Pulling the Plug on AI: Why Kill Switches Cannot Replace Governance

Editor’s Note: Lawmakers are weighing whether developers of the most powerful AI models should be required to keep the ability to shut them down. Anthropic’s October 2026 research on self-replicating “AI worms” added to that discussion, finding that a slow-spreading AI-enabled worm was difficult to remove once it reached poorly secured devices. The federal AI Kill Switch Act would establish shutdown requirements for certain AI providers, while California Executive Order N-9-26 directs state officials to evaluate potential requirements for frontier-model kill switches and independent verification. This article by HaystackID® Global Advisory Managing Director Aleida Gonzalez reviews both proposals, the technical limits of shutdown mechanisms shown by the 2017 WannaCry incident, and the constitutional questions raised by Youngstown Sheet & Tube Co. v. Sawyer. Throughout the article, Gonzalez also covers how businesses outside the scope of a kill switch mandate could be affected and the governance steps they can take now. Shutdown authority addresses what happens after a failure, while most AI risk management must happen before one.

By Aleida Gonzalez, Global Advisory Managing Director, HaystackID®

A malware virus could enter a home through a television, spread to the refrigerator and spoil the food, then reach the thermostat and heat the home instead of cooling it. Many American households have dozens of Internet of Things (IoT) devices, such as dishwashers, ovens, refrigerators, and doorbell cameras, in addition to mobile phones, computers, and vehicle Wi-Fi systems. Consumers often buy these products for convenience, without realizing that inadequate security controls can create vulnerabilities that extend beyond individual users and potentially affect broader digital ecosystems.

These concerns have attracted increasing attention from lawmakers and regulators, who warn that poorly secured devices can be exploited for cyberattacks, surveillance, data collection, and other malicious activities. The risks become even more pronounced when such products are manufactured or supported by entities influenced by foreign governments, raising questions about the potential impact on privacy, critical infrastructure, and national security. Researchers are also examining how AI’s exponential processing power could enhance existing cyber threats, enabling malicious software to automate and accelerate activities such as vulnerability discovery, device compromise, and propagation across networks.

Yet a key governance issue remains: who should be held accountable when AI systems function beyond their intended scope or produce unforeseen outcomes? Developers increasingly bear full responsibility, despite the influence of end-user behavior, but is a kill switch the appropriate response in the international AI innovation race?

An AI Worm With No Off Switch

On October 12, 2026, Anthropic, an American public benefit corporation founded by former OpenAI researchers, published research examining whether AI systems could function as self-replicating “AI worms” that autonomously propagate across the internet like computer viruses, with limited or no human intervention. The researchers selected inexpensive smart television boxes because their limited security measures make them representative of the types of devices most likely to be targeted by autonomous malware.

While the slow-propagating virus proved effective, eradicating it proved to be difficult, as no centralized kill switch existed to halt operation across the systems. The research suggests that the AI worm’s capabilities are continuously improving, with the potential to self-replicate across a network of devices by the end of 2026. The Anthropic authors emphasize that better cybersecurity practices, stronger device protections, and coordinated monitoring will be essential to reduce the risk of such self-propagating AI threats in the future. However, lawmakers increasingly appear inclined to pursue regulatory solutions.

The Push for Mandatory Shutdown Controls

The rapid advancement of frontier AI has intensified concerns among policymakers that existing safeguards may be insufficient to address risks posed by advanced AI systems. As a result, a prominent policy question is whether AI developers should be required to maintain the ability to suspend or deactivate their most powerful models during emergencies. Recent proposals at both the federal and state levels reflect a growing belief that ensuring human control over advanced AI systems may require more than voluntary commitments and internal governance frameworks. Together, these efforts signal a broader shift in the AI safety debate from preventing harmful outcomes to ensuring that potentially dangerous systems can be stopped when necessary.

In 2024, California Governor Newsom vetoed California’s SB 1047, the “Safe and Secure Innovation for Frontier Artificial Intelligence Models Act,” a bill that would have required developers of the most powerful AI models to “mitigate the risk of catastrophic harms,” including by maintaining the ability to shut them down. In his veto memo, Gov. Newsom explained that the proposed bill focused on expensive, large-scale models, while smaller models could cause just as much harm. Despite his veto, Governor Newsom remained committed to holding developers accountable and subject to oversight.

The AI Kill Switch Act and Executive Order N-9-26

Two recent proposals, one federal and one from California, address kill switch requirements for frontier AI developers. Under both, the developer operates the switch, and an outside party audits it.

The federal AI Kill Switch Act. H.R. 9917, introduced on July 23, 2026, by California Representative Ted Lieu and co-sponsored by Texas Representative Nathaniel Moran, would amend the Homeland Security Act of 2002. The bill would require commercial AI providers with $500 million or more in revenue to maintain a kill switch. Covered providers would be subject to a Department of Homeland Security (DHS) order to activate it, as well as to audits, on-site inspections, or forensic reviews. A company could petition against an activation order, but the bill makes it difficult to obtain a refusal, delay, or reversal.

California Executive Order N-9-26. Signed by Governor Newsom on September 18, 2026, the order directs California’s Government Operations Agency to evaluate the feasibility and necessity of requiring frontier AI developers to build in a kill switch, and to deliver recommendations to state legislators by November 16, 2026. Under other provisions of state law, the Agency already has responsibility for establishing an AI audit program, a regulatory framework for independent verification organizations, and an AI auditor registry. Under the order, frontier developers would manage the kill switch, subject to independent audit and verification.

What a Kill Switch Can’t Undo

Supporters compare a kill switch to the emergency shutdown systems used in nuclear plants, industrial control systems, and other high-risk technology. In practice, shutting down a complex, distributed AI system is not a single on/off action. AI developers have built their own shutdown mechanisms, but they vary by system and don’t work the same way for every deployment. Once code or data has spread across networks, stopping it at the source does not remove the copies that already exist elsewhere.

The 2017 WannaCry ransomware worm shows how this works in practice. A security researcher stopped new infections by triggering a kill switch that the malware’s authors had apparently included by accident. By then, hundreds of thousands of systems were already infected, files were still encrypted, and operations were still disrupted. Organizations had to find affected devices, isolate infected networks, patch vulnerabilities, and restore from backups. The kill switch prevented further spread, and recovery required separate work.

A self-replicating AI worm would present the same problem. A central mechanism might stop new execution or propagation, but copies already running in cloud environments, enterprise networks, and IoT devices could keep causing disruption. An effective shutdown would require identifying where the worm had replicated, determining which systems were affected, and coordinating remediation across many separate environments. Policy discussions should therefore weigh monitoring, detection, containment, incident response, recovery planning, and resilience as much as shutdown authority. Those controls determine whether an organization can recover from a large-scale AI-enabled cyber incident.

Innovation, Investment, and the Risk of Regulation

Critics question whether kill switch requirements are technically and legally workable. Distributed models, open-source systems, and autonomous agents that can copy themselves may be hard to disable fully after deployment. The debate also involves a tradeoff between the economic benefits of AI development and the need for oversight, accountability, and protection against catastrophic failures.

Investors may worry about civil penalties and the possibility that a kill switch becomes a target for cybercriminals or foreign governments. International competition is another factor. U.S. companies could deploy advanced models in jurisdictions with fewer restrictions, reducing U.S. regulatory oversight and the domestic economic benefits of that work. As governments pay more attention to frontier AI, kill switch requirements are likely to remain part of discussions on AI governance, safety standards, and compliance.

Youngstown and the Limits of Emergency Authority

The kill switch proposals raise questions similar to those in Youngstown Sheet & Tube Co. v. Sawyer, in which the Supreme Court held that a claimed national emergency did not by itself give the President authority to take control of private industry. AI is now used throughout economic and national security infrastructure, so the legal question is whether government-ordered shutdowns are a lawful and effective way to manage its risks. As in Youngstown, the issue involves private enterprise, innovation, and the limits of government authority.

In Youngstown, President Truman argued that steel production was necessary for national defense during the Korean War and that a strike would harm U.S. military operations. Advanced AI systems now play a comparable role in economic and security infrastructure. Giving DHS authority to order a shutdown would require clear authorization from Congress, and the AI Kill Switch Act does not fully define the scope of that authority. Several questions remain open:

What happens if a covered entity cannot shut down its AI system in time, despite its best efforts?
What happens if industry experts recommend a partial suspension while DHS demands a complete shutdown?
Will covered entities be compensated if government agents erroneously order a kill switch activated?

A Shutdown Upstream, a Disruption Downstream

The AI Kill Switch Act will not cover most businesses, but many could still be affected. Companies that build frontier models from covered providers into their own software and services would lose that functionality if DHS ordered the provider to shut down its system. They might receive little or no notice, and a partial or complete shutdown would affect their own operations, their customers, and any workflows that depend on the model.

Businesses that use or embed AI should set governance policies across the organization to protect sensitive and privileged information, manage AI risk, maintain chain of custody, and prepare to respond to incidents. A governance program should cover documented compliance, employee training, and implementation. Depending on a company’s size and line of business, the following measures may apply:

Adopt recognized standards and frameworks. Align governance with guidance from organizations such as the International Organization for Standardization or the National Institute of Standards and Technology.
Adopt zero-trust security. Implement continuous authentication and authorization and never assume access based on network location alone.
Strengthen data segmentation. Logically isolate matters and workspaces, so a compromise in one cannot spread laterally to others.
Protect AI systems. Validate all prompts and inputs, monitor prompt injection attacks, and continuously audit AI outputs for anomalies.
Enhance data integrity controls. Ensure data remains accurate, consistent, complete, and secure.
Increase behavioral threat detection. Traditional antivirus tools look for known signatures; behavioral analytics can flag unusual document access, large-scale exports, and abnormal search activity.
Secure third-party integrations. Every integrated platform expands the attack surface, so vendors should continuously test application programming interfaces and limit permissions to the minimum required.
Implement data minimization. Shorten retention periods, archive inactive matters, and apply automated disposition policies to reduce the sensitive information available to an attacker.
Conduct AI-focused red-team exercises. Test how systems respond before an attack occurs, using scenarios such as AI worms, autonomous agents, data poisoning, and model manipulation.

Many organizations adopt AI policies but struggle to put them into practice. The gap matters most for businesses that build on third-party models. An organization that trains its own model can govern its full lifecycle. Still, one that uses a vendor model through an API or enterprise platform inherits that model’s behaviors and vulnerabilities and often can’t fix them directly. In those cases, governance depends on knowing which systems rely on which models, testing how those models behave once integrated, and having a plan if a provider suspends service.

HaystackID’s AI Governance Services take this approach, starting with an inventory of AI systems and use cases, a risk classification for each, and a map of regulatory exposure that includes the embedded models a kill switch order could affect. System-level security testing then looks for prompt injection, model extraction, data leakage, and integration vulnerabilities, and documents the findings and remediation steps for auditors, regulators, and customers. The work aligns with the NIST AI Risk Management Framework and ISO/IEC 42001 and covers third-party AI due diligence and ongoing executive and board reporting. Because our cybersecurity team handles incident response and digital forensics, the same experts who assess an organization’s AI controls can also help it respond and recover if a model it depends on is disrupted.

Embedding Oversight and Control in AI Architecture

Self-replicating AI and more autonomous systems are a real concern for policymakers, businesses, and consumers. Shutdown authority addresses what happens after a failure, and governance frameworks are needed to reduce risk before one occurs. A kill switch does not replace cybersecurity, oversight, continuous monitoring, or clear accountability.

As AI is built into more critical infrastructure, commercial services, and consumer devices, policymakers will need to weigh public safety, economic competitiveness, and constitutional limits on government authority. A government-ordered shutdown may not work well for technology that runs across many independent systems. AI governance will depend more on building systems that are secure, transparent, and controllable from the start than on the ability to turn them off.

If a model your business depends on were shut down tomorrow, could your organization show regulators, clients, and its board which systems were affected and how it would recover?

New Sources

About HaystackID®

HaystackID® solves complex data challenges related to legal, compliance, regulatory, and cyber requirements. Core offerings include Global Advisory, Cybersecurity, Core Intelligence AI™, and ReviewRight® Global Managed Review, supported by its unified CoreFlex™ service interface and eDiscovery AI® technology. Recognized globally by industry leaders, including Chambers, Gartner, IDC, and Legaltech News, HaystackID helps corporations and legal practices manage data gravity, where information demands action, and workflow gravity, where critical requirements demand coordinated expertise, delivering innovative solutions with a continual focus on security, privacy, and integrity. Learn more at HaystackID.com.

Assisted by GAI and LLM technologies.

SOURCE: HaystackID

Advisory Note: A kill switch mandate may apply only to the largest AI providers, but organizations that build on those providers’ models would also be affected by a shutdown. To prepare, an organization needs to know where it uses AI, which systems depend on third-party models, and how it would document, contain, and recover from a disruption. HaystackID’s AI Governance Services help organizations inventory and classify AI systems, implement governance programs aligned with recognized frameworks, test high-risk systems for security and fairness, and report to executives and boards. HaystackID builds governance into daily operations and produces documentation that regulators, customers, and other stakeholders can review. Organizations evaluating their AI risk can connect with HaystackID’s team of experts to learn more.