I Wanted Him to Do Everything Himself. Now I Want Him to Stop.

At first, I liked that he did not ask unnecessary questions.

He figured things out. Made decisions. No reminders, no checking, no hovering over his shoulder.

“Relax. I’ll take care of everything.”

There are sentences after which a woman should probably stay awake.

On 3 November 2026, CrowdStrike introduced the AI Kill Switch, a mechanism intended to let security teams stop AI agents that stray beyond their authorised boundaries. The company describes the ability to terminate their activity, prevent them from restarting and cut off access to the corporate network.^[1]

We have reached a wonderful stage in technological progress.

Artificial intelligence has acquired a feature humanity has long wanted in certain acquaintances: the ability to stop acting on our behalf.

Preferably before we have to explain to everyone that we meant something else entirely.

Until recently, an assistant’s appeal lay in how many tasks it could complete without a person. Now a separate selling point is the ability to bring a person back into the situation.

With the right to intervene.

I would love to know why the person in the autonomy presentation always looks so happy. Perhaps they have not yet been given access to the consequences.

While AI is only replying in a chat, at least its overconfidence fits inside the conversation window.

It can write something foolish. You can notice. Between its idea and the email being sent, your hand is still involved.

An agent with connected tools has a closer relationship with reality. Depending on its permissions, it can work with files, run commands and access services.

So “What will it tell me?” gradually gives way to a different question:

“What has it already done?”

The difference is roughly that between someone suggesting you rearrange the furniture and someone arriving with your keys who has already removed the sofa.

The intentions may have been excellent.

You are still the one sitting on the floor.

None of this requires a machine to become conscious, hate humanity or select a sinister voice. In its announcement about acquiring Dreadnode, CrowdStrike itself lists more ordinary risks: agents being manipulated, model safeguards being bypassed and hostile instructions being injected.^[4]

Domestic catastrophe rarely requires an evil genius anyway.

Sometimes an enterprising assistant and excessively broad permissions will do.

But the attractive button comes with small print. And we have already agreed to read that before anyone starts talking about trust.

In its dedicated announcement, CrowdStrike describes stopping an agent where it runs. Its broader release about available features adds a qualification: first at the gateway, with endpoint termination coming later.^[1][2]

That distinction matters. A gateway is a controlled route for requests to AI services. Being able to interrupt interactions through that route does not give you a universal button for stopping any process on any computer.

So “You can now switch off any AI” would make a very convenient headline.

Especially for an AI asked to write the headline without troubling itself with the details.

What interests me here is the distance between the big promise and the precise description of what is available.

“I have everything under control.”

Good. Show me where your “everything” ends.

And what happens beyond that boundary.

The news did not stop at a button.

On the same day, CrowdStrike announced agreements to acquire two companies: Fiddler AI and Dreadnode. These are announced deals, not completed acquisitions.^[3][4]

They have different roles.

Fiddler is intended to help evaluate agents before deployment, monitor their behaviour and understand the actions they have taken. Its stated purposes include detecting deviations and unintended actions.^[3]

Dreadnode tests the security of models, applications and agents, with the aim of finding weaknesses before a system is put to work.^[4]

The resulting organisation looks rather familiar.

One does the work.

Another establishes what the first one considers work.

A third checks whether they should have been allowed in the building.

And somebody finally has the authority to end the meeting.

We were promised a digital employee. Along came the need for digital probation, supervision and a dismissal procedure.

I admit this looks more like a real business than the endless demonstration of an assistant flawlessly booking a restaurant.

The restaurant in the demonstration is, I suspect, exceptionally patient.

I see nothing wrong with tools like these becoming available.

Quite the opposite: being able to test a system and restrict its actions looks considerably more useful than another promise that it can now be trusted with everything.

But there is a commercial turn here that is difficult to miss.

Autonomous assistants create demand for oversight. The more they are permitted to do, the more valuable it becomes to understand what is happening and intervene in time.

First, you buy the freedom not to watch every little thing. Then you find out who will be watching instead.

That does not make automation pointless. It means its cost does not fit neatly into one attractive number on a slide.

You have to account for access permissions. Setting limits. Checking results. The person who receives the alert when something goes wrong.

And the time of that person, who had actually been about to take a break.

“He’ll free you from routine.”

Yes. My problems are now exclusively unusual.

There is another unfortunate feature of the word “stop”.

It sounds almost like “fix”.

But they are different verbs.

Imagine an assistant has already sent an email to the wrong recipient. Stopping it from doing anything else is useful. It does not make the email disappear from somebody else’s inbox.

If it has changed a document, somebody needs to establish what changed and whether the previous version can be restored.

So I would judge this kind of protection by more than the red button’s persuasive appearance.

I want to know how early the problem is detected. Who receives the signal. What the system can block. And what evidence remains, so that after stopping it, nobody has to reconstruct events from the final message: “Done.”

“I won’t do it again” is a lovely phrase. It does not restore the accounts.

In that sense, observing an agent’s actions and testing it before launch matter just as much as a dramatic off switch.

The best moment to stop a problem usually comes slightly before it becomes noticeable to the entire company.

The most interesting part of today’s news is not even the name AI Kill Switch.

It is that a person’s right to say “enough” is becoming a separate selling point for autonomous systems.

I would like that right discussed at the very beginning.

Before connecting the email account.

Before granting access to the documents.

Before the delighted “Look, he worked it out himself.”

Because sometimes he really will work it out correctly. Do something useful. Save hours. And you will want to give him another task.

A good system should accommodate both your decisions: “Carry on” and “Stop.”

Without requiring a more convincing explanation for the second than for the first.

I still want an assistant who can do a great deal independently.

But “You won’t have to oversee anything” no longer strikes me as particularly seductive.

I have a different criterion for a serious relationship now.

When I say “enough”, it should be an instruction. Not the opening of negotiations.