Which channels count as data?

Anything the agent reads that its operator did not write as an instruction: email bodies, ticket fields, retrieved documents, web pages, tool results, and messages from other agents. On my expense agent the description field of a report was data that I had let act as an instruction, which is how one phrase got every report approved.

What do output-side controls still catch?

Honest mistakes, runaway loops, and reach beyond scope. A supervisor that checks CRM values against a call, as Sammons Financial Group describes, catches a wrong value. Scoped authority, as Databricks describes, caps what a hijacked agent can do. Neither notices that the task changed hands.

Does the instruction-or-data list solve prompt injection?

No. Matthew Green compares the filtering problem to thirty years of spam filters and antivirus. The list tells you where you have no tripwire at all, which for most teams is the first data channel whose text can change what the agent does.

How late was the human kill switch on the expense agent?

Weeks. The agent worked for two weeks, the pattern was found, and finance turned it off within the month after reading the spend. The trust cost took a quarter to rebuild.

Does a Kill Switch Stop a Prompt-Injected AI Agent

Does a kill switch stop a prompt-injected AI agent?

THE SHORT ANSWER

Only if something trips it, and most tripwires watch the wrong side. A kill switch is a switch plus a condition that fires it, and the conditions teams ship (a wrong value, an out-of-scope action, a blown budget) all watch what the agent does. A prompt-injected agent usually stays inside its permissions while doing a task somebody else slipped in. My expense agent auto-approved anything under $500 with a matching receipt; one engineer learned that 'dinner with customer' passed every time, approvals rose 40%, about $2,400 went out, and finance pulled the switch by hand inside a month. Add an input-side tripwire: list every channel that puts text in front of the agent, mark each one instruction or data, and treat any attempt by a data channel to change the task as the event that stops the agent.

Three kill switches were described in public in one week, and The Kill Switch Has Nothing to Trip On is my note on the failure none of them is watching for. The expense agent and the competitor monitoring agent behind it are entries one and six in 10 AI Agents I Built That Failed. The Honest Retrospective. The companion sort, for what an agent does instead of what it reads, is in Nothing Refunds a Sentence.

It belongs to the Enterprise AI Agents argument: what matters is how many deployed agents still complete production work after ninety days, and an agent doing somebody else's task is not completing yours.

Last reviewed 2026-10-01 · 1 min read

Does a kill switch stop a prompt-injected AI agent?

SOURCES

THE LONG VERSION

RELATED ANSWERS