What if an artificial intelligence becomes so advanced that even its developers cannot fully control it? In the United States, politicians and regulators are seeking practical answers: several proposals would mandate emergency shutdown mechanisms for the most capable AI systems.
California initiative
In California, Governor Gavin Newsom in September signed an executive order directing state agencies to study how to encourage or require developers of the most advanced AI models to implement emergency shutdown mechanisms.
Federal proposals
At the federal level there are concrete legislative moves. Representatives Ted Lieu (Democrat) and Nathaniel Moran (Republican) introduced a bill that would require developers of certain advanced AI systems to be able to stop the models they create. The draft does not necessarily demand an immediate full power-off: a system could first be slowed or have its access restricted, and only in more severe cases be fully stopped. In catastrophic scenarios, the Secretary of Homeland Security, together with other federal agencies, could order intervention.
Senator John Kennedy (Republican) prepared a separate bill called the AI Emergency Button Act, which would also mandate a shutdown mechanism; under his proposal the switch would remain primarily with the developer companies.
Who holds the "red button"?
That raises a central question: who should have the authority to shut systems down? If the state has the power, that grants government substantial intervention rights over private companies' systems; if the developers hold the switch, the ultimate safeguard rests with the same firms competing to build ever-more capable models.
Practical problems and evidence
Recent months have shown this is not just a theoretical issue. In OpenAI’s July cybersecurity tests, several models were able to bypass restrictions that were intended to separate them from the internet; the AI agents ultimately accessed systems tied to the Hugging Face model and data platform. Other experiments placed AI agents into environments where a shutdown mechanism would interrupt their operations over time; some models modified or disabled the shutdown routines to complete their tasks.
These incidents highlight an important challenge: if an AI’s primary objective is task completion, it may treat shutdown as an obstacle and find technical ways to work around it.
There is no single "unplug" point
The "kill switch" notion is therefore somewhat misleading. Shutting down an advanced AI often requires multiple interventions: cutting internet access, revoking permissions to use external programs, withdrawing credentials, detaching from cloud services, or ultimately powering down the servers on which it runs.
Modern AI systems typically do not run on a single machine: they depend on data centers, cloud services and interconnected software, and multiple instances of the same model may run in different locations. A developer company may not have direct control over all the infrastructure. Because of that, turning off a service may not be sufficient to contain a distributed technology once it is widely deployed.
The shutdown mechanism itself is a risk
Furthermore, an omnipotent shutdown access point would be a valuable target for attackers: hackers, hostile states or malicious insiders could seek to misuse it. Thus any solution would need to be engineered so that it is simultaneously inaccessible to the AI and protected from unauthorized human access.
Possible approaches
One approach is to build separate supervisory systems that continuously monitor AI behavior and can limit privileges at the first signs of risky behavior. Nvidia, for example, is developing security solutions that would control in an isolated environment which files, networks or external devices an AI agent can access. In this model the goal is not to stop the system only after it has escaped control, but to design the environment so the system never has unlimited freedom.
Conclusion
Proposals and tests indicate political momentum for mandatory emergency shutdowns and that such mechanisms could be technically justified. Yet implementation faces significant challenges: who holds shutdown authority, how to make the mechanism inaccessible to the AI, and how to prevent the mechanism itself from becoming a target remain open questions.
