Pulling the Plug Is the Easy Part

The UK NCSC published interim advice on agentic AI on 20 August. The headline everyone repeated was the kill switch: if something goes wrong, you should be able to halt autonomous activity immediately.

That is the right last move. It is not the hard part.

The hard part is knowing what you are shutting down, and what already happened before you reached for the switch.

What the NCSC actually asked for

The post is practical, not theatrical. It tells operators to decide how much autonomy an agent is allowed to have, then apply controls in proportion to that choice. It tells them not to treat model-level safety as a security program. It tells them to sandbox the agent, deny network by default, give the agent its own identity and short-lived credentials, log the session as if it were user activity, and keep a way to cut both the agent process and its path to the model.

Those are not new ideas. They are now written down by a national cyber agency, with maturity ladders attached. The source is here: https://www.ncsc.gov.uk/blogs/managing-the-cyber-risk-of-agentic-ai

The network ladder is blunt. Unrestricted access is level 1. An allowlist is level 2. Model API only is level 3. No external network, local model inside the sandbox, is level 4. Most coding-agent setups we see in the wild are still level 1 wearing a container.

The compute ladder is the same story. Same host, no isolation. Same host, a container. Same host, a VM. Dedicated hardware. Level 1 is where an agent inherits the user’s SSH keys, npm tokens, and authenticated browser sessions because it is running as the user.

That is the blast radius. The NCSC names it that way on purpose.

A stop button is not evidence

We wrote in May that the new incident question is not only “what changed?” It is “what did the agent do?” — “What Did the Agent Do?” Is the New Incident Question

The NCSC just put that in official language. Observability, in their list, is not a nice dashboard. It is transcripts and traces plus sandbox logs, proxies, and network traffic. Those logs should be hard to alter. The collection path itself should not be an escape hatch.

If your only control is a kill switch, you can stop the next action. You cannot answer the last one.

Did the agent install a package? Did it read .env? Did it follow a skill that told it to send a file off-box? Did it compress away the constraint you wrote at the top of the prompt? A stopped process does not tell you that. A git diff does not tell you that either. The session does.

Identity is the other gap. The NCSC says every agent should have a distinct identity, in a class that is not a human and not “the laptop.” If the commit, the API call, and the npm publish all look like Tom, you do not have an agent security program. You have a shared account with extra enthusiasm.

What to do this week

You do not need level 4 to start.

Give the coding agent its own identity. Do not let it inherit the user’s cloud keys. Prefer a proxy that injects credentials into approved requests so the agent never holds the secret.

Deny outbound network by default. Allow the model API, the package registry you actually use, and nothing else until someone grants it. Record the grant.

Treat the session as evidence. Prompt, tools, files touched, commands, installs, policy hits. Keep that record somewhere the agent cannot edit.

Then add the kill switch. Cut the process. Cut the network. Cut the path to the model. Test it once on a weekday, while people are watching, before you let the agent run overnight.

The NCSC is careful to say this is interim. Formal guidance will replace it. That is honest. The direction is not going to reverse.

If you cannot answer what the agent did, pulling the plug only stops the next mistake. The last one is already in the repo.

Defenders need an edge. Explore the stack at https://turen.io, or watch the full demo at https://try.turen.io/demo.