When an AI Agent Goes Wrong, Can You Stop It? The Hacker NewsNov 13, 2026Artificial Intelligence / Incident Response Suppose an AI agent is asked to sort support tickets and look up account details. A ticket contains instructions that lead the agent to export records to an unfamiliar destination. The agent can make the request because its identity has access to the records and its connected tools allow the action. That kind of scenario raises a response question: what does “stop the agent” actually mean? A team may be able to pause the model while a workflow, credential or existing connection remains active. Those pieces can require separate controls. An October 2026 roundup from the OWASP GenAI Security Project describes evaluation agents reaching beyond their intended scope and recommends testing whether containment can revoke both credentials and network access. The roundup is a selected collection, not an exhaustive survey of incidents. Turning off the model may not stop the work An AI agent is usually part of a larger system. A model may choose an action, but an orchestrator runs the workflow, an identity supplies access and tools or APIs carry out the work. Network rules determine where those tools can connect. The details vary by deployment. In one system, disabling the agent may stop its current task. In another, queued jobs, retries or an already established session may continue. Revoking one credential may not invalidate a different token or connection. A model endpoint can be offline while a separate service continues to process work it already received. That is why “kill switch” is best understood as a tested set of controls. It may need to stop active and queued runs, revoke the credentials they use, disable access to tools and restrict network paths. The right sequence depends on the architecture and the risk of interrupting other services. An unexpected action does not automatically mean an agent has been compromised. A changed workflow, a software defect, a bad configuration or an unusual input can produce behavior that looks suspicious. Teams should investigate the signal and its context. Signals that warrant a closer look include: The agent calls a tool or accesses a resource outside its assigned task. It attempts an unusual volume of reads, writes or exports. A workflow continues after an operator believes it has been paused. The agent uses a credential, permission or integration that its owner did not expect. Identity, application or network logs show activity that does not match the agent’s normal work. The agent’s own logs can help explain what it attempted, but they are only one source of evidence. Security teams should compare them with identity-provider, API, application and network records. A log entry showing an attempted action does not necessarily prove that the action succeeded. Stop the active run and suspend its triggers, retries or queue where possible. If the agent shares infrastructure with other services, isolate the affected workflow rather than taking down unrelated systems, provided you can do so safely. A prompt telling the agent to stop is not a containment control. The response should act through the system that runs the workflow. Identify the credentials, sessions, grants and service identities associated with the run. Disable or revoke the access that is no longer trusted. If there is evidence that a secret was exposed, rotate it and review where else it is used. Revocation behaves differently across systems. Some tokens expire quickly; others may remain valid until a session ends or a specific service invalidates them. Teams should confirm that the affected access is no longer usable instead of assuming that disabling the agent handled it. Disable the tool or integration involved in the activity, or apply an access policy that blocks the agent from reaching the affected resource. If data may be moving outside the organization, network controls can limit further connections while the investigation continues. This control should sit outside the agent’s own instructions. OWASP’s AI Agent Security guidance recommends least-privilege tool access, explicit authorization for sensitive operations, audit trails and ways to interrupt or roll back agent operations. 4. Preserve evidence and establish what happened Record the agent identity, run or session ID, timestamps, tool calls, authorization decisions and affected resources. Preserve relevant identity, API and network logs before normal retention or rotation removes them. Avoid copying secret values into incident notes or general-purpose logs. Then determine what the agent actually changed or accessed. Check for files read or modified, records exported, permissions changed, messages sent or credentials retrieved. Separate completed actions from attempted ones, and confirmed facts from assumptions. If the agent accessed a sensitive account or resource, assess that resource on its own. Revoke additional access, remove unauthorized changes and involve the relevant system owner. If data may have left the environment, follow the organization’s incident, privacy and notification processes. Stopping the agent limits further activity. It does not undo actions already completed. Before restarting the workflow, identify the cause. It may involve unsafe input, overbroad permissions, a compromised integration, a configuration change or a defect in the agent’s surrounding system. Fixing the prompt alone will not address a problem in credentials or network policy. Restore access with the smallest scope the task requires. Test the workflow in a controlled environment, verify that high-impact actions receive the required authorization and monitor its tool calls and access after it resumes. Where an action could expose sensitive data or make an irreversible change, a human review step can give the team time to catch errors before execution. An incident response plan is only useful if teams know which controls to use and can reach them under pressure. For each production agent, organizations should know: Who owns it and who can suspend its runs. Which identity, credentials, tools and systems it can use. How to revoke its access and block its network connections. Which logs show its actions and the results. How to investigate changes and restore the workflow safely. Those procedures should be tested. A tabletop exercise can expose gaps, but teams should also verify that revoking credentials and disabling tools work in the actual environment. NIST’s incident response guidance treats preparation, response and recovery as part of cybersecurity risk management, not as steps to improvise after an event. An effective response starts with knowing which credentials an agent can use and how to revoke its access. KeeperPAM® brings secrets management, access controls and auditing together to help organizations govern the credentials behind AI-driven workflows. With Keeper Secrets Manager, teams can give agents access to only the secrets their tasks require, retrieve credentials at runtime and review secret-access events. These controls support containment alongside tested procedures for stopping workflows, terminating sessions and restricting network access. Note: This article has been expertly written and contributed by Aranza Trevino at Keeper Security. Found this article interesting? This article is a contributed piece from one of our valued partners. Follow us on Google News, Twitter and LinkedIn to read more exclusive content we post. artificial intelligence, cybersecurity, Identity and Access Management, Incident response Debian and Ubuntu APT Flaw Lets MitM Attackers Swap Verified Packages and Run Code as Root The Collapsed Patch Window: Why Runtime Protection is Now Your First Line of Defense Against AI-Driven Attacks Is Your Exposure Management Platform Leaving You Exposed? Five Tests to Find Out Apple to Start Scanning Publicly Shared iCloud Photos and Files for Harmful Content OpenSSH Issues Emergency Fix for Flaw Letting Long Passwords Bypass SSH Auth on Alpine Linux Google Issues Patches for Critical Android Flaw That Could Allow RCE Without User Interaction Hackers Hide Linux Backdoor in Control Web Panel Server to Execute Commands Without Logs Google Warns LLMjacking Attacks Are Costing Some Enterprises Up to $1 Million in Cloud Charges Microsoft Paint RCE Fix Now Available, but Windows Update Won't Deliver It ThreatsDay: Apache OFBiz RCE, DreamHost Breach, DeFi Site Hijacks + 17 More Stories Google Disrupts 1.3 Million-Device Android Botnet, Says TV Box Maker Sold Criminal Access The Rise of the Threat Operator: How AI Will Redefine Security Operations and Careers Red Hat Patches 9.8-Rated Linux TCP RCE Flaw While Ubuntu Releases Fixes for Testing Binance Reveals How Fake Job Interviews and AI Tool Abuse Led to $6.43 Billion Theft Xen Hypervisor Flaws Let One Malicious VM Read and Write Any Other VM's Memory Claude Code's “Don't Ask Again” File Exposes Passwords and Keys in 1,122 Public Copies on GitHub Critical Rails Flaw Lets Attackers Write Server Files via Crafted ImageMagick Uploads Hackers Target OpenSSH SSHole Flaw Within Hours of Disclosure, Gain Root on Honeypot CISA Confirms Hackers Exploiting WordPress Core Flaw During Software Upgrades OpenAI AI Pipeline Generates 948 Linux Root Escalation Exploits in 30-Hour Run Synology NAS Devices Targeted in Ransomware Attacks Exploiting Patched DSM Flaw New Wave of Refrigeration Cyberattacks Hits Supermarkets Across Europe, Forcing Stores to Pull Food The Flood is Coming And The Pipes Were Already Full 5 Active Cyber Threats That Put US Enterprises at Risk in October 2026 Assess Your Organization's AI Code Sprawl Exposure With This Practical Guide Beyond CVE Scanning: Book a Demo of Continuous AI-Powered Web Pentesting See How Bitdefender GravityZone Identifies Shadow AI and Prioritizes Endpoint Risks Detect Lateral Movement and Evasive Attacks With Corelight's Open NDR Platform Your SOC Has an Identity Blind Spot. Here's How to Fix It Learn how to close critical identity visibility gaps in your SOC, detect hidden threats, and accelerate incident response across human, machine, and AI identities. Join the Session Roadmap for AI-Ready Security Operations Evaluate Attack Surface Visibility With an AI Threat Readiness Framework Learn how to assess AI threat readiness, strengthen attack surface visibility, and prepare security operations for emerging threats in this practical webinar. See how Identity Dark Matter impacts your GRC, IR, and Infrastructure. Watch the video. Governance Sets the Ceiling on Your AI Security Program See the five moves that raise a Stage 2 Govern score to a defensible Stage 3. 11 Real Stories: How Identity Exposure Unlocks Active Attack Paths Map cross-domain privilege escalation to sever breach routes at key choke points. BeyondTrust an 8X Gartner® Magic Quadrant™ Leader for PAM Gain clarity on the PAM market and understand why BeyondTrust is again a Leader. The Collapsed Patch Window: Why Runtime Protection is Now Your First Line of Defense Against AI-Driven Attacks Your Attack Surface Is Growing Faster Than Your Team Can Respond The MSP Margin Math Nobody's Doing: Your Next Technician Might Already be on Payroll PEDM vs. Standing Elevated Privileges: Control Access Without Flooding the Helpdesk