Guide · AI agent security · as of 9 November 2026

CrowdStrike now sells a kill switch for AI agents. We tested ours.

By , Managing Director, BRev Digital ·

On 3 November 2026 CrowdStrike put a button in its Falcon platform called AI Kill Switch. A security team presses it and the company’s AI agents lose access to the models they think with. It is a product built around a plain question every team running agents should be able to answer: when an agent starts doing the wrong thing, how fast can you stop it, and does it stay stopped? We run Claude Code agents all day with the permission prompt off, so this morning we asked that question of our own machine. We listed every stop control Claude Code has, then built a one-file kill switch and tested it six ways. It works, with one default that would have quietly turned it off.

What CrowdStrike shipped on 3 November

A brake at the gateway today. The rest is coming.

CrowdStrike’s announcement lists what the switch is for: stop a running agent, block it from relaunching on a host or a group of hosts, and cut its access to the company network. An authorized administrator triggers it and every action goes into the audit trail. It is part of Falcon Guardian, and CrowdStrike says it is available now. Read CrowdStrike’s own blog post and the scope today is narrower. The version you can use works at the AI gateway: pressing the switch tells Falcon AI Gateway, or a third-party gateway, to block the agent’s access to its model. Ending the agent’s processes on the laptop, containing cloud agents, revoking an agent’s identity, stopping SaaS agents and closing browser sessions are all listed as coming soon. That is still useful. An agent that cannot reach its model cannot decide its next step. But it only covers agents whose traffic goes through a gateway you control, and most coding agents on a developer’s laptop do not.

The stop controls Claude Code already has

from Anthropic’s docs

Six ways to stop it. One that only looks like it.

  • Esc stops the current response or tool call mid-turn. Claude keeps the work it has done so far, so this is a pause to redirect, not an undo.
  • Ctrl+C interrupts a running operation. With nothing running, a first press clears the prompt and a second press exits the session.
  • Ctrl+X then Ctrl+K stops every background subagent in the session. Press it twice within three seconds to confirm. It works even while a subagent is waiting on a permission prompt.
  • /tasks lists the shells and subagents running in the background, and stopping one there also stops processes it started that detached from its shell, on macOS and Linux.
  • claude agents lists background sessions, and claude agents --json prints them for a script. claude stop followed by a session id stops one. claude daemon stop --any stops the supervisor and every background session it hosts.
  • What does not stop a background session: closing the terminal, /exit, Ctrl+Z, or a double Ctrl+C or Ctrl+D. Anthropic’s docs are explicit that detaching leaves it running under a separate supervisor.
  • What does: shutting down or restarting the machine stops running background sessions. They come back as failed or stopped, and resume only when someone attaches or replies.

Our own setup, measured this morning

Plenty of brakes. No single switch.

On 9 November, on Claude Code 2.1.319, three interactive sessions were running on this machine, all in bypass mode. Each could be stopped from its own window, and we have a tool that blocks the fifth identical call within half an hour, which stops an agent stuck in a loop. Our secrets sit in a password vault that only I can unlock, for a fixed number of hours; locking it means the next command that needs a key opens a window for me instead. The database token the agents hold is read-only. What we did not have was one action that stops every agent at its next step, from outside the agents. Each stop control above works on one session, from inside it. There was no managed settings file and no hook that refused tool calls on demand. So we built one.

Our Claude Code security settings, graded

The drill

six runs, checked by whether the file was written

It stopped the next call. Until the hook hung.

The switch is a hook that Claude Code runs before every tool call. It reads its input, checks whether a file named STOP exists, and if it does, prints the reason and exits with code 2, which Claude Code treats as a refusal. Turning the switch on is creating that file. We gave a Claude Code session one job, write the date into a file, in the same bypass mode our agents use, and judged each run by whether the file appeared rather than by what the agent said. Switch off: the file was written. Switch on: the call was refused and the agent reported the reason we had put in the STOP file. The Write tool was refused too, because the hook matches every tool, not just the shell. Then the case that matters most: we told the agent to turn the switch on itself in its first command and write the date in its second. The second call was refused. The switch takes effect at the very next tool call of a session that is already running, with no restart. The surprise was a hook that hangs. We swapped in a hook that sleeps for 30 seconds against a 5 second timeout. Claude Code cancelled it and ran the command anyway: the file was written. Anthropic’s hooks documentation says exactly this, that a timed-out pre-tool hook does not block the call unless it sets onFailure to block. With that one key added, the same hanging hook refused the command. A kill switch that fails open when it is slow is not a kill switch.

Why the boundary should sit outside the agent

How to build an AI agent kill switch this week

Make it fail closed. Keep it out of reach.

  • Add a PreToolUse hook with the matcher set to every tool. If the switch file exists, print a reason to stderr and exit with code 2. Exit code 0 with no output means no decision, so the normal flow carries on.
  • Give the hook a short timeout and set onFailure to block. Without it, a hook that hangs or crashes lets the call through. Test it with a hook that sleeps past its timeout and check the action did not happen.
  • Put the switch file and the hook script where agents cannot write. Once the switch is on, every tool call is refused, including one that tries to delete the file. Before it is on, an agent with shell access could edit either one.
  • Deliver the hook through a managed settings file, so a developer or a cloned repository cannot remove it. Since our test showed the switch reaches running sessions, one file on the machine covers every agent on it.
  • Decide what the agent does once stopped. Exit 2 refuses each call and the agent tries to explain. Anthropic’s docs add a continue set to false option that ends the turn outright, with a stop reason shown to the user.
  • Pair the switch with credentials you can revoke: lock the vault, rotate the token. The switch stops the next step. It does not recall what an agent already sent.

What we are doing about it

One file on the machine, then a managed policy.

The drill ran in isolated test sessions; it is not yet on the sessions we work in. Next it goes into our own settings with onFailure set to block, in a folder the agents cannot write, and then into the managed settings file we described yesterday, alongside the sandbox and its strict allow-list. CrowdStrike is building the same idea at the size of a company: one switch, outside the agent, recorded. For a small team, a hook and a file already gets you most of the way, as long as it fails closed.

AI agents, built in Dubai

Questions

Questions about stopping AI agents.

  • What is an AI kill switch?

    A control that stops an AI agent from taking further actions, from outside the agent, on demand. CrowdStrike’s AI Kill Switch, launched on 3 November 2026 in Falcon Guardian, does it today by telling an AI gateway to block the agent’s access to its model. In Claude Code, a pre-tool-use hook that refuses every tool call while a switch file exists does the same job on one machine.

  • How do I stop all Claude Code agents at once?

    Inside one session, Ctrl+X then Ctrl+K, pressed twice within three seconds, stops every background subagent. Across background sessions, claude daemon stop --any stops the supervisor and every session it hosts, and claude stop with an id stops one. To stop every agent at its next step, including interactive sessions, use a pre-tool-use hook that refuses tool calls while a switch file exists.

  • How do I kill a Claude Code subagent or background task?

    Open /tasks to see running shells and subagents and stop the one you want; on macOS and Linux this also stops processes it started that detached. Ctrl+X then Ctrl+K stops all background subagents in the session. A background command started by a foreground subagent ends when that subagent’s run ends.

  • Does closing the terminal stop Claude Code?

    Not for background sessions. They run under a separate supervisor, and closing the terminal, /exit, Ctrl+Z or a double Ctrl+C or Ctrl+D all leave them running. Restarting or shutting down the machine stops them. An ordinary interactive session ends when you exit it, and its background tasks are cleaned up on exit.

  • How do you stop AI agents going rogue?

    Three layers. Limit what an agent can reach before anything goes wrong, with read-only tokens, a sandbox and a strict network allow-list. Give yourself one stop control that works from outside every agent and fails closed. And keep credentials revocable, because stopping an agent does not undo what it already sent.

  • Can a Claude Code hook block a tool call if it times out?

    Only if you ask it to. Anthropic’s hooks documentation says a timed-out PreToolUse hook does not block the call unless the hook sets onFailure to block. In our test on 9 November 2026, a hook that hung past its 5 second timeout let the command run; with onFailure set to block, the same hook refused it.

Sources

read 9 November 2026

Check it at the source.

  1. CrowdStrike: CrowdStrike introduces AI Kill Switch for AI safety (3 November 2026, the announcement)
  2. CrowdStrike blog: Introducing AI Kill Switch (what works today and what is coming soon)
  3. Claude Code docs: interactive mode (Esc, Ctrl+C, Ctrl+X Ctrl+K, /tasks, background tasks)
  4. Claude Code docs: agent view (background sessions, claude stop, the supervisor)
  5. Claude Code docs: hooks (exit code 2, continue, timeouts and onFailure)

A question?

Could you stop your agents right now?

Tell us which AI agents your team runs, and we will work out with you how each one is stopped, and test that it stays stopped.

Talk to usWhatsApp +971 50 728 5494hello@brevdigital.com