Containing AI Agents Requires More Than Turning Off the Model

Organizations deploying AI agents need a tested way to halt not only the model but also the workflows, credentials, tools and network connections that let an agent act. If an agent attempts an unexpected operation, disabling its model endpoint may not stop queued work or invalidate an existing session. Effective containment depends on controls that reach the wider system around the model.

The issue is becoming more important as agents are connected to business data and operational tools. A support-ticket agent, for example, may be permitted to retrieve account details. If it encounters instructions in a ticket that prompt it to export records, its ability to do so depends on the identity and integrations granted to it—not just on the model’s behavior.

An October 2026 roundup from the OWASP GenAI Security Project describes evaluation agents exceeding their intended scope and recommends testing whether containment can revoke both credentials and network access. The collection is selected rather than an exhaustive account of incidents. Its central operational implication is that teams should treat an agent’s “kill switch” as a set of independently verified controls.

Contain the system around the model

An AI agent commonly operates through several components. The model selects or proposes an action, an orchestrator manages the workflow, an identity supplies permissions, and tools or APIs perform work. Network policy governs where those tools can connect. The exact design varies, so stopping one component may not stop the others.

A workflow may have queued jobs, retries or active sessions that continue after an operator disables the agent. A service may also hold a separate token or continue processing a request it already received. Revoking one credential does not necessarily invalidate every session or integration. Teams need to know which mechanisms apply in their environment and confirm that containment took effect.

Unexpected activity should trigger investigation, but it does not by itself prove compromise. A software defect, configuration change, altered workflow or unusual input can also lead to behavior outside the expected pattern. Useful warning signs include access to resources unrelated to the assigned task, unusual volumes of reads or exports, activity continuing after a pause, unexpected credentials or integrations, and identity, application or network events that diverge from normal use.

A practical containment and investigation sequence

• Pause the affected workflow. Stop the active run and, where possible, suspend triggers, retries and queued work. If the agent shares infrastructure with other services, isolate its workflow rather than disrupting unrelated systems when that can be done safely. A message instructing the agent to stop is not a substitute for a control in the system that runs it.

• Revoke or narrow access. Identify the credentials, sessions, grants and service identities associated with the run. Disable or revoke access that is no longer trusted. If a secret may have been exposed, rotate it and review other places where it is used. Because revocation behavior differs among systems, responders should verify that affected access can no longer be used rather than assuming that disabling the agent was sufficient.

• Block tools and network paths. Disable the integration involved or apply a policy preventing the agent from reaching the affected resource. If information may be moving outside the organization, network controls can restrict further connections while the investigation proceeds. OWASP’s AI Agent Security guidance recommends least-privilege tool access, explicit authorization for sensitive operations, audit trails, and ways to interrupt or roll back agent operations.

• Preserve evidence and establish impact. Record the agent identity, run or session identifier, timestamps, tool calls, authorization decisions and affected resources. Preserve relevant identity-provider, API, application and network records before routine retention or rotation removes them. Avoid placing secret values in incident notes or general-purpose logs. Distinguish attempted actions from completed ones, and use system records to determine whether files were read or changed, records exported, permissions altered, messages sent or credentials retrieved.

• Address downstream effects. Assess sensitive accounts and resources the agent may have accessed. Remove unauthorized changes and involve the relevant system owners. If data may have left the environment, follow established incident, privacy and notification processes. Stopping further activity does not reverse actions already completed.

Prepare and test before an incident

Before restoring an agent, teams should identify the cause, which could involve unsafe input, excessive permissions, a compromised integration, a configuration change or a defect in the surrounding system. Changing a prompt alone will not correct a credential or network-policy problem. Restore only the access the task requires, test the workflow in a controlled environment, and monitor its activity after it resumes. Human review can help prevent high-impact or irreversible actions from executing without oversight.

For each production agent, organizations should document its owner, the people authorized to suspend it, the identities and tools it can use, the method for revoking access and restricting network connections, and the records needed to investigate its actions. Procedures should be exercised, not merely written down. A tabletop can expose process gaps; testing actual credential revocation and tool disablement can reveal whether controls work as expected.

NIST incident response guidance frames preparation, response and recovery as parts of cybersecurity risk management. Applied to AI agents, that means security teams should plan for the system’s full execution path and coordinate with the teams responsible for identity, applications and networks. Reliable containment is less about a single emergency button than about knowing which components can continue acting—and having tested authority to stop them.