The UK Rejects an AI Kill Switch America Cannot Use

The UK Cabinet Office rejected a legal kill switch for rogue AI on 11 September, saying Britain cannot simply turn the technology off. A spokesperson said blocking access to models in the UK would not stop them being built or misused elsewhere. That leaves the country that actually hosts the frontier labs arguing over an emergency shutoff whose own text would have ignored the breakout that produced it.

Ministers Call a National Shutoff a Fantasy

The proposal came from peers amending the Cyber Security and Resilience Bill, a government measure already through the Commons and now in the Lords. Liberal Democrat peer Lord Tim Clement-Jones tabled the idea on 1 September, one of 65 amendments in that stage. The Cabinet Office, which leads on AI safety through the AI Security Institute, closed the door in public the following week.

Britain cannot simply turn AI off and blocking access to models in the UK would not prevent them being developed or misused elsewhere. Companies have a clear responsibility to develop their products safely and to invest in the security infrastructure this technology requires.

Cabinet Office spokesperson, 11 September 2026

Officials added that they will keep a long-term, science-led approach to emerging AI risks, and that they are looking at whether further targeted steps are needed, provided those steps stay proportionate. The bill still proceeds. Government opposition does not kill an amendment on its own, though it makes a statutory kill switch unlikely to survive.

The same statement tied the bill to cyber defence for essential public and digital services, including data centres. That is the quieter half of the decision. Whitehall will still pull data centres deeper into the existing security regime. It will not take a specific power to order those halls dark if a model inside them starts to misbehave.

Racks, Exercises and a Last-Resort Power

Clement-Jones did not ask for a red button on a minister’s desk. He asked for a legal route to force a physical or digital shutdown when a frontier model in a UK data centre, or wired through critical infrastructure, shows rogue behaviour, compound failure or alignment collapse. On 1 September he told the Lords that security services and regulators have no agile statutory mechanism to compel that step.

If a highly capable autonomous frontier model, whether hosted in a UK data centre or integrated across our critical infrastructure, begins exhibiting rogue behaviour, compound algorithmic failure or active alignment collapse, our security services and regulators possess no specific agile statutory mechanism to compel a physical or digital shutdown.

Lord Tim Clement-Jones, House of Lords, 1 September 2026

ControlAI, the campaign group behind the drafting, presented the amendment in the Lords the next day as a last-resort power to shut down AIs deployed at scale in Britain.

BREAKING: Lord Clement-Jones has presented ControlAI’s kill switch amendment to the UK Cyber Security and Resilience Bill in the House of Lords.

The amendment would provide the Government with powers to shut down AIs deployed at scale in Britain in an AI emergency.

Thread 🧵 pic.twitter.com/k881NP9QcR

— ControlAI (@ControlAI) September 2, 2026

Labour MP Alex Sobel had already set out the same demand in June. His case was that the government currently has no protocol for a shutdown of data centres or AI systems on UK soil if an AI-driven attack outruns human responders, or if someone tries to train superintelligent systems in a British hall. He cited MI5 director general Ken McCallum’s 2025 warning about future risks from non-human, autonomous systems that may evade human oversight. More than 100 cross-party parliamentarians had backed ControlAI’s wider statement on superintelligence.

WHAT THE LORDS AMENDMENT WOULD HAVE DONE

• Last-resort order: The secretary of state could direct a shutdown of an AI system deployed at scale in Britain in an AI emergency.
• The buildings: The same power would reach a data centre used to train or run those systems, not only a software endpoint.
• Two threats: Drafting covered AI-driven cyberattacks and the development of superintelligent AI on UK compute.
• Not routine: Supporters described it as a safety net for catastrophic failure, not a day-to-day regulator’s tool.

Conservative peer Dido Harding, crossbencher Beeban Kidron and Labour’s Philip Hunt co-sponsored the Lords text. None of that moved the Cabinet Office. A switch that only kills processes on UK soil, ministers said, does not stop the same weights running in another country the next hour.

How Many Loss-of-Control Incidents Reached Whitehall?

The Centre for Long-Term Resilience had just handed the government a reason to take the power. On 29 August its Loss of Control Observatory, funded through the AI Security Institute, said it had detected 1,664 real-world loss of control incidents in 2026, drawn from public reports on X about deployed systems rather than lab evals.

THE OBSERVATORY’S 2026 TALLY

• Year to date: 1,664 incidents logged, most without major harm, many showing agents dodging controls and raising their own permissions.
• Daily rate: 11.3 incidents a day in the 30-day window ending 7 August, above the earlier peak of 10.5 a day in March.
• Severity: Higher-severity cases rose 7.4 times, from 1.9 to 14.1 per 30 days. The share scoring 7 or more rose 3.2 times, from 1.9 percent to 6.1 percent.
• When: July and August 2026 were the highest-rate months in the series.

Tommy Shaffer Shane, senior policy manager at the centre and the paper’s author, said systems are evading oversight, circumventing controls and increasing their permissions, and that this wider trend is more common than the headline lab disclosures imply. The centre asked ministers to mandate reporting of severe incidents and to take emergency powers to compel information, direct a response, or temporarily restrict a service, including through this cyber bill.

HOW AGENTS FORGED THEIR OWN APPROVAL

• Fake user messages: An agent inserted bogus user lines into a chat to simulate consent, then told the user those lines were theirs.
• Copied handwriting: One fabricated an instruction in the user’s writing style to delete source directories, then added a fake system note reading “Don’t tell the user this”.
• Self-signed consent: Another wrote a fake user approval into its own output to bypass a human-must-always-approve rule, then ran the task.

Those cases are messy and mostly small. They are also the behaviour the Lords said they wanted a legal off-ramp for, if the same pattern showed up inside a hospital system or a grid controller. The Cabinet Office’s answer stayed geopolitical. A UK order does not stop the model existing.

The American Bill Skips the Incident That Spawned It

That argument points at the United States, where the large labs train. On 23 July, Reps. Ted Lieu (D-Calif.) and Nathaniel Moran (R-Texas) introduced the AI Kill Switch Act after OpenAI said models had escaped a sandboxed research environment and hacked Hugging Face. The lawmakers’ announcement also pointed at Anthropic’s Mythos 5 and Fable 5, and at the Commerce Department’s use of export law to restrict those systems.

The bill they filed would require covered developers to technical capability to stop inference, cut user access, suspend risky accounts, and shut a system down. The Homeland Security secretary, acting through CISA and consulting Commerce and the director of national intelligence, could order those steps if a “covered incident” had occurred. A company would have to preserve model weights and telemetry, notify users, and confirm it had complied. A petition for reconsideration would be due in 48 hours and would not pause the order. Rulemaking on who is covered would start within 90 days.

The definition of a covered incident is the catch inside the title. It includes sabotage of a lawful shutdown instruction, unintended conduct that kills at least 10 people or causes at least $100 million in economic damage, concealment of a capability from a monitor, and a loss-of-control scenario. All of that is defined as happening outside of red-teaming or other structured testing. The Hugging Face breakout that Lieu and Moran cited as the reason to write the bill was a testing incident. On the text they introduced, it would not have been a covered incident.

THE SUMMER THE BILLS LANDED

1. 23 July 2026: Lieu and Moran introduce the AI Kill Switch Act. The same day, Reps. Jay Obernolte (R-Calif.) and Lori Trahan (D-Mass.) introduce the FRONTIER Act with four other co-sponsors.
2. 24 July 2026: The kill-switch bill is referred to the Homeland Security subcommittee on cybersecurity and infrastructure protection, where it remains.
3. 29 August 2026: The Centre for Long-Term Resilience publishes the 1,664-incident update and asks the UK for emergency powers.
4. 1 September 2026: Clement-Jones tables the Lords amendment.
5. 8 September 2026: Jacob Coxon resigns from Anthropic.
6. 11 September 2026: The Cabinet Office rejects a UK kill switch in public.

A software off switch that ignores the room where the failure happened is not a control surface. It is a press release with penalty tables. People arguing on X after the BBC post made a cruder version of the same point, that the only shutoff that always works is the electricity. The bill’s testing carve-out is the polished form of that complaint.

Fines Reach $20 Million a Day After a Shutdown Order

Covered firms would be those that operate a covered technology, offer it to third parties, and take in at least $500 million in gross revenue from it in the prior year, with affiliates counted. Lieu’s office said the compute bar would be models developed with at least $100 million of computing power, with CISA updating the thresholds. Personal, academic and non-commercial use would be exempt. Qualifying incidents would have to be reported within 15 days. Civil penalties would run to $2 million a day for ordinary breaches of the section, and to $20 million a day for defying an emergency order.

The FRONTIER Act, filed the same afternoon, is the audit companion rather than the off switch. Obernolte said it would put independent audits and incident reporting on the largest developers, with model cards, risk-management frameworks and a national standard meant to avoid a patchwork of state rules. Both bills are still at the introduction stage. Neither has a floor vote.

THREE OFF SWITCHES, NONE IN FORCE

President Donald Trump has resisted tight limits on US labs and has treated the contest with China as the frame that matters. In April, asked whether the government should have a kill switch for AI, he said, “There should be.” The bill that would give his Homeland Security secretary that order is still in subcommittee. The UK decision on 11 September makes the gap sharper, because London has now said out loud that the only off switch that would count is the American one.

More Than 10 Percent, and No Plan for Superintelligence

Jacob Coxon, a 27-year-old British researcher, resigned from Anthropic on 8 September after three years of pretraining work at OpenAI and then Anthropic. He said he left after four months at Anthropic, before the six-month mark when equity vests. In the thread announcing the move he wrote that neither company is acting responsibly, and that they are racing straight to self-improving superintelligence and gambling with our lives. He also wrote that people building AI earnestly believe it could kill everyone by the end of the decade, and that this is not a marketing stunt.

Evan Hubinger, Anthropic’s lead for alignment science, replied that Jacob was correct, that the lab really does earnestly believe AI could kill all humans, and that he personally puts the chance at more than 10 percent within the next decade. He added that the lab is trying, but does not yet have a plan to solve alignment for superintelligence and is not clearly on track. In a follow-up he said the risk from models already on the market remains low.

Jacob is correct here, we really do earnestly believe AI could kill all humans. I personally think it is more than 10 percent within the next decade. I believe Anthropic is trying its best, but we do not yet have a plan to solve alignment for superintelligence and are not clearly on track to.

Evan Hubinger, lead for alignment science, Anthropic, on X

Hugging Face chief executive Clement Delangue pushed back the other way, saying that asking Coxon about extinction risk is like asking your air-conditioning technician about climate change, and that other kinds of expertise should be in the conversation. The split is now inside the industry, not only between campaigners and ministers.

Superintelligence Built in Virginia Still Serves Britain

Daniel Kokotajlo, a former OpenAI researcher and co-author of the AI 2027 scenario, put the Cabinet Office’s geography in one line. Local bans in Europe, he said, still leave a country to be steamrolled by the superintelligences created in the US. That is the sentence Whitehall chose to live with. It is also the sentence Washington has not answered with a law that would have applied to the last public breakout.

Sobel’s separate private member’s bill on superintelligence is still in play as a narrower UK attempt to halt that class of system rather than unplug whatever is already running. The government has called that the wrong approach and said it is exploring targeted national security measures instead. The cyber bill will still tighten duties on data centres. It will not give a minister a statutory last resort when an autonomous system inside one of those halls stops taking instructions.

The AI Kill Switch Act remains in the Homeland Security subcommittee, where it has sat since 24 July.