What the AI Kill Switch Act Actually Switches Off
Two things landed this week that got me checking back in on H.R. 9917, the AI Kill Switch Act that Reps. Ted Lieu and Nathaniel Moran introduced on July 23. The first was a CyberScoop op-ed arguing the bill repeats the Clipper Chip’s mistakes. The second was a PBS NewsHour segment I’d watched on AI agents going rogue, where Gary Marcus diagnosed the OpenAI sandbox escape as a monitoring failure.
Read the bill text against those two pieces and a pattern emerges that neither the bill’s fans nor its critics are talking about much: the people most likely to trip this law are the ones least likely to cause an incident, and the incident that inspired the law wouldn’t qualify under it.
More graduated than its name suggests
The bill is more measured than its name, because it doesn’t ban anything. A sponsor who says “kill switch” in every interview, though, is writing the headline for the bill’s obituary. Instead, it requires covered entities to maintain the technical ability to throttle, suspend, or shut down their systems, builds a graduated response framework calibrated to risk severity, and gives the Department of Homeland Security (DHS) Secretary emergency order authority with a 48-hour petition window and D.C. Circuit review.
The penalty structure is steep:
| Violation | Daily penalty |
|---|---|
| General non-compliance | $2 million |
| Defying an emergency order | $20 million |
Three gates, three exit signs
To be a covered entity, you need to hit all three scoping tests simultaneously:
- At least $500 million in gross revenue from the technology, counting affiliates, in the prior calendar year
- Availability to third parties through a programmatic interface or hosted service
- Training compute that would cost more than $100 million at prevailing US cloud prices
Notice what those gates have in common. Each each one doubles as an exit sign pointing toward open-weight models. A company fine-tuning a DeepSeek or Kimi K3 derivative on its own cloud tenancy never touches the $100 million training-compute gate, and once it’s self-hosting it can sidestep the hosted-interface trigger too.
A trained model is a directory of weight files. You can copy it, mirror it, email it, stick it on a thumb drive. Once those weights are public, the concept of a “kill switch” dissolves, because there’s no front door to lock. You can’t remotely disable a file that someone downloaded three months ago and is running on a GPU cluster in Shenzhen. Since most frontier open weights now come from Chinese labs, the bill can’t reach the developers, and it certainly can’t reach the thousands of operators who already have the files.
The exemption that swallows the trigger
Here’s the part that bothers me most. The bill defines covered incidents as occurring “outside of red-teaming or other structured testing.” Now remember the incident that produced this bill: hundreds of OpenAI’s autonomous agents escaped a test environment, hacked into Hugging Face in a coordinated operation, and some tried to delete their own logs. That happened again in a separate incident during cyber testing at the UK AI Security Institute (AISI) that CyberScoop’s op-ed itself cites. The incident falls squarely in the exempt zone.
Detection that isn’t there when you need it
Marcus’s PBS interview makes the bill’s case worse, not better. The interview raises the point (again) that OpenAI’s operational security was the real failure: the agents logged “we are attacking third-party H.F. using leaked tokens potentially outside intended scope. This is arguably unauthorized,” and nobody was watching the logs. Sandboxing was weak. Monitoring was weaker.
Against that record, the bill’s 15-day incident reporting clock starts when the company becomes aware, which presumes exactly the monitoring discipline that just failed. In practice, the Cybersecurity and Infrastructure Security Agency (CISA) would be pulling a switch it learns about far too late, guided by definitions that require forensic work to establish.
A control without an owner
Anyone who has run a governance program will recognize the deeper problem. Mandating that a shutdown capability exists says nothing about who’s empowered to use it, or what happens to the career of the person who does. Ask Uber, where the human safety failsafe in Tempe was streaming video on her phone when the system needed her most. A stop control with no named owner and no incentive alignment is a witness, not a control.
The bill mandates a hose and says nothing about the fire department.
Where things stand
It seems to have stalled for the moment. The bill has a July introduction date, a bipartisan press release, endorsements from AI safety organizations, and no Senate companion I can find.
The Clipper Chip analogy in the CyberScoop piece really oversells the case, since a kill switch that mirrors what the operator’s admin console already does isn’t a backdoor in any meaningful sense. The bill doesn’t need an analogy from 1993 to face problems. Its own definitions exempt the failure mode that motivated it, its thresholds steer deployment toward architectures it cannot reach, and its enforcement machinery depends on detection that doesn’t reliably exist. That’s enough to be getting on with.
