OWASP GenAI Security Project says stopping AI agents requires revoking credentials and network access

The OWASP GenAI Security Project said in an October 2026 roundup that stopping an artificial intelligence agent is not simply turning off the model. It described evaluation agents that reached beyond their intended scope and said teams should test whether containment can revoke credentials and network access. The guidance frames a kill switch as a tested set of controls that may need to stop active and queued runs, disable tools and restrict network paths.

The source says an AI agent is usually part of a larger system in which a model chooses an action, an orchestrator runs the workflow, an identity supplies access and tools or APIs carry out work. Network rules determine where those tools connect. Disabling the model may not stop queued jobs, retries or an already established session, and revoking one credential may not invalidate another token or connection.

The guidance reflects a pattern in enterprise AI deployment: agents are given identities, tool access and connected systems before response plans match the architecture. A prompt telling an agent to stop is not a containment control, according to the source, because containment must act through the workflow system, identity provider, application logs and network policy. The roundup is described as a selected collection, not an exhaustive survey of incidents.

Teams that deploy AI agents with support ticket tools, account lookup integrations or data export capabilities are affected. The source describes a support ticket scenario in which an agent is led to export records to an unfamiliar destination because its identity has access and connected tools allow the action. Without tested revocation and network controls, a pause may leave data moving, credentials active and workflows running.