Bill Gates Says an AI Kill Switch Is Not Enough

Bill Gates said on Sept. 27 that AI is powerful enough to drive events that cause a billion deaths. The Microsoft cofounder told Kristen Welker, in a Meet the Press interview, that skipping required AI safeguards and monitoring is completely irresponsible. He also said a kill switch is not enough, and that the rules would add only a little overhead for the labs.

Nine days earlier, California had ordered work on the very switch he waved off. New York floated the same idea three days after that. The clip that moved was the death toll. The part about police logs did not.

The Kill Switch Landed While Gates Was Taping

Gates sat with Welker on Wednesday, Sept. 23. That is the same day Gov. Gavin Newsom named the experts who will tell California how to build an emergency shutoff for frontier models. Newsom had already signed the order on Sept. 18, directing the state to speed two new auditor laws and to study a kill switch whose working order would be checked by an outside body.

Welker put three choices to him: an imposed kill switch, a full pause, or companies policing themselves. He did not pick the switch. He said most dangerous tools are ones governments already funded or buy, and that AI came out of private labs, so officials still have “so little expertise” in the thresholds he says were crossed this year in biotech and cyber attacks.

NINE DAYS OF SWITCH TALK

1. July 23, 2026: Rep. Ted Lieu of California, with Rep. Moran, introduces H.R.9917, the AI Kill Switch Act, and the House refers it to the cybersecurity subcommittee the next day.
2. Sept. 18, 2026: Newsom issues an executive order to speed independent oversight and a kill switch for rogue frontier models.
3. Sept. 18, 2026: Anthropic says Accenture staff will evaluate its models from inside the company, with employee-level access.
4. Sept. 21, 2026: New York Gov. Kathy Hochul says her state will look at kill switches if they are feasible and in the state’s interest, as a new RAISE Act compliance office stands up.
5. Sept. 23, 2026: Newsom names Jason Goldman, Gillian Hadfield, Alondra Nelson and Rob Reich to advise on the order, and Gates tapes the Welker interview.
6. Sept. 27, 2026: The interview airs. Gates calls a kill switch “kind of a weird thing” and “not enough.”
7. Sept. 29, 2026: President Donald Trump tells reporters Gates “went the opposite” on the warning.

The House bill is still only introduced. It would make large operators stop inference and shut models down, cut off users, and freeze accounts that look risky. It is a switch with extra knobs, not a single red button, and it still sits in committee.

Gates Wants Records Police Can Read

The danger he kept naming was not a model that seizes every computer on the desk. Asked if AI is already out of control, he said no. It is not running millions of robots, he said, and “we can turn off the computer.” The near-term problem, in his telling, is people with bad intent using the newest tools.

Law enforcement is going to get called up on all these fraud events or, you know, transmission shutdown events. And their ability to see what’s going on is going to be nil unless the monitoring and safeguards are built into the AI.

Bill Gates, Microsoft cofounder, Meet the Press interview with Kristen Welker

He said a kill switch alone would not prevent those tragedies. “When you’re trying to moderate the bad behavior, you need insight and records of what’s being done.” He also said he would never want to say he is against a kill switch. The ask underneath the slogan is logging, so that after a fraud wave or a grid event, investigators can see what the system did.

Pressed on self-rule by the labs, he was blunt. “No one thinks self-regulation is enough.” Asked if Washington must pass a law, he said, “Absolutely. You need law enforcement and the politicians to get into the discussion about what safeguards and monitoring look like. And that has to be a required thing.”

Why a Plug Does Not Stop a Fraud Ring?

Pulling the plug on a hosted model stops new answers from that host. It does not rewind a scam that already drained accounts, and it does not recover a pathogen recipe that already left the chat. Gates walked through the jobs he says small groups can now do, work that used to sit with state cyber units and military labs.

THE THREATS HE NAMED ON AIR

• Retail fraud: Someone who wants to defraud a person is “now empowered,” and he said the old model of people in Cambodia typing scam scripts is already out of date.
• The power grid: He listed a bid to shut down the electric network as a live use of the same tools.
• Banking: He said attackers can scramble bank accounts, and that police will be called after the fact with nothing to read if the logs were never kept.
• Bioterror: He pointed to Anthropic’s own reports of people trying to use its models for bioweapons, and he grouped bio-attacks with large cyber strikes as the events that would force a late scramble.

That list is why he called the kill-switch talk a sign of how non-technical the debate has become. “We’re not yet at the point where they autonomously grab computers and, you know, can’t be shut down.” A switch is a tool for a runaway host. The cases he put on the table are users, prompts and missing records.

THREE SWITCH TRACKS ON THE BOOKS

Newsom’s packet is the closest to Gates’s monitoring line, because it tries to embed outside checkers in frontier labs and to make companies’ safety filings stand up to an independent review. SB 813 sets up those verification bodies. AB 1405 builds a state registry of AI auditors. Both were signed in 2026 on top of SB 53, the 2025 Transparency in Frontier Artificial Intelligence Act. The kill switch is the piece that draws the cameras. The auditor track is the piece that resembles logs.

The House text is heavier than the nickname. Covered firms are those that take in at least $500 million a year from the technology. A “covered incident” includes unintended conduct that kills at least 10 people or does at least $100 million in damage, plus loss of control and any attempt by the system to hide from a monitor or a shutdown. Operators would have 15 days to report. The secretary of homeland security would have 90 days to write the first rules, then update them each year. Ordinary breaches can cost $2 million a day. Defying an emergency shutdown order can cost $20 million a day. Personal, academic and non-commercial use is carved out.

Even that bill is still a shutdown statute with a reporting clause. It does not, on its face, give local police a window into a fraud model the way Gates described. Hochul’s version is thinner still. She has not adopted a switch. She has said she will look at one.

Nuclear Talks Were the Easy Comparison

Welker asked whether Cold War limits on nuclear arms are a template for a U.S.-China deal on AI. Gates said yes, then immediately said this is harder. “This is more difficult than that was.” Nuclear work, he said, had fissile material you could count and tasks you could see. AI does not offer that kind of object.

He still wants Washington to lead the way it once did on aviation safety, the ozone layer and nuclear weapons, “in a way that was benign,” with friends pulled along. He rejected the claim that China would refuse safeguards. “Certainly, all countries should want the safeguards in place. So anyone that says, ‘Well, you know, China won’t put these safeguards in place,’ I totally disagree with that.” He said he expects Beijing does not want bioterror or big attacks by nongovernmental actors either.

Then came the price tag he put on the same project. Required monitoring “will be a little bit of overhead for the industry, but not a dramatic slowing of what they’re doing.” He said the work “won’t slow things down in a meaningful way,” and that the only real choice is whether to install the safeguards before large cyber-attacks or bio-attacks, or after. “It’s the world’s most obvious thing.”

Those lines sit in one interview. A global bargain harder than nuclear talks. A death scale he put at a billion. A compliance cost he described as a little overhead. He can mean that logging is cheap relative to a pause, and still mean that a treaty is hard. Listeners who heard only the death number, or only the shrug about overhead, heard half the tape.

The short clip that spread on Sept. 25, two days before the full airing, was the billion-death sentence with the mechanism cut off. Replies treated the warning as a character test. The same interview had already answered the obvious next question, the one about how such a toll would arrive: fraud at scale, a grid taken down, bank records scrambled, small groups using models for work that used to need a state’s cyber team or a bioweapons lab. “There’s never been a weapon as powerful as the combination of people with ill intent using the latest AI tools.”

Anthropic Is Paying Accenture to Sit Inside

While governors wrote shutoff language, one frontier lab bought a different product: people in the building. On Sept. 18, the same day as Newsom’s order, Anthropic said it was partnering with Accenture on independent evaluation of frontier AI. Faculty, Accenture’s specialist AI unit, will lead the work. The evaluators are meant to have employee-level access inside the company, so they can watch models in training, follow deployment choices and talk to staff, rather than score a finished system from outside.

WHAT THE ACCENTURE DEAL SETS UP

• The money: Anthropic and Accenture each expect to invest at least $1 billion over five years to build evaluation capacity, a figure for staff and tools, not a published fee.
• Who pays whom: Anthropic will fund Accenture’s work directly for this first programme, because there is still no pooled or government pot for independent evaluation.
• The limit: Anthropic says the outside team does not reduce the lab’s own duty; model safety “remains our responsibility.”
• The next names: The deal is non-exclusive. Anthropic says it is talking with METR and other nonprofit testers about separately funded pilots, and that more evaluators will be named.

There are still no shared rules for what an embedded evaluator may see or how it must report. Anthropic said so in the same post. That is the hole Gates wants politicians and police to fill. A consultancy on a lab badge can red-team a model. It cannot, by itself, open a log for a detective after a transmission shutdown. The market that formed in September is a paid inside auditor. The statute Gates asked for is a duty to keep records the state can read.

Trump Said Gates Went the Other Way

Gates went out of his way not to pick a fight with the White House. Trump had already called AI-danger talk a hoax and written, “WHOEVER WINS AI, WINS!” Gates’s reply to Welker was, “It’s not a hoax at all.” He also said Trump’s first reaction was “fine,” and that after Trump hears from him and others, including the claim that safeguards do not hobble a nation-state race, “we will come to a consensus.” He wants a meeting. He said he would not walk in asking for a slowdown. He would ask for a requirement on all the AIs in the United States.

Two days after the interview aired, Trump was asked about the billion-death line. He said Gates was not saying that anymore. Told that Gates had said it on Sunday, he answered that he did not care what was said on Sunday, because “yesterday he didn’t say that at all. He actually went the opposite.” Gates had not withdrawn the line. He had spent the same broadcast saying the United States can still turn the computers off, and that the immediate mess is criminals using the tools, which is a narrower claim than a rogue machine ending the species, and is still the claim Trump waved away.

Gates left the timing in one sentence. Building the safeguards and the monitoring is a choice, “and the only question is do we do that before or after there’s some large-scale cyber-attacks or bio-attacks.” The switch bills on the table answer a different question, about who gets to pull a plug on a host that has not yet grabbed the machines. The logs he asked for are still optional.