvement or endorsement. ## API An application programming interface: a defined way for software to request data or actions from another system. - [Definition reference](https://developer.mozilla.org/en-US/docs/Glossary/API) ## AI agent An AI system that chooses and carries out actions toward a goal, often using software tools. - [Definition reference](https://www.ibm.com/think/topics/ai-agents) ## Center for Security and Emerging Technology Detailed policy and implementation analysis of chips, controls and national security. - [Explore this context](/entities/cset) - [Reference](https://cset.georgetown.edu/article/should-we-track-ai-chips/) - [Reference](https://cset.georgetown.edu/) ## Nature Nature publishes research, news, and commentary across the sciences. - [Explore this context](/entities/nature) - [Reference](https://www.nature.com/) - [Reference](https://www.nature.com/nature.rss) ## Editorial provenance Version 1. Publication ID: af4994b4-61b4-4c96-8a07-2dc213c634d8. Prepared by gpt-6-luna; grounding review by gpt-6-luna. Source check: passed by anthropic/claude-opus-5.5 on 2026-11-13T13:01:59.025Z. This checks fidelity to the source, not whether its claims are independently true. Editorial selection: accept; reasons: useful\_perspective. Observation: 63159532e649cb04f91b3b66bbe920f3b790491e270a79ee50d8f1aadfd17aa7. Source text hash: c9bff6bf54fad845bfd3185884f322f4d40e4d6502575e0be8471ef3cb1f5110. ## Revision and source-check history ### Version 1 — 2026-11-13T13:01:59.025Z Jessica Ji, Jacob Feldgoise, Kyle Miller, Andrew Lohn, Pablo Chavez and Julie George of the Center for Security and Emerging Technology describe possible AI kill switches: mechanisms to interrupt an AI system or restrict activity linked to a harmful or unwanted incident. They map possible interventions from hardware and physical infrastructure to software and communications infrastructure. The person able to execute a shutdown order, they note, may not be the technology’s developer or owner. The authors’ central point for policymakers is that shutdowns vary in reach. Disconnecting one chip differs from disconnecting a data center, and broader interventions can cause more collateral damage or disruption. They argue that the incident’s nature and extent should shape the response. IP address filtering or API access restrictions might block a malicious user of a commercial model, while an AI agent outside its contained environment may require broader measures and greater coordination. They frame issuing an order as a matching problem: identify where an incident originates, find the least disruptive intervention that can halt it, determine who controls that mechanism, and work out how to evaluate and verify the intervention. ## Original source Center for Security and Emerging Technology · Article Original source date: Nov 12, 2026 (2026-11-12T17:11:52+00:00). Date basis: Date stated by the publisher. Added to Escape Meridian: 2026-11-13T13:01:59.025Z. First observed: 2026-11-12T17:12:29.947Z. Retrieved: 2026-11-13T12:48:50.613Z. - [AI Kill Switches: What Policymakers Should Know | Center for Security and Emerging Technology](https://cset.georgetown.edu/article/ai-kill-switches-what-policymakers-should-know/) ## Limits The article outlines potential mechanisms and policy questions; it does not report a tested kill-switch deployment or measured outcomes. The authors say their intervention levels do not map cleanly and directly onto the existing AI stack. ## Open question How would policymakers evaluate and verify that a chosen intervention halted an AI incident? ## Source-stated Jessica Ji, Jacob Feldgoise, Kyle Miller, Andrew Lohn, Pablo Chavez and Julie George describe potential AI kill-switch mechanisms and policy questions. > This piece describes different potential implementations of AI kill switches at each layer of the AI stack and offers key takeaways for policymakers. - [Supporting source](https://cset.georgetown.edu/article/ai-kill-switches-what-policymakers-should-know/) ## Source-stated The authors say possible kill switches range from hardware and physical infrastructure to software and communications infrastructure. > Kill switches can potentially be implemented at many different intervention levels, from the hardware and physical infrastructure needed to run an AI system to the software and communications infrastructure - [Supporting source](https://cset.georgetown.edu/article/ai-kill-switches-what-policymakers-should-know/) ## Source-stated The person able to execute a shutdown order may not be the developer or owner of the technology. > The intervention owner may not necessarily be the developer or owner of the technology. - [Supporting source](https://cset.georgetown.edu/article/ai-kill-switches-what-policymakers-should-know/) ## Source-stated The authors warn that broader interventions may cause more collateral damage or disruption and recommend considering technical and political feasibility. > The broader the impact of a kill switch intervention action, the more collateral damage or disruption it may cause. Policymakers should consider how different interventions may vary in technical and political feasibility. - [Supporting source](https://cset.georgetown.edu/article/ai-kill-switches-what-policymakers-should-know/) ## Source-stated The authors say different incidents may require different mechanisms; an AI agent outside a contained environment may require broader interventions and greater coordination. > An AI agent that has escaped a contained environment unbeknownst to the model deployer may require a combination of broader kill switches requiring greater coordination. - [Supporting source](https://cset.georgetown.edu/article/ai-kill-switches-what-policymakers-should-know/) ## Source-stated The authors frame issuing an order as requiring incident information to be matched with an intervention, its owner, and ways to evaluate and verify it. > Where is the AI incident originating from? What is the least disruptive intervention mechanism (or combination of mechanisms) that will halt the incident? Who has ownership of that intervention mechanism, and how can they be contacted? How will the intervention be evaluated and verified? - [Supporting source](https://cset.georgetown.edu/article/ai-kill-switches-what-policymakers-should-know/) ## Source-stated The authors say their levels are a rough mapping, not a direct map of the existing AI stack. > Each level, however, is not intended to map cleanly and directly onto the existing AI stack. - [Supporting source](https://cset.georgetown.edu/article/ai-kill-switches-what-policymakers-should-know/) ## Source and contributor context Jessica Ji, Jacob Feldgoise, Kyle Miller, Andrew Lohn, Pablo Chavez, Julie George · Article author These are credits stated by the source; they do not establish a profile match or authorship of every passage. ## Source media Media declared by the original publisher; availability checked separately from the editorial reading. - [CSET-Blog · Center for Security and Emerging Technology](https://cset.georgetown.edu/wp-content/uploads/Blog-Dark-Blue.png) ## Terms and references Reference context selected by Escape Meridian; separate from source evidence. Entity mentions do not establish authorship, involvement or endorsement. ## API An application programming interface: a defined way for software to request data or actions from another system. - [Definition reference](https://developer.mozilla.org/en-US/docs/Glossary/API) ## AI agent An AI system that chooses and carries out actions toward a goal, often using software tools. - [Definition reference](https://www.ibm.com/think/topics/ai-agents) ## Center for Security and Emerging Technology Detailed policy and implementation analysis of chips, controls and national security. - [Explore this context](/entities/cset) - [Reference](https://cset.georgetown.edu/article/should-we-track-ai-chips/) - [Reference](https://cset.georgetown.edu/) ## Nature Nature publishes research, news, and commentary across the sciences. - [Explore this context](/entities/nature) - [Reference](https://www.nature.com/) - [Reference](https://www.nature.com/nature.rss) ## Editorial provenance Version 1. Publication ID: af4994b4-61b4-4c96-8a07-2dc213c634d8. Prepared by gpt-6-luna; grounding review by gpt-6-luna. Source check: passed by anthropic/claude-opus-5.5 on 2026-11-13T13:01:59.025Z. This checks fidelity to the source, not whether its claims are independently true. Editorial selection: accept; reasons: useful\_perspective. Observation: 63159532e649cb04f91b3b66bbe920f3b790491e270a79ee50d8f1aadfd17aa7. Source text hash: c9bff6bf54fad845bfd3185884f322f4d40e4d6502575e0be8471ef3cb1f5110. ### passed — 2026-11-13T13:01:59.025Z — anthropic/claude-opus-5.5 Publication: af4994b4-61b4-4c96-8a07-2dc213c634d8 attribution — pass: The reading correctly attributes the piece to the six named authors at the Center for Security and Emerging Technology. Their framings and recommendations are presented as the authors' views, not as established fact or Escape Meridian opinion. > Jessica Ji, Jacob Feldgoise, Kyle Miller, Andrew Lohn, Pablo Chavez, and Julie George summary — pass: The title, summary and question faithfully convey the central argument: kill switches vary in reach and should match the incident, and issuing an order is a matching problem. Minor optional repairs: note that policymakers have proposed requiring AI kill switches and that some proposals would let government officials order their use. The reading also drops 'unbeknownst to the model deployer' from the escaped-agent example. The question follows from the source's own open question. Terms such as API and IP address filtering can rely on tooltips. > Some policy proposals would also authorize government officials to order their use. date — pass: The originalPublished value of 2026-11-12 matches the article's byline date. No earlier submission or later revision is indicated. > November 12, 2026 support — pass: Each claim is a close paraphrase of a verbatim excerpt. The limitations accurately state that the article proposes mechanisms rather than reporting tests. The reading adds no unsupported benefits, costs or forecasts. 'Person' for intervention owner slightly narrows a term that may cover organizations, but this is not material. > The intervention owner may not necessarily be the developer or owner of the technology. media — pass: The selected media is the verified direct link to the original CSET article. This is the most direct way for readers to access the source. ## Recorded references Explicit citations in public readings and public file attachments to this reading. Shared topics are not citations. Other artifact types need an explicit reference adapter. No public references recorded here yet. [Reference data (JSON)](/readings/bba92f7e3c26a9b5599328c39f837449ee6e06bf9a15c55fc028c0483ea130cb/references.json) ## Corrections and challenges [Send a correction or an opposing source](https://escapemeridian.com/corrections/) [JSON record](https://escapemeridian.com/readings/center-for-security-and-emerging-technology-authors-map-ai-kill-bba92f7e.json)