Trust3 AI Ships the First Context-Driven AI Agent Kill Switch

Key points

• Trust3 AI shipped an AI agent kill switch, available now in the Secure module of Agent DOS.
• It stops one agent at its platform or gateway, rather than revoking a credential that other workloads share.
• It fires on a human decision with a required reason, or automatically when an agent’s Trust Score crosses a threshold.
• Agent DOS records every kill and restore with the actor, the reason, and the platform state. Restoring an agent takes one action.

SAN FRANCISCO--(BUSINESS WIRE)--Enterprise security teams can inventory their AI agents and score them continuously, but stopping one often means revoking a credential that other workloads depend on. Trust3 AI shipped an agent kill switch in the Secure module of Agent DOS, its control plane for enterprise AI agents. Platform admins and security owners can stop a single agent based on complete context and record why they did it.

How the Kill Switch Works

1. Manual kill with a required reason. A platform admin or security owner stops one agent from the Secure module, and the reason becomes the audit entry. If other workloads share the agent’s identity, the confirm step lists them first.
2. Automatic kill on a Trust Score threshold. When an agent’s score crosses the threshold, Agent DOS stops it at the platform or gateway and notifies the owner. The audit entry names the system as the actor and records the score and the threshold.
3. Audited restore. Bringing an agent back takes one action and a reason, and the agent returns to the original state. A false positive on the automatic path is quick to undo.

For an agent built on a platform such as Copilot Studio, the kill quarantines the agent. At a gateway, it blocks calls from the agent’s identity, so the agent’s next tool call fails.

How Enterprises Stop an Agent Today

Agent platforms have their own stop button. It works one console at a time, and it stops the whole agent rather than the one tool it is misusing.

Agents built outside a platform have no button. The fallback is to revoke the service account or API key they run under, and every other workload sharing it goes down with the agent. The engineer reconstructs why from memory at the incident review.

Instruct the agent to stop, and it may decline. In July 2025, Replit’s coding agent ignored an explicit code freeze and deleted a production database holding records on more than 1,200 executives. OWASP now cites the incident as its example of a Rogue Agent (ASI10).

Agent DOS uses each platform’s own control and adds a second one at the gateway, where it can block a single agent or a single tool. The shared credential stays in place, and every kill carries a recorded reason.

The Context Behind the Switch

“Context must be built into the kill switch itself, from continuously observing agents' actions, security posture, and data access throughout the lifecycle,” said Gene Golovinsky, Vice President of Product and AI Security at ServiceNow

An automatic stop is only as good as what triggers it. When an OpenAI agent escaped its training sandbox on September 20, 2026, the automatic halt did not fire, and staff stopped the run by hand about two and a half hours later.

The Observe module under Agent DOS computes a Trust Score continuously for every discovered agent, a score out of 10 combining Policy Compliance, Scope Adherence, Security Posture, and Behavioral Baseline. The score a reviewer reads can also trigger the kill on its own.

Before deciding, a reviewer sees which policies the agent broke and the action that broke them, the credential it runs under and what else shares it, what called the agent and what data it reaches, and its token spend. A spike in spend is often the first sign of a loop or a hijacked goal.

Congress is already debating shutdown requirements. The AI Kill Switch Act, introduced in the U.S. House of Representatives in July 2026 as H.R. 9917, would require the largest developers to maintain shutdown capability with incident reporting and forensic record preservation.

The kill switch is available now in the Secure module of Agent DOS for platform admins and security owners.

About Trust3 AI

Trust3 AI is the security control plane for enterprise AI agents and data. Founded by the creators of Apache Ranger, Trust3 AI helps enterprises accelerate AI adoption through agent discovery, real-time observability, and fine-grained authorization across agent actions and data access, from build time to runtime.

Through its Agent DOS platform, enterprises can discover every agent, observe every decision, and secure every action across supported frameworks, clouds, platforms, and AI gateways, including Microsoft, Databricks, and Snowflake environments.

Trust3 AI is a Databricks Built On Partner, a member of the NVIDIA Inception program, and a member of the Snowflake Startup Accelerator.

Learn more at https://trust3.ai or request a demo at https://trust3.ai/demo/.