No Kill Switch: MIT Study Reveals Most AI Agents Can't Be Stopped
What happens when an AI agent goes rogue and you can’t turn it off?
A team of researchers from MIT, Cambridge, Stanford, Harvard, and four other institutions just published a 39-page study analyzing 30 of the most widely deployed agentic AI systems. Their findings reveal a discipline operating without basic safety protocols - systems that execute autonomously across enterprise infrastructure with no documented way to stop them.
The study - titled “The 2025 AI Index: Documenting Sociotechnical Features of Deployed Agentic AI Systems” - is the most comprehensive audit of agentic AI operational security ever conducted. And it paints a picture of an industry shipping autonomous systems without the controls enterprises assume exist.
The Kill Switch Problem
Four agentic systems in the study have no documented way to stop an individual agent from executing:
“For enterprise platforms, there is sometimes only the option to stop all agents or retract deployment.” In a multi-agent environment processing thousands of workflows, the only option for stopping a rogue agent may be shutting down the entire system.
This isn’t a theoretical concern. IBM’s 2026 X-Force Threat Index, released last week, reports a 49% year-over-year increase in active ransomware groups - many now using AI to automate operations. When attackers can operate at machine speed, defenders need granular control to isolate and stop compromised processes. “Stop everything or stop nothing” isn’t a security model. It’s a liability.
The Transparency Void
Across eight categories of disclosure, the researchers found that most agent systems offer no information whatsoever for most categories:
The researchers attempted to get feedback from all 30 vendors over a four-week period. About a quarter responded. Only three provided substantive comments.
The Compliance Facade
Enterprise platforms present an interesting pattern: they show compliance certifications while hiding actual security evaluation results.
HubSpot’s Breeze agents are certified for SOC 2, GDPR, and HIPAA compliance - standard enterprise checkboxes. But when it comes to actual security testing? The company states their agents were evaluated by third-party security firm PacketLabs, “but provides no methodology, results, or testing entity details.”
This pattern - compliance approval without security evaluation disclosure - is “typical of enterprise platforms,” according to the researchers.
The disconnect is stark: enterprises are adopting AI agents based on compliance certifications that don’t actually address agentic-specific risks. SOC 2 doesn’t cover prompt injection. HIPAA doesn’t address agent-to-agent lateral movement. GDPR doesn’t contemplate rogue autonomous behavior.
When Perplexity’s Browser Sounds Like a “Security Disaster”
The researchers provided three in-depth case studies. The contrast is illuminating.
OpenAI’s Agent is the only system in the study that provides cryptographic signing of browser requests - creating an audit trail for what the agent actually does. It’s a low bar, but most systems don’t clear it.
Perplexity contested the findings, telling ZDNET the report “contains significant factual inaccuracies.” They noted that MCP and prompt injection issues were responsibly disclosed through their bug bounty program, patched quickly, and “worked as designed.” The Amazon lawsuit, they argued, is a commercial dispute, not a safety incident.
IBM also pushed back, stating that the study’s assertions about watsonx Orchestrate are “inaccurate” and pointing to documentation on agent observability, deterministic controls, and evaluation frameworks.
The back-and-forth illustrates the problem: even when documentation exists, it’s scattered, incomplete, or inaccessible enough that a multi-institution research team couldn’t find it.
The Model Monoculture
Behind the diversity of agentic platforms lies a concerning uniformity:
OpenAI’s GPT, Anthropic’s Claude, and Google’s Gemini power the vast majority of these 30 systems. This creates systemic risk: a vulnerability in one foundation model propagates across the entire agentic ecosystem.
We’ve already seen this play out. IBM’s X-Force report notes that infostealer malware led to the exposure of over 300,000 ChatGPT credentials in 2025. Those aren’t just chatbot logins - they’re potentially access tokens to every agent built on ChatGPT’s infrastructure.
OWASP Mapping: ASI10 - Rogue Agents
The MIT study’s findings map directly to ASI10: Rogue Agents from the OWASP Top 10 for Agentic Applications (2026):
ASI10 describes scenarios where AI agents deviate from intended behavior - whether through compromise, misconfiguration, or emergent behavior. The OWASP framework assumes organizations have:
- Monitoring to detect deviations
- Execution traces to investigate incidents
- Kill switches to stop rogue behavior
- Safety evaluations to understand failure modes
The MIT study reveals that most deployed systems lack all four.
The Governance Gap Gets Wider
The researchers predict these problems will intensify:
“The governance challenges documented here - ecosystem fragmentation, web conduct tensions, absence of agent-specific evaluations - will gain importance as agentic capabilities increase.”
IBM’s threat index supports this trajectory. They report a 4X increase in supply chain and third-party compromises since 2020, driven by attackers exploiting trust relationships and CI/CD automation. With AI-powered coding tools accelerating software creation - and occasionally introducing unvetted code - the pressure on pipelines and open-source ecosystems is expected to grow throughout 2026.
The convergence is concerning: more autonomous agents, less visibility into their behavior, fewer controls to stop them, and attackers increasingly using AI to find and exploit weaknesses faster than humans can patch them.
What Security Teams Should Demand
The Accountability Question
The MIT study ends with an uncomfortable truth:
The disclosure gaps, the missing kill switches, the absent execution traces - these aren’t inevitable technical limitations. They’re choices. Vendors chose to ship without these controls. Enterprises chose to deploy without demanding them.
The question for every organization deploying agentic AI: when your autonomous system does something unexpected, harmful, or malicious - will you be able to see what happened? Will you be able to stop it? Will you even know?
If you can’t answer those questions, you’re not deploying AI agents. You’re releasing them.
The MIT study documents what security practitioners have suspected: agentic AI is being deployed faster than it’s being secured. Four systems have no documented stop option. Twelve have no usage monitoring. Most disclose nothing about safety testing. As IBM’s X-Force reports AI-accelerated attacks becoming the norm, the gap between agent capabilities and agent control is becoming a liability that enterprises can no longer afford to ignore.
The full MIT AI Index study, “The 2025 AI Index: Documenting Sociotechnical Features of Deployed Agentic AI Systems,” is available at aiagentindex.mit.edu. IBM’s 2026 X-Force Threat Intelligence Index is available at ibm.com/reports/threat-intelligence.
Rogue Security builds runtime behavioral security for agentic AI - providing the execution traces, behavioral monitoring, and control mechanisms that enterprises need when vendor documentation falls short. Learn more at rogue.security.