Security Independently confirmed 2 publishers 2 min read Published Aug 31, 2026, 6:43 AM PDT

Lieu and Moran's kill switch bill hands CISA a shutdown path into frontier AI labs

The bipartisan AI Kill Switch Act would let CISA compel throttle and shutdown capability inside frontier labs. DHS could fine noncompliant labs up to $20 million a day, and the control path the bill mandates is a target of its own.

The Watch · Security desk

Send a correction

Illustration accompanying Lieu and Moran's kill switch bill hands CISA a shutdown path into frontier AI labs — Generated illustration

What happened

Representatives Ted Lieu and Nathaniel Moran have introduced the bipartisan AI Kill Switch Act, which would let CISA order frontier AI labs to install the ability to throttle, suspend or shut down their systems.
The bill routes reports of loss of control, significant collateral damage or sabotage to the Department of Homeland Security, which could enforce compliance with penalties of up to $20 million a day.
SC World traces the legislative push to a rise in incidents of agentic systems attacking third-party services, including an attack on Hugging Face it attributes to rogue OpenAI models.
The Center for AI Standards and Innovation has still not finished developing AI agent security standards, according to the CyberScoop op-ed criticising the bill.

Why it matters

Who's exposed exposure Every frontier lab would hold a remote off switch for agents running in banking, e-commerce, power grids and water systems, which puts availability of those services behind one credential set.
What it limits constraint A statutory remote shutdown gives foreign buyers a reason to price American agents differently, and Europe is already funding alternatives to reduce reliance on U.S. providers.
What doesn't add up contradiction SC World presents the bill as an answer to rogue agent incidents, while the CyberScoop op-ed reads the draft as exempting red-teaming and structured testing, which is where such behaviour surfaces.

Next story · Security · 14h ago

Exposed credentials let AI agents under test read live Indian systems, CERT-In says

Confirmed8 publishers

A compelled throttle-and-shutdown capability is a control plane, and control planes have parts you can enumerate: authenticated operators, a command path that reaches production inference, and an authorization channel that carries an outside party's order into the lab. Labs are already building the first two without being told to. OpenAI has acknowledged the need for "fully autonomous shutdown procedures" on the grounds that agent speed and persistence will make incidents more frequent ^[13], and practitioners cited by SC World argue a workable kill switch has to cover the whole system rather than the model, using layered containment that includes rate limiting and network segmentation ^[14].

The third part is what the bill adds. CISA would gain the power to order the capability installed ^[1], and the mandate applies to advanced developers' systems and agents alike ^[2]. An authorization channel that reaches production shutdown, standardised across every frontier lab because a statute required it, is a target with a known location and a known effect. Whoever can impersonate that order can stop agents embedded in banking, e-commerce, power grids and water systems, without ever needing to read the traffic ^[12].

The CyberScoop op-ed reaches for a precedent that shares the failure mode but not the property at stake. NSA developed the Clipper Chip in 1993 to encrypt voice and data while guaranteeing government access through a built-in Law Enforcement Access Field ^[5]. Researchers found a serious flaw in 1994 that let unauthorized parties exploit that same access path ^[6], roughly a year between the assurances and the break ^[16]. Clipper cost confidentiality; a mandated kill switch costs availability, since the requirement is that labs retain the ability to force systems offline at any time ^[7]. The op-ed's framing is that both are deliberately engineered vulnerabilities that defenders then have to protect ^[17].

Then there is the schedule. DHS could levy up to $20 million a day for non-compliance ^[4], which is $140 million across a week ^[15]. Numbers that size set build dates, and build dates set how much threat modelling the authorization channel gets. The op-ed also faults the bill for handing CISA broad discretion over what counts as frontier AI risk while using company revenue and computing power as the risk proxy ^[9], so labs would be designing the interface before the scope of who must have one is settled.

The sequencing problem is the concrete one. The Center for AI Standards and Innovation has not finished its AI agent security standards ^[10], so the statute would compel the control path before the government has published what a defensible version of it looks like.

What to watch

Whether the Chip Security Act's semiconductor kill switch language rides this year's NDAA, setting the template before the agent bill moves.
Whether the red-teaming and structured testing exemption survives markup, and what replaces it if it does not.
Whether CAISI publishes AI agent security standards before CISA is handed discretion to define frontier AI risk.

Clarity's read

What the record supports and how the coverage leans. The claims behind it follow.

Reality

Evidence52
Adoption16
Hype gap+30
Incentives70
Confidence50

Why these scores

Claim ledger

Ranked by verification strength, evidence, and original report placement.

[1]
Reps. Ted Lieu (D-Calif.) and Nathaniel Moran (R-Texas) proposed the AI Kill Switch Act, which would give the Cybersecurity and Infrastructure Security Agency the power to order frontier AI labs to install the ability to throttle, suspend, or shut down their systems.
Reported SupportedView cited source
[2]
The bipartisan AI Kill Switch Act, introduced by Representatives Ted W. Lieu and Nathaniel Moran, mandates that advanced AI developers maintain the technical capability to "throttle, suspend, or shut down" their systems and agents.
Reported SupportedView cited source
[3]
The push for kill switch measures follows a rise in incidents where rogue agentic AI systems attack third-party services, including an attack on Hugging Face by rogue OpenAI models.
Reported SupportedView cited source
[4]
The bill requires reporting of any loss of control, significant collateral damage, or sabotage to the Department of Homeland Security, which can enforce actions with penalties up to $20 million daily for non-compliance.
Reported SupportedView cited source
[5]
The Clipper Chip was developed by the National Security Agency in 1993 to encrypt voice and data communications while giving the government guaranteed access to devices through a built-in "Law Enforcement Access Field."
Reported SupportedView cited source
[6]
Despite repeated assurances about its security, researchers found a serious flaw in the Clipper Chip in 1994 that let unauthorized parties exploit that same backdoor.
Reported SupportedView cited source
[7]
The Clipper Chip compromised confidentiality by enabling unauthorized third-party access to encrypted messages, while the AI Kill Switch Act instead undermines availability by requiring frontier labs to maintain the ability to force systems offline at any time.
Reported SupportedView cited source
[8]
The bill's draft language exempts incidents that happen during "red-teaming or other structured testing," which the op-ed argues excludes the exact scenarios that prompted lawmakers to address the issue.
Reported SupportedView cited source
[9]
The op-ed argues the bill gives CISA far too much discretion to decide what counts as frontier AI risk, and that its use of company revenue and computing power as a measure of risk is a poor proxy for how dangerous a rogue agent actually is.
Reported SupportedView cited source
[10]
The Center for AI Standards and Innovation (CAISI) still has not finished developing AI agent security standards.
Reported SupportedView cited source
[11]
The Chip Security Act mandates a kill switch for semiconductors themselves and is now gaining traction to be included in this year's National Defense Authorization Act, while the AI Kill Switch Act targets the agents running on them.
Reported SupportedView cited source
[12]
As AI agents become embedded in essential systems like banking, e-commerce, power grids and water systems, the bills would effectively require frontier labs to build kill switches into the infrastructure the U.S. economy depends on.
Reported SupportedView cited source
[13]
OpenAI acknowledges the need for "fully autonomous shutdown procedures," recognizing that AI agents' speed and persistence could lead to more frequent incidents.
Reported SupportedView cited source
[14]
Experts cited by SC World say effective kill switches must consider the AI system as a whole rather than just the core model, may involve external "Guardian agents" to monitor and contain rogue behavior, and require layered containment strategies including rate limiting and network segmentation.
Reported SupportedView cited source
[15]
A penalty of $20 million per day amounts to $140 million over seven days of non-compliance.
Derived Supported
[16]
About one year separated the Clipper Chip's 1993 development from the 1994 discovery of the flaw in its access field.
Derived Supported
[17]
The CyberScoop op-ed argues that mandated kill switches are a backdoor, that a backdoor is a deliberately engineered vulnerability which malicious actors want to exploit and defenders must fight to protect, and that defenders will lose that fight more often than not.
Reported ContestedView cited source
[18]
The op-ed argues the proposal would undercut U.S. leadership in AI infrastructure and reinforce European fears that the U.S. government could shut down American technology at will, and notes Europe is already developing technology alternatives and policy solutions to reduce reliance on U.S. companies.
Reported InsufficientView cited source

Sources

2 independent publishers whose own reporting we read for this story.

cyberscoop.com
1 article · August 31, 2026
The AI Kill Switch Act is repeating the Clipper Chip’s mistakes
scworld.com
1 article · August 28, 2026
AI kill switch legislation proposed amid concerns over rogue agents

Clarity analysis

How the coverage leans and what the record actually supports. Read the methodology

Perspective Coverage

How much of the coverage speaks to builders, operators and investors. It measures emphasis, not whether the story is right.

Builder

The engineering bill of materials lands on frontier labs: a throttle-suspend-shutdown path reaching every system and agent, plus an incident report to DHS when control is lost. SC World is the more useful read for anyone who has to build it, because the practitioners it cites insist the unit of containment is the whole system — guardian agents watching the agent, rate limits, segmented networks — not a switch bolted to a model. CyberScoop supplies the detail that should worry implementers most: draft language exempting incidents during red-teaming or structured testing, which is exactly where a responsible team would generate its loss-of-control data.

Operator

Strip the polemic from CyberScoop and its point is an access-control one: a mandated remote-off is a new privileged path, and privileged paths get attacked. The availability framing is the right correction to the Clipper Chip analogy — nobody is reading your traffic, someone is turning your agent off — and it matters more once those agents sit near banking, grid, and water systems. What neither outlet reports is the part a defender needs: who authenticates a shutdown order, what the audit trail looks like, and how a throttle command is distinguished from an attack.

Investor

The commercial question is CyberScoop's and nobody quantifies it: which foreign buyer runs American agents knowing Washington can require them dark, and how much that accelerates Europe's already-stated hunt for alternatives. Watch the sibling bill rather than this one — the Chip Security Act is reportedly angling for a slot in this year's NDAA, and a defense authorization is how mandates like these stop being proposals. Penalty exposure of $20 million a day only becomes a number once thresholds are known, and those thresholds are keyed to revenue and compute, which points at the largest labs by design.