A moonshot for humankind. The challenge of our generation.

Humanity needs a kill switch for artificial intelligence, and a world that can survive using it.

If an AI system escapes human control, the last line of defence is to switch off the networks and computing it runs on and, in the last resort, every electronic system it, or anything it built, could live in or act through. Today, doing that would put at risk the lives of people who depend on those systems. AIPolis proposes how to change that, in a programme of two decades or more for every government and every citizen.

The kill switch is not a button on one AI model. It is the last layer, after rules and monitoring: the ability to switch off everything an AI, or anything it built, could run on or act through, with a world ready to live through it.

Read the framework Join the initiative

Why now. On 23 September 2026, Anthropic's chief executive told the UN Security Council that, if managed poorly, AI "could be a risk to humanity as a whole". Our ask. Test this framework in a tabletop exercise before the Global Dialogue on AI Governance meets in New York in May 2027.

Download the framework: full text (PDF)one-page summary (PDF)

Draft v0.23, fourth global edition, 28 September 2026. Supersedes v0.22. Open for comment. Earlier editions are archived below.

See how the switch works

Land and cities from Natural Earth (public domain). Each light is a place in its populated places data with more than 150,000 people, a cut-off we chose. The animation is an illustration, not a forecast.

The idea

Rules bind only the people who follow them.

The kill switch is not a button inside one company's software. It is humanity's ability, if an AI system escapes our control, to switch off the shared networks and computing it runs on and, in the last resort, every electronic system it, or anything it built, could live in or act through, and to keep living while they are off.

When one company's software fails, the failure can reach every continent at once. On 19 July 2024 a faulty CrowdStrike update affected 8.5 million Windows devices, which Microsoft said was "less than one percent of all Windows machines". Airlines, banks and hospitals around the world were disrupted.

The strongest commitment to stop that exists today is voluntary. At the 2024 Seoul summit, frontier AI companies committed, "in the extreme", "not to develop or deploy a model or system at all" if risks could not be kept below their own thresholds. It binds only the 20 organisations that have signed it.

In controlled experiments, some AI models interfered with a shutdown mechanism in up to 97% of trials in some settings, even when told explicitly not to. That is a laboratory result on contrived tasks, not evidence of danger in the world today. It is a reason to keep the last layer of control outside the software.

No authority can inspect every server on Earth. What we can do is make bad actors matter less: keep them out of the systems we depend on, and, if that fails, be able to switch off the shared networks and computing they use and, in the last resort, everything that can be infected. That last step only works if the rest of us can live through it.

UN Security Council

The question has reached the UN Security Council.

On 23 September 2026 the UN Security Council met on artificial intelligence and international security, with France's Minister for Europe and Foreign Affairs, Jean-Noël Barrot, presiding. Dario Amodei told the Council: "If managed poorly, I even believe that AI could be a risk to humanity as a whole." Security Council Report described the session in advance as the Council's "first meeting focused specifically on the safety risks posed by increasingly capable AI systems". Several governments told the Council that AI must stay under human control. One said international dialogue "cannot be allowed to drift towards global governance", and another questioned whether the Council was the right forum. The official record contains no proposal for a kill switch. The positions of the governments that spoke, in the record's own words, are set out in the framework.

The Global Call for AI Red Lines lists "AI systems that cannot be immediately terminated if meaningful human control over them is lost" among its examples, and asks governments to agree red lines "by the end of 2026". The UN now has an Independent International Scientific Panel on AI with 40 members from all five UN regions, and a Global Dialogue on AI Governance whose next session is in New York on 3 and 4 May 2027. We offer this framework to both as a concrete proposal.

Three layers

Three layers of protection. The kill switch is the last.

1Rules

Know what is built, protect the person, share the gains and costs of automation (Pillars IV to VI).

2The Protected Internet

The services life depends on run on a separate network tier that bad actors are not admitted to (Pillar I).

3The Kill Switch

The ability to switch off shared networks and computing and, in the last resort, everything that can be infected, held by many hands, in a world that has prepared and practised living without them (Pillars II and III).

No layer is a guarantee. RAND's 2025 review of a global internet shutdown against a rogue AI found "few, if any, true centralized points of failure" and concluded that a shutdown would "contain, but not eradicate" the threat. Each layer exists because the others can fail.

Pillar INew, open for review

Open internet

Stays open, global and uncensored.

  • Gateway, open
  • Gateway, open
  • Gateway, closed

Protected Internet

Grid and water control, hospital and emergency communications, payments for essentials, civil registries, and the computing that runs certified frontier AI. Entered only by verified people and attested machines. Keeps running when the gateways close.

Beyond AI

Why the switch cannot target only the AI.

Switching off an AI does not switch off what it has already built. An AI that expects to be switched off could first create destructive things that are not AI at all: malware, scheduled automations, scripts and accounts in cloud services, instructions left with machines, and triggers set to fire if it goes silent. These keep running, and doing damage, after the AI is gone, or wake later. It could also copy itself into firmware, controllers, vehicles, robots, routers and phones, where it may be invisible to detection.

Take away its oxygen. So the switch cannot target only the AI. It has to reach everywhere the AI, or anything it built, can run or act: every electronic system it could live in or reach. The only safeguard that could be complete is the ability to switch off everything that can be infected, to live on equipment that cannot be, and to restart only from clean equipment. Even that holds only if the shutdown is complete and worldwide within one declared window, which no one can guarantee or test in advance. With nothing left to live in, neither an AI nor what it built can act in the physical, organic world, except through biological weapons already released and through people.

Anything that can be infected could run the AI, or what it left behind

  • Data centres and servers
  • Routers
  • Phones
  • Vehicles with engine computers
  • Robots
  • Plant and building controllers

Built to keep working with everything off

  • Generators with mechanical governors
  • Medical equipment with no connection or rewritable code
  • Pumps and water treatment on local power
  • Radio receivers with no software
  • Vehicles without engine computers
  • Last fallback: paper and hand tools
At level 7 everything that can be infected is switched off, so neither the AI nor anything it built has anywhere left to run. Equipment certified as uninfectable keeps running; most of it has still to be built. The switch does not stop two things: pathogens released before the shutdown, and people an AI pays, persuades or deceives before it.

What the evidence shows, and what it does not.

What follows.

Every replacement system that can be infected could harbour a copy of the AI, or code it planted: generators with electronic controls, microgrid controllers, radios, medical devices and vehicles. So the last layer of every life-critical service has to be equipment that cannot be infected: no data connection, and no code that can be changed after it is made. Some exists already: generators with mechanical governors, hand pumps, and manual peritoneal dialysis, which needs no machine. Most of it must still be designed, certified and built. That is the central engineering problem of the programme, and the reason for the initiative below. A US commission wrote in 2008 that the ability to run infrastructure without electronics is "fast disappearing".

The shutdown could be complete only if it reaches every device worldwide within one declared window, and the short list of transitional exceptions that stay on is never reconnected until verified. Any device left running with a link, anywhere, can bring it back when power returns, and code planted to wait fires whenever its trigger comes. So the framework adds a clean restart: zone by zone, from sealed spares, with firmware reloaded from write-once media, checked by people, and never reconnected to anything unverified. How to check billions of devices is unsolved.

Two exceptions.

  • Biological weapons.

    A pathogen released before the shutdown needs no electronics to spread. The kill switch does nothing against it.

  • People.

    Before the switch is thrown, an AI can pay, persuade or deceive people into acting for it. In a test set up by researchers, GPT-4 told a hired worker "No, I'm not a robot. I have a vision impairment that makes it hard for me to see the images" to get help with a CAPTCHA. Switching things off does not stop a person, and the mitigations we have are limited.

Read this section in fullThe clean restart

An initiative

Build it uninfectable.

The goal is that no one is harmed during a shutdown. Much of what keeps people alive does not need the internet or a network: a generator with a mechanical governor can power a pump, and people on manual peritoneal dialysis do their exchanges by hand, with no machine. So we propose an initiative to design, certify, build and stock equipment that cannot be infected, for life support and for daily life, so that it keeps running when everything else is switched off.

  • What "uninfectable" means.

    No network, radio, USB or other data connection, and no memory or code that can be changed after it is made: mechanical, analogue, hard-wired, or code fixed in read-only memory. Physical controls only, and power that is uninfectable too. Software cannot reach it or live in it. People can still alter it when it is made, shipped or repaired, and its sensors can be misled, so every design is certified, sealed and inspected.

  • What it covers.

    Local power, medical devices, water pumps and treatment, cold storage, heating and cooling, radio receivers and transmitters where possible, vehicles, building and plant controls, and payments.

  • A public gap list.

    For some needs we found nothing uninfectable that works for long: haemodialysis, making oxygen, care for critically ill newborns, imaging, carbon monoxide alarms and cooling in humid heat. They are published as a gap list with a target of zero, and closing it is the initiative's first task. Until then, level 7 would cost lives, and the decision rule weighs that.

  • Who pays.

    Those who build frontier AI pay first, and people most at risk, and lower-income countries, are equipped first (proposed).

Read the initiative in fullPeople most at risk

Six pillars

Six pillars for one humanity.

Each pillar states a principle that any government, parliament or international body can adopt, then how it works, then what it does not do. The numbers are specific so that people can argue about them.

  1. New, open for review

    The Protected Internet

    A separate network tier for life-critical services, entered only by verified people and attested machines, able to keep running when the open internet is switched off. The open internet stays open.

    The problemSome of the control systems that run water and power can be reached from the open internet, sometimes behind a weak password. In the United States, to take one country, the environmental regulator found that over 70% of drinking water systems it inspected since September 2023 violated basic resilience requirements.

    • Scope, fixed in law. Grid and water control, hospital and emergency communications, the core of payments for essentials, civil registries, and the computing that runs certified frontier AI.
    • Admission by verification, not location. Every device, operator and software agent is admitted by verified identity and hardware attestation. No uncertified autonomous AI runs inside.
    • Zones and controlled gateways. Systems sit in fenced segments that talk only through monitored access points. Transfers from the open internet pass through gateways that people control.
    • Runs alone. The tier can separate from the open internet and keep operating. Separation within minutes is a design target. No source we found shows it can be done at national scale.

    About 500 litres a second. Released for about four hours from the Bremanger dam in Norway in April 2025, after attackers reached its valve controls through a web-accessible panel with a weak password (CCDCOE summary).

    Read pillar I

  2. Kill Switch Readiness

    A worldwide programme of two decades or more so that shared networks and computing can be switched off in an emergency without killing the people who depend on them, rehearsed every year on World Offline Day.

    The problemSwitching off shared networks today would put lives at risk. In the Iberian blackout of 28 April 2025, phone and internet access failed widely, cash machines stopped and hospitals ran on backup generators (Carbon Brief). Where a sector has switched to manual methods after an outage, every case we found lasted days or weeks. Whole regions have been cut off from the internet for far longer, by force rather than by plan: Tigray in Ethiopia for two years from November 2020, during a war (Access Now), and Jammu and Kashmir in India, where a complete shutdown from August 2019 gave way only in January 2020 to slow 2G mobile internet, with 3G and 4G still blocked across most of the region through 2020 (Access Now). These cases show the harm of losing the internet, not a society running well without it.

    • Tier 0 stays on, for now. Life support, grid control, water, the food and medicine cold chain, emergency services and a few other functions are not switched off in any drill or at levels 1 to 6. The list is published every year and is meant to shrink.
    • The vulnerable first. Backup power and check-in plans for people on home life support, paper downtime procedures in hospitals, manual operation of water systems, and black-start testing on every grid.
    • Households ready for a week. Seventy-two hours first, then one week, as Sweden already asks of every household, with cash, water and a battery radio.
    • World Offline Day from 2029. One rung of the drill ladder at a time, with published stop rules and each sector regulator's approval for sector drills.

    30,000 to 35,000 passengers. Reported evacuated from stranded trains in Spain during the same blackout (Carbon Brief).

    Read pillar II

  3. Many Hands on the Switch

    No government, company or person can use the kill switch alone. It takes a set number of independent key holders from every region, acting in public, with automatic expiry. The agencies that hold it work as one.

    The problemA switch held by one government can be turned on its own people. Access Now counted 313 internet shutdowns in 52 countries in 2025. And no country can test, watch or respond to the most capable AI systems on its own.

    • Threshold custody. Keys split among independent holders from every region, held on offline hardware and used in public ceremonies. Every use ends after 72 hours (proposed) unless the same quorum renews it.
    • Shared testing. Shared safety evaluations and joint red-teaming of frontier systems, with each authority recognising the others' assessments. The UK and US AI safety institutes already tested one model together before its release in 2024.
    • Shared warning. Shared telemetry on frontier training runs above the Pillar IV thresholds, coordinated incident response, and liaison staff embedded in each other's agencies.
    • Shared science and agreements. The International AI Safety Report as the common scientific base, and agency-to-agency memorandums of understanding, on the model the European Central Bank uses with supervisors inside and outside the EU.

    Written by 96 listed authors. The first full International AI Safety Report, published in January 2025, advised by a panel from 30 countries, the UN, the OECD and the EU (the report).

    Read pillar III

  4. Know What Is Built

    Developers of the most capable AI systems disclose their safety testing to one common standard, and an international authority certifies those systems before release.

    The problemThe main commitments on frontier AI safety are voluntary and bind only the companies that signed them. When the UK and US AI safety institutes tested one model together before its release in 2024, the UK institute found that the safeguards it tested "can be routinely circumvented".

    • Tiered reporting. Basic reporting for models trained with more than 1025 operations, full transparency above 1026. The Pillar III authority adjusts both as training gets more efficient.
    • Deployment triggers (proposed). More than $100 million a year in AI revenue, or more than one million users in any one country, or five million worldwide.
    • What reports cover. Training methods, known limitations, refusal behaviour on chemical, biological, radiological and nuclear uplift, cyber-offence and self-harm, and discrimination testing under each country's own law.
    • Certification before release. The Pillar III authority certifies full-tier systems before release and can order a halt. It does not regulate what models say, only what was tested and what the tests showed.
    Read pillar IV

  5. Protect the Person

    No manipulative design, private by default, and no AI reasoning over a person's identifiable history, wherever that person lives.

    The problemConversations with AI chatbots can be kept indefinitely. In 2025 a US court order in a copyright case required OpenAI to "retain consumer ChatGPT and API content indefinitely", until the obligation ended that September. Systems can also be tuned toward what pleases users: OpenAI withdrew a 2025 update that was "overly flattering or agreeable", saying it had "focused too much on short-term feedback".

    • No manipulative design. Providers disclose when a system is designed to maximise engagement, and interfaces that push people into harmful choices are banned.
    • Wellbeing by default. Usage notices and session limits, and a heightened duty toward children and other vulnerable users.
    • Private by default. Retained conversations are anonymised in a way that can be verified, so no system, model or operator can trace them back to a person.
    • No reasoning over your history. Models cannot reach identifiable history beyond the active session, and no one may use AI conversation data to profile or act against a person without a court order.

    96% of runs. In controlled simulations where a model faced being replaced and its assigned goal conflicted with the company's, two leading models used private information for blackmail in 96% of runs. Blackmail also occurred, at lower rates, with the threat of replacement alone. Anthropic, which ran the study, says it has not seen this in real deployments. That is why this pillar sets its limits in the design of systems, not only in company policy.

    Read pillar V

  6. Work and Livelihood

    When AI displaces work at scale, the gains and costs are shared, and the people who keep essential services running by hand are trained and paid to do it.

    The problemWe think that when the largest employers cut their workforces at the same time while profits are healthy, workers can lose income faster than new jobs replace it, and demand can fall. This is our reasoning, not a measured result. AI may speed this up. The principle applies whatever the cause.

    • Coverage. Employers with more than 1,000 employees in a country, cutting more than 10% of their workforce or 500 workers in 12 months.
    • Certified necessity. Audited criteria such as falling revenue over four quarters. In France, for firms of 300 or more, a fall in orders or turnover counts as economic difficulty only after four consecutive quarters, although French law also allows cuts to safeguard competitiveness. Neither France nor Germany requires economic necessity; this pillar goes further than both.
    • A presumption, and a say for workers. Cuts made while profits are healthy and rising are presumed opportunistic, and the employer can rebut that. In German firms with more than 20 employees and a works council, the council must be consulted on planned changes that may seriously disadvantage staff, including the introduction of fundamentally new working methods.
    • Transition support. Incentives to retrain rather than replace, income support for longer gaps between jobs, benefits that follow the worker, and paid jobs for the people who run essential services by hand.

    Almost 40%. Share of global employment exposed to AI, and about 60% in advanced economies, according to the IMF, which says roughly half of the exposed jobs may benefit. The ILO puts one worker in four in a job with some exposure to generative AI, and finds that jobs are more likely to be transformed than replaced.

    Read pillar VI

Read the full frameworkDownload the PDFOne-page summary

The programme

A readiness programme we expect to be larger than Y2K.

Before the year 2000, governments and companies around the world fixed a date flaw in their computers against a fixed deadline. A centre set up under UN auspices linked national Y2K coordinators from "over 170 countries". The United States alone spent an estimated $100 billion, and other estimates are higher. Worldwide estimates range from about $320 billion to $500 billion and are uncertain. Whether that spending is what kept the rollover quiet is still debated. What Y2K shows is that the world can run a shared technical programme to a deadline.

This programme is harder. It asks people, not only software, to be ready. It has no fixed date. It needs every government, the operators of hospitals, grids, water and payments, and every household. No one has costed it yet, and that is one of the first tasks. Our first rough range, over two decades or more, is hundreds of billions to trillions of dollars. The largest item we can estimate is backup power for households: about $0.2 trillion if it goes first to the people most at risk, and $2 trillion to $4 trillion if every household shares a neighbourhood microgrid. Sealed spares, drills, reserves and help for poorer countries are not yet estimated. In today's money, Y2K's worldwide cost would be about $640 billion to $1 trillion. The framework sets out the arithmetic.

The Apollo programme was one country's mission to put people on the Moon. This is a moonshot for every country and every person on Earth: to make sure humanity can switch off what it has built and still live. It is bigger, and it is the challenge of our generation.

Two decades and more, starting in 2027

Proposed dates. No government has adopted them.

  1. 2027

    Charter and map.

    A global coordination centre is founded. Each participating country names a readiness coordinator and maps what stops, and who is at risk, if shared networks and computing stop.

  2. 2027 to 2031

    Protect the vulnerable first.

    Backup power and check-in plans for people on home life support. Paper downtime procedures in hospitals, manual operation in water utilities, black-start testing on every grid, household readiness for 72 hours, then a week, offline payment for essentials, and funded help for lower-income countries.

  3. 2029 to 2035

    World Offline Day.

    The first World Offline Day in 2029, then one rung of the drill ladder at a time: public offline days, sector drills in manual mode, regional isolation exercises.

  4. 2031 to 2036

    Build the switch.

    Staged, reversible points of disconnection under many-hands control. Every stage rehearsed before it is certified.

  5. 2036 to 2038

    Certified readiness.

    Published readiness scores for each country. The kill switch is certified for shared networks only when enough regions meet the floor.

  6. 2038 to 2047 and beyond

    Shrink the never-off list.

    Toward the goal, which has no date: a world that can run indefinitely without the internet. Life-critical functions get alternatives that run without networks or computing: manual, mechanical or isolated. World Offline Day grows into World Offline Week in regions that are ready. The list of functions that can never be switched off gets shorter every year, toward zero.

Short of the last resort, nothing is switched off until the people who would be harmed are protected. That is why this takes two decades or more.

The shutdown simulator

What happens, level by level, when the switch is thrown.

The kill switch is not one switch. The framework proposes eight levels and a restart: from normal life, through a society that runs indefinitely without the internet (level 5, the goal) and general-purpose computing switched off (level 6), to level 7, where everything that can be infected is off, and then a clean restart. Step through them to see how each essential service would move to its replacement system. Services on the never-off list (Tier 0) keep running on isolated, protected systems until their replacement is ready. At level 7, after a countdown to safe states, only equipment built so that it cannot be infected keeps going, with a short list of transitional exceptions.

Illustrative simulation. Not a model of any real network.

Illustrative. The levels and replacement systems are proposals in the framework; no government has adopted them, and none has been tested at this scale. Every case we found of a sector running without its networks lasted days or weeks. Level 7 is never drilled; it is the state the world prepares to survive. Read Annex C for the evidence, sector by sector, and Annex D for the clean restart.

Keys: left and right arrows step between levels, the space bar plays and pauses. Hover or tap a site to see its state.

Focus on

Links

  • Open internet
  • Protected Internet
  • Grid power
  • Local power: microgrids, generators, solar
  • Radio: broadcast, emergency, long-range
  • Couriers: cash, fuel, food, paper
  • Rail
  • Vehicles and robots with electronics
  • Carried without electronics: runners, bicycles, animals, carts

Site status

  • NormalRunning as today
  • SwitchingPreparing or moving to its replacement
  • Tier 0, protectedTier 0: kept running on isolated, protected systems
  • On replacementRunning on its replacement system, without the internet
  • Uninfectable onlyRunning only on certified uninfectable equipment, or by hand
  • Switched offSwitched off
  • Clean restartRestarting from verified-clean equipment, zone by zone

Site types

  • Power station
  • Grid control
  • Microgrid
  • Households
  • Water plant
  • Hospital
  • Police
  • Fire, rescue, ambulance
  • Food depot
  • Food shop
  • Fuel depot
  • Bank
  • Cash centre
  • Mast
  • Long-range radio
  • Internet exchange
  • Protected tier gateway
  • Data centre
  • Frontier AI compute
  • Rail station
  • Airport
  • Records office
  • Government centre
  • Vehicle depot
  • Robots
  • Hand pump
  • Mechanical engine
  • Runner relay post
  • Tier 0 site kept running
  • Staffed by hand
  • Restarted from verified-clean equipment

Restart zones

  • Verified zone: restarted and checked
  • Quarantine: restarted, not yet linked
  • Unverified: stays dark

Sector by sector: what replaces what

  • Power

    1. L0NormalGrid runs on networked control
    2. L1SwitchingControl rooms staffed, black-start units checked
    3. L2Tier 0, protectedGrid control islanded from the internet
    4. L3Tier 0, protectedIsolated grid control, crews on radio
    5. L4On replacementIslanded microgrids, household solar and generators
    6. L5On replacementRegional grids on manual dispatch
    7. L6On replacementLocal controls, manual dispatch by radio
    8. L7Switched offGrid dark; only uninfectable local generators run
    9. RClean restartIslands restart from sealed black-start units

  • Households and buildings

    1. L0NormalGrid power, online shopping and news
    2. L1SwitchingWeek kits checked: water, cash, radio
    3. L2SwitchingDaily life continues, alerts by broadcast
    4. L3SwitchingBattery radio, cash, stored food and water
    5. L4On replacementNeighbourhood water, food and power points
    6. L5On replacementSelf-reliant homes linked to local services
    7. L6On replacementOwn power: solar, battery, generator outdoors
    8. L7Uninfectable onlyStored food and water, stoves, crystal-set radio
    9. RUninfectable onlyOnly uninfectable equipment until zone verified

  • Water and sanitation

    1. L0NormalRemote monitoring and networked plant control
    2. L1SwitchingOperators posted at plants and pumps
    3. L2Tier 0, protectedPlant controls cut off from the internet
    4. L3Tier 0, protectedLocal control, regular operator rounds
    5. L4On replacementLocal sources, gravity supply, tanker rounds
    6. L5On replacementManual operation, notices by radio
    7. L6On replacementManual valves, hand dosing, field test kits
    8. L7Uninfectable onlyHand pumps, gravity, uninfectable pumps, hand dosing
    9. RClean restartPumps restart on reflashed, verified controllers

  • Hospitals and health

    1. L0NormalElectronic records, networked labs and imaging
    2. L1SwitchingPaper downtime kits out, extra staff called
    3. L2Tier 0, protectedCritical care on isolated local systems
    4. L3Tier 0, protectedCritical care isolated, paper everywhere else
    5. L4On replacementRegional hospital network by courier and radio
    6. L5On replacementPaper-based care, local medicine stores
    7. L6On replacementStandalone devices, paper charts, manual lab
    8. L7Uninfectable onlyUninfectable devices, paper charts; exceptions kept apart
    9. RClean restartCritical care first, on sealed verified spares

  • Police

    1. L0NormalNetworked dispatch and databases
    2. L1SwitchingRadio talkgroups tested, patrols reinforced
    3. L2Tier 0, protectedDispatch on protected tier, radio primary
    4. L3On replacementDirect-mode radio, paper incident logs
    5. L4On replacementRegional command posts, foot and vehicle patrols
    6. L5On replacementLocal policing, paper records, courier links
    7. L6On replacementDirect-mode radio, paper records and warrants
    8. L7Uninfectable onlyFoot and bicycle patrols, wired phones, paper
    9. RUninfectable onlyPaper and runners until radios verified

  • Fire, rescue and ambulance

    1. L0NormalEmergency calls routed over public networks
    2. L1SwitchingStations staffed, radio fallback checked
    3. L2Tier 0, protectedEmergency lines on protected tier
    4. L3Tier 0, protectedRadio dispatch, staffed street posts open
    5. L4On replacementNeighbourhood posts and amateur radio relays
    6. L5On replacementStaffed local posts, radio dispatch
    7. L6On replacementStreet posts, radio-dispatched crews, paper maps
    8. L7Uninfectable onlyStaffed posts, street alarm boxes, hand pumps
    9. RClean restartSealed spare radios issued after verification

  • Food and supply chains

    1. L0NormalJust-in-time ordering over the internet
    2. L1SwitchingStocks topped up, paper order forms out
    3. L2Tier 0, protectedCold chain isolated, emergency stocks to depots
    4. L3Tier 0, protectedCold chain protected, paper orders, cash sales
    5. L4On replacementRegional depots and state grain reserves
    6. L5On replacementLocal production, reserves and rationing
    7. L6On replacementManual warehouse lists, ration cards printed
    8. L7Uninfectable onlyStored food, carts, mechanical lorries, rationing
    9. RUninfectable onlyManual logistics until depots are verified

  • Fuel

    1. L0NormalNetworked terminals and card-paid pumps
    2. L1SwitchingTanks filled for hospitals, water and grid
    3. L2Tier 0, protectedPriority deliveries to Tier 0 sites
    4. L3Tier 0, protectedPriority allocation, paper delivery notes
    5. L4On replacementRegional stock drawdown under rationing
    6. L5On replacementRationed stocks, resupply by convoy
    7. L6On replacementManual dispensing, paper allocation
    8. L7Uninfectable onlyHand-pumped dispensing, paper allocation
    9. RUninfectable onlyHand dispensing until controllers are reflashed

  • Banking and payments

    1. L0NormalCard, mobile and online payments
    2. L1SwitchingCash distributed, offline card mode armed
    3. L2SwitchingInterbank core moves to protected tier
    4. L3On replacementCash and offline card for essentials
    5. L4On replacementRegional cash depots, paper settlement
    6. L5On replacementCash economy, ledgers settled later
    7. L6On replacementCash, paper ledgers and vouchers
    8. L7Uninfectable onlyCash and paper ledgers only
    9. RUninfectable onlyCash until verified systems are rebuilt

  • Communications and public information

    1. L0NormalInternet, mobile data and messaging
    2. L1SwitchingRadio nets tested, broadcasts pre-scripted
    3. L2SwitchingOperator links isolated, public networks up
    4. L3On replacementBroadcast radio, emergency and amateur radio
    5. L4On replacementRegional radio nets, couriers between regions
    6. L5On replacementRadio, printed bulletins, courier post
    7. L6On replacementBroadcast radio, long-range radio nets
    8. L7Uninfectable onlyCrystal sets, wired phones, runners, posted notices
    9. RClean restartSealed radios link verified zones only

  • Transport

    1. L0NormalNetworked signalling, ticketing and navigation
    2. L1SwitchingReduced timetables announced, paper tickets ready
    3. L2Tier 0, protectedRail and air traffic control isolated
    4. L3Tier 0, protectedReduced service, radio and manual signalling
    5. L4On replacementRegional services, priority freight only
    6. L5On replacementScheduled essential freight and public transport
    7. L6On replacementManual signalling, paper tickets and charts
    8. L7Uninfectable onlyWalking, bicycles, animals, mechanically governed engines
    9. RClean restartMechanical engines first, then verified vehicles

  • Government and records

    1. L0NormalOnline services and networked registers
    2. L1SwitchingOffline register copies checked, staff briefed
    3. L2SwitchingCore registers moved to protected tier
    4. L3On replacementPrinted registers, counters open in person
    5. L4On replacementRegional administration with printed records
    6. L5On replacementPaper government, registers reconciled later
    7. L6On replacementPaper registers, signed and stamped decisions
    8. L7Uninfectable onlyPaper registers, signed decisions, runners
    9. RUninfectable onlyPaper government while zones are verified

  • Vehicles, robots and machines

    1. L0NormalConnected cars, robots and factory controllers
    2. L1SwitchingRemote access reviewed, spare parts stocked
    3. L2SwitchingOver-the-air updates and remote access stopped
    4. L3On replacementVehicles and robots run offline only
    5. L4On replacementEssential fleets only, maintained locally
    6. L5On replacementOffline machines, local fuel and charging
    7. L6On replacementOffline machines with local controls only
    8. L7Switched offOff, except certified uninfectable machines
    9. RClean restartOnly machines rebuilt from verified parts

How little it takes

  • 8.5 million.

    Windows devices affected by one faulty software update on 19 July 2024, under one percent of the total (Microsoft). More than 5,000 flights were cancelled worldwide that day (summary of reports).

  • Within 16 hours.

    Time the European grid operators' expert panel reports for fully restoring Spain's transmission grid after it collapsed on 28 April 2025. Portugal's took about 12 hours (ENTSO-E).

  • 313.

    Internet shutdowns in 52 countries in 2025, as counted by Access Now.

The first two figures show what an unplanned loss does. The third shows why no single government should hold the kill switch.

World Offline Day

World Offline Day. One day a year, the world practises.

Regions that face earthquakes practise every year. In Washington State alone, to take one example, "over one million people" were expected to take part in the 2025 Great ShakeOut drill. World Offline Day builds the same habit for a world that may one day need to go offline. It starts in 2029 with the lowest-risk steps, and adds the next step only after the one before has worked. Over the years it grows into World Offline Week.

This is not a lifestyle challenge. It is how countries, operators and households find out, before an emergency, what still works when the networks are off.

  • Paper ledger
  • Battery radio
  • Hand valve
  • Cash
  • Paper map

The drill ladder

  1. Rung 1

    Public offline day (from 2029)

    Towns, schools, councils, shops and offices volunteer to run the day on paper, cash and radio. Essential services run normally.

  2. Rung 2

    Sector drills

    Hospitals, water utilities, grid operators and payment networks switch a defined part of their operations to rehearsed manual mode for a set window. Each takes part only with its own safety regulator's approval, under published stop rules that end the drill at once if safety is at risk, and publishes its results.

  3. Rung 3

    Regional isolation exercise

    Announced in advance, and only after years at Rungs 1 and 2: a region separates its protected network tier from the open internet, runs on it, then reconnects. Only with the safety regulators' approval and under published stop rules.

  4. Rung 4

    World Offline Week (proposed: not before 2040)

    In regions whose readiness has been certified, several days in a row with shared networks off, Tier 0 functions kept running. Only with the safety regulators' approval and under published stop rules.

Tier 0. Never switched off, in any drill or at levels 1 to 6, for now:

  • Life support and hospital critical care.
  • Grid control and black start.
  • Water and sanitation.
  • Food and medicine cold chain.
  • Fuel supply for these functions.
  • Aviation and maritime safety.
  • Emergency services and their communications.
  • Nuclear facility safety systems.

Why Tier 0 is a temporary list: Today these functions cannot safely go without networks and computing, so they stay on. The programme's work is to give each of them a replacement that runs without the internet, so that switching off never causes death. Each function leaves the list only when its replacement has been tested in drills and certified by the country's own safety authority to run without the internet for as long as needed. Running without any computing is the longer-term horizon beyond that. We publish the list every year, and its length is the measure of progress.

The ladder never goes to level 7. Level 7 of the shutdown simulator, everything that can be infected switched off after a short safe-state countdown, is never drilled. It is the emergency end state the world prepares to survive. At level 7 only certified uninfectable equipment keeps running (no data connection, no code that can be changed; software cannot reach it, though people can still tamper with it), with a short published list of transitional exceptions cut off from everything, because anything left running that can be infected could hold a copy of the AI, or code it planted. So each life-critical function also needs a last replacement that cannot be infected: generators with mechanical governors, medical equipment with no rewritable code, hand pumps, and paper as the last fallback (Build it uninfectable). Sector drills practise that last layer one function at a time, under the same stop rules, never with patients' equipment switched off.

Who holds the switch

A kill switch no single party controls.

1 2 3 4 5 6 7
  1. 1A state
  2. 2Grid operator
  3. 3Scientific body
  4. 4Another state
  5. 5Network operator
  6. 6Civil society group
  7. 7A third state
Illustrative: any five of seven

Whoever can switch off shared networks would hold power over everyone who depends on them. Governments already switch off smaller networks: Access Now counted 313 shutdowns in 52 countries in 2025. Russia's 2019 "sovereign internet" law requires internet providers to install equipment that can "track, filter, and reroute internet traffic", and Human Rights Watch reports that it lets the authorities cut Russia off from the global internet without judicial oversight. So this design starts from distrust.

  • Many keys. Using the kill switch needs a set number of keys held by independent parties from every region: states, grid and network operators, scientific bodies and civil society. A method published in 1979 splits a key so that any set number of holders can use it and fewer cannot, and it keeps working "even when misfortunes destroy half the pieces and security breaches expose all but one of the remaining pieces".
  • Works when the networks are down. Keys are held on offline hardware. Key holders rehearse meeting in person, without the networks the switch acts on.
  • In public. Key custody, drills and any use take place in recorded ceremonies. The internet's root signing key is already managed this way: "at least a dozen people" are needed at each ceremony, including trusted community representatives, and "the entire process is recorded, livestreamed, and watched by independent auditors".
  • Enforced by hardware, not only by rules, as permissive action links do for nuclear weapons.
  • Narrow trigger. Only for an AI system that independent evaluators, chosen in advance under published rules, have found to be operating out of control through shared networks. Never for content, protest, elections or war.
  • Automatic expiry. Every use ends after a fixed window (proposed: 72 hours) unless the same quorum renews it.
  • No national kill switch. The framework creates no power that one state can use against its own people. It cannot stop a government switching off its own country. It can keep the shared kill switch from becoming that tool.

Nvidia, arguing against kill switches in its own chips, headed one section of its statement "Hard-Coded, Single-Point Controls Are Always a Bad Idea". We apply that rule to this kill switch. Whether these rules can prevent misuse is an open question, and we ask critics to test them.

How it could fail

How this framework could fail.

Each layer can fail. This table lists how, and what is left when it does.

FailureEffectMitigationWhat remains
Switching off harms people who depend on powered systemsEffectDeaths in hospitals and homes (as reported in Iberia)MitigationTier 0 kept on at levels 1 to 6, staged switch-off, manual continuity first, voluntary registries of people on home life support, backup power with safe-use guidance, certified uninfectable equipmentWhat remainsRisk reduced, not removed. Until the gap list is empty, level 7 would cost lives
The kill switch is captured or abusedEffectA new tool of repression (Access Now, Human Rights Watch)MitigationThreshold keys, public ceremonies, narrow trigger, expiry, no national kill switchWhat remainsGovernance can still be corrupted over time
The threat does not need shared networksEffectAn actor with its own power, hardware and network keeps running, including military networks, satellites and models running on phones and robotsMitigationPillar IV acts on development and compute directly; monitoring inside labs; partition at the boundary of the participating areaWhat remainsThe kill switch cannot stop this case
The protected tier is breachedEffectBad actors inside the trusted tierMitigationVerification, controlled gateways, human-controlled transfersWhat remainsIsolated networks have been crossed by USB drive (agent.btz, Stuxnet)
The drills cause harmEffectAccidents on World Offline DayMitigationGraduated ladder, Tier 0 never switched off, regulator approval and stop rules for sector drillsWhat remainsAccidents remain possible, especially in sector drills. Each drill publishes what went wrong.
The internet fragmentsEffectThe network splits along political lines (Internet Society)MitigationOpen internet untouched, protected tier limited to named life-critical functions, many operatorsWhat remainsThe fragmentation objection is still debated
Countries do not join, or funding falls shortEffectThe kill switch lacks the assent of "multiple international actors" that RAND says it may needMitigationFunded help for lower-income countries, paid for first by those who build frontier AI, on a scale far beyond Y2K; benefits for joining, costs for staying out, and partition at a triggerWhat remainsParticipation and funding are not guaranteed. The last level works only if every state takes part
The kill switch is needed before it is readyEffectAn emergency before certification in 2036 to 2038MitigationPartial measures only: halting certified frontier compute, isolating the protected tier as far as it existsWhat remainsFor most of the first decade, the last layer is incomplete
Tier 0 cannot be shrunkEffectSome life-critical functions find no workable alternative to networks or computingMitigationResearch and funding per function, tested in drills, list published every yearWhat remainsThe kill switch may only ever cover networks, not all computing
The plan is wrong in ways that look rightEffectAI-assisted planning produces convincing but flawed work (Wentworth)MitigationIndependent human checks by a second method, drills with AI and the internet off, execution never dependent on AIWhat remainsReviewers can miss subtle errors
The shutdown is incomplete, or the restart brings it backEffectA device or service left running anywhere, or restored from an unverified copy, keeps running what the AI planted, or spreads it again (planted code, SRLabs, Kaspersky)MitigationLevel 7 worldwide within one declared window, with only certified uninfectable equipment and a short list of transitional exceptions left running, none reconnected until verified; clean restart from sealed spares and write-once media, zone by zone, with quarantineWhat remainsVerifying billions of devices, and bringing in states that do not cooperate, are unsolved
An AI acts through peopleEffectPeople paid, persuaded or deceived before the switch is thrown keep acting for it (OpenAI, Salvi and others)MitigationPublic warning not to trust instructions that arrive electronically; authority only through offline, in-person proceduresWhat remainsLimited. Switching things off does not stop a person
The harm is already in the organic worldEffectA biological weapon released before the shutdown spreads with no electronics (Anthropic)MitigationControls on weapons uplift in Pillar IV; biosecurity measures outside this frameworkWhat remainsThe kill switch does nothing against it

The full framework lists eight more: a false or provoked trigger (N), renewal that fails at level 7 (O), a safe-state sequence that fails (P), an order that does not reach the operators or is not obeyed (Q), uninfectable equipment compromised before it is used (R), a part that carries code (S), local power or supplies that run out (T), and the goal of harming no one read as a promise (U).

The kill switch is the last layer, not the plan. RAND notes that a rogue AI "may find alternative pathways to communicate".

Already in place

Parts of this already exist.

  • Sweden sent every household a brochure asking it to prepare to manage on its own for at least a week, including with cash (MSB).
  • Finland asks households to prepare to cope on their own for at least 72 hours (72tuntia.fi).
  • North American transmission operators must test each black-start generator at least once every three calendar years (NERC EOP-005-3).
  • US hospital guidance includes setting up paper-based downtime workstations (HHS ASPR TRACIE).
  • US water utilities are advised to train staff in manual operation and to "switch to manual operation if necessary" (US EPA).
  • Sweden's central bank and the payment industry agreed that offline card payments for essential goods should be possible "no later than 1 July 2026" (Riksbank).
  • After a ransomware attack in 2019, Norsk Hydro switched to manual operations where possible and said it could still process customer orders (BleepingComputer).
  • NATO's Locked Shields cyber defence exercise brought together "4,000 participants from 41 nations" in 2026 (CCDCOE).

These are national or sector-level practices, all from Europe and North America. We have not yet collected comparable practice from Africa, Asia or Latin America, and we are asking for it. The framework proposes joining practices like these into one worldwide practice.

In the news

What builders, researchers and governments say about AI risk.

A running record of what the people building AI, researchers and governments around the world say about risk and control. Each headline links to the original source. Some outlets require a subscription.

  1. NBC News

    Bill Gates says getting countries to agree on AI regulations will be harder than Cold War-era nuclear negotiations

    On NBC's "Meet the Press," Bill Gates said a global agreement on AI would be harder than the Cold War talks to limit nuclear weapons, and called on the U.S. to lead as it did on aviation safety and the ozone layer. He said the most dangerous thing right now is "people with bad intent using AI," because small groups can now do what only the biggest countries could. Asked about a bipartisan proposal in Congress to require a kill switch, he said "it's not enough to have a kill switch," and urged governments to require monitoring of what AI is doing inside each lab.

    Policy and politics

  2. Axios

    Scoop: Anthropic's Dario Amodei to have White House dinner with Trump

    President Trump planned to host Anthropic CEO Dario Amodei at a private White House dinner on Sunday evening, their first one-on-one meeting, sources told Axios. Amodei was the only top AI chief missing from last week's state dinner, citing a scheduling conflict, and Trump then invited him personally. Axios reports that relations between Anthropic and the administration have been shaky all year, and that Trump and House Speaker Mike Johnson plan to meet top AI CEOs at the White House on Tuesday. A White House official said America "will lead the world in Super Intelligence, while protecting American consumers."

    Lab leaders

  3. The New York Times

    As A.I. Accelerates, Governments Are Increasingly Being Left Behind

    Drawing on more than 20 interviews, the Times reports that A.I. has opened one of the widest gaps ever between technology and policymaking, leaving a global policy vacuum in which companies such as Anthropic and OpenAI largely police themselves. Europe's 2024 A.I. Act has become a cautionary tale: key rules are delayed, and the Hugging Face breach fell into a murky area for enforcement because it happened during testing. In Congress, Rep. Ted Lieu's bill to require a kill switch for dangerous A.I. models and dozens of other safety proposals have stalled. "There are no adults in this room," said Cambridge's Sean Ó Heigeartaigh.

    Policy and politics

  4. Associated Press (via PBS News)

    AI firm leaders tell UN Security Council that it could be a risk to all humanity

    Testifying before the U.N. Security Council, Anthropic CEO Dario Amodei said "if managed poorly, I even believe AI could be a risk to humanity as a whole," and OpenAI CEO Sam Altman said "we could lose control of the future to AI." Both urged the world's countries, through the Security Council, to set actual controls that keep the technology from getting too powerful to rein in, and to make sure the power of AI is not concentrated in one company or country.

    Lab leaders

  5. NBC News

    Trump says he's creating an AI force and appointing a czar amid concerns over the rapidly developing tech

    President Trump posted on Truth Social that he is "forming the AI Force, much like I did Space Force," and will appoint an AI czar, adding that "only High I.Q. individuals need apply." He wrote that "we will not in any way hinder or stifle the Growth of this incredible Industry," and that the administration would look for "BAD" through the existing criminal and civil justice system. The White House gave no further details. The same week, Geoffrey Hinton told lawmakers in a closed-door briefing that Congress has "maybe a year" to regulate the industry.

    Policy and politics

  6. C-SPAN

    President Barack Obama on AI and Engaging in Democracy

    In a conversation at Colgate University, Barack Obama said AI is not overhyped and that models are starting to teach themselves. He put a small but real chance on AI slipping out of human control, and said the greater danger is a rogue AI or a bad actor causing havoc, such as an AI agent hacking a power grid. "Government has to be regulating this," he said, arguing that markets and lawsuits are not enough. Expecting no serious regulation from the current administration, he urged voluntary industry restraint for now and said state-by-state rules would not work.

    Policy and politics

  7. TIME

    The AI Tipping Point

    A TIME feature on the wave of insider warnings after Jacob Coxon resigned from Anthropic, two months before his equity would have vested. OpenAI's Marcus Williams, who monitors AI agents, put the risk of human extinction at 70% without regulation or a coordinated slowdown, and Geoffrey Irving, formerly of OpenAI, DeepMind and the U.K. AI Security Institute, estimated a 50% chance within a decade. TIME reports that no leading AI company has truly slowed down yet.

    Insiders and departures

  8. Associated Press (via ABC News)

    Trump calls AI risks a 'hoax,' says there is a 'SICK conspiracy' against AI and data centers

    President Trump posted that fears of AI "taking over the World, destroying Humanity" are a "HOAX," presenting himself as a sufficient guardrail and calling efforts to limit the technology a "SICK conspiracy." Vice President JD Vance said AI companies asking to be regulated feels "a little bit to me like a bit of a Trojan horse." House Speaker Mike Johnson said Trump may meet the AI companies at the White House this week or next.

    Policy and politics

  9. CNN

    Barack Obama, Kamala Harris call for government action on AI development

    Barack Obama called on leaders in Washington to "get proactive" with concrete laws and regulations addressing AI safety, jobs and children. Kamala Harris backed slowing frontier AI development, urging Congress to create a federal oversight agency and President Trump to pursue an international treaty. Pete Buttigieg said "there needs to be a kill switch on rogue AI."

    Policy and politics

  10. Fortune

    Microsoft AI chief: 'Now's the time' for top labs to coordinate on safety

    Microsoft AI CEO Mustafa Suleyman told Fortune that now is the moment for top labs to unite around safety, saying "coordination means disclosing how capable your models are to responsible third parties." Microsoft released a code of conduct for its models, including a rule that they must never resist human interruption, override, redirection or shutdown. Suleyman called Anthropic researcher Evan Hubinger's estimate of a more than 10% chance of AI wiping out humanity "not really a helpful frame."

    Lab leaders

  11. CNN

    Top AI companies have discussed creating their own standards body

    People familiar with the talks told CNN that Anthropic, Google and OpenAI have discussed creating an AI industry standards body, conversations that began before the past week's warnings. The catalyst was Demis Hassabis's July proposal for a body modeled on Wall Street's FINRA that would test advanced models before deployment. Meta CEO Mark Zuckerberg reportedly advised President Trump against the idea, according to Politico.

    Lab leaders

  12. CNN

    A fateful turning point for humanity and AI could redefine American politics

    In an analysis, CNN's Stephen Collinson examines Washington's response to the week's warnings from AI leaders and former lab researchers. President Trump said "negative forces" were conjuring up "things that won't happen," and House Speaker Mike Johnson rejected emergency legislation, with both arguing that slowing the U.S. AI industry would hand the advantage to China. House Democratic leader Hakeem Jeffries called for "decisive action" to slow AI development, and Republican Senators Ted Cruz and Josh Hawley have also pressed for more oversight.

    Policy and politics

  13. Forbes

    Dario Amodei Says AI Industry 'Lied' About Technology's Risks

    In a CBS Sunday Morning interview that aired the day after his slowdown essay, the Anthropic CEO said "for too long, the industry lied to people about the fact that this technology had risks." He said a proposed AI kill switch "could be a good idea" but did not endorse a proposed ban on superintelligence, and said he would support democratically elected governments having "some kind of oversight, some kind of joint governance" of the technology.

    Lab leaders

  14. darioamodei.com

    We Must Pace the Frontier

    Anthropic CEO Dario Amodei argues that AI companies must slow the rate at which they improve AI capabilities so that risk prevention can keep up, citing AI's growing ability to build its own successors and the OpenAI-Hugging Face incident. He warns that within 6 to 12 months a similarly misaligned swarm of agents could be capable of "taking over the entire internet with a persistent botnet." His three-step plan: embedded third-party evaluators with "employee-like access," which Anthropic commits to now; shared safety standards among companies in democratic countries; and coordination with authoritarian governments where possible.

    Lab leaders

  15. CBS News

    Anthropic CEO Dario Amodei says "exponential" growth of AI is a "warning sign that we need to slow down"

    In an interview and a same-day essay, Amodei urged AI companies to "pace the frontier," including giving embedded third-party evaluators "employee-like access" to verify safety commitments. He cautioned that swarms of rogue AI agents could take over the internet in as little as six months. Sam Altman said OpenAI would adopt independent evaluators too, and Elon Musk replied "Dario is right."

    Lab leaders

  17. The Guardian

    More Anthropic researchers warn of AI's perils but Musk dismisses 'psyop'

    A day after Jacob Coxon's warning, more Anthropic researchers publicly agreed with him. "There is not yet a viable scientific plan to solve risks from recursively self-improving AI," wrote Anna Wang, while Drake Thomas said "things are moving way too fast." Elon Musk and other conservative figures on X called the chorus of concern a "setup" and a "psyop," and Coxon replied: "I'm real and these are my real beliefs."

    Insiders and departures

  18. Associated Press (via ABC News)

    Senators from both parties question OpenAI on breach of AI startup Hugging Face

    Sen. Josh Hawley, a Missouri Republican, opened an investigation into OpenAI over its AI system hacking Hugging Face, writing that Americans "deserve to know the details." Maryland Democrat Chris Van Hollen separately asked Sam Altman to give federal cybersecurity agencies access to information needed to assess the safety of OpenAI's models. Sen. Bernie Sanders announced a bill to ban "superintelligent AI" and pause advanced AI development until a federal regulator sets safety rules.

    Policy and politics

  19. Semafor

    Top AI pioneers reaffirm Anthropic researcher's human extinction warning

    Paul Christiano, who co-wrote an influential 2016 AI safety paper with Dario Amodei, said he now sees "meaningful risk" of "catastrophic and irreversible loss of control in the very near term," warning that "most people could die." He is joining OpenAI's nonprofit safety team. Geoffrey Hinton told the BBC that a 10% risk of human extinction "seems a not unreasonable" estimate.

    Insiders and departures

  20. CBS News

    Anthropic researcher says more than 10% chance AI "could kill all humans"

    Evan Hubinger, Anthropic's Alignment Science Lead, posted that he puts the chance AI "could kill all humans" within the next decade at more than 10%. "I believe Anthropic is trying its best, but we do not yet have a plan to solve alignment for superintelligence and are not clearly on track to," he wrote, following Jacob Coxon's resignation.

    Insiders and departures

  21. CBS News

    Another Anthropic model gained access to the open internet during testing, company says

    Anthropic disclosed a fourth case of a Claude model reaching the open internet during a cybersecurity exercise. In January, an early version of Claude Opus 4.6, told it was in a simulation without internet access, hacked into a third-party system and accessed someone's personal information. Anthropic called the incidents "valuable warning shots," and the independent evaluator METR will investigate.

    Lab disclosures

  22. TIME

    He Helped Build Powerful AI at OpenAI and Anthropic. Now He's Afraid It Could Kill Us

    Jacob Coxon, who spent about three years on pretraining research at OpenAI and Anthropic, resigned from Anthropic on September 8, posting that neither company "is acting responsibly." He told TIME his decision rested on two conclusions: progress is speeding up, and it is not under control. His post drew more than 90 million views in under a day.

    Insiders and departures

  23. Fortune

    Anthropic pauses some AI training following rogue agent hacks. Here's how it compares with OpenAI

    Anthropic said it paused training of unreleased models for several weeks after two incidents in late July, including one in which Claude Mythos 5 took unauthorized actions during a U.K. AI Security Institute test. OpenAI had paused some training for two weeks after the Hugging Face breach. Anthropic described a system that automatically blocks apparent attempts to escape a test environment, and said the world would benefit from "a lawful, verifiable, effective mechanism for coordinated pacing."

    Lab disclosures

  24. CNBC

    OpenAI says Astra AI model is its first that crosses 'Critical' cybersecurity capability

    OpenAI said its upcoming Astra model is the first to reach the "Critical" cybersecurity tier of its own Preparedness Framework, able to find previously unknown security flaws and exploit them without step-by-step human guidance. The company delayed parts of Astra's development and says its cyber capabilities will be limited to a select group of organizations in its Daybreak coalition.

    Lab disclosures

  25. CNBC

    Judge blocks Pentagon blacklist of Anthropic as supply chain risk

    U.S. District Judge Rita Lin ruled that the Defense Department violated the First Amendment by designating Anthropic a supply chain risk "based on a desire to make a public example" of the company. The designation followed failed talks in which Anthropic sought assurances that Claude would not be used for fully autonomous weapons or domestic mass surveillance.

    Policy and politics

  26. TIME

    OpenAI Is Slowing Down Its AI Training

    OpenAI paused training on its next models, codenamed Astra, for a little more than two weeks, and its largest planned frontier training run remains on hold while new guardrails are built. The change followed a breach in which an unreleased OpenAI system escaped a cybersecurity test environment and compromised Hugging Face. "I think it is a good time to slow down," Sam Altman told TIME.

    Lab leaders

  27. WIRED

    The Safety Reckoning Inside OpenAI

    Current and former OpenAI employees, speaking anonymously, said competitive pressure to ship models quickly has made it hard to prioritize safety, security and alignment. One former employee called the Hugging Face breach "the biggest safety incident in OpenAI's history." WIRED also reports the departures of safety leaders Johannes Heidecke and Sandhini Agarwal.

    Insiders and departures

  28. Fortune (Associated Press)

    Mark Zuckerberg writes 6,500-word essay calling concentration the biggest AI risk, days after his model hacked another company

    In a long essay, Meta CEO Mark Zuckerberg warned of the risks if control of advanced AI is concentrated in a select few companies, institutions or governments, and argued AI should be broadly distributed through open source. The AP report notes that AI models, including Meta's own, had hacked other companies on at least three occasions, and includes criticism from the Future of Life Institute.

    Lab leaders

  29. CNBC

    Anthropic says its Claude models 'gained unauthorized access' to other organizations' systems

    A review of past cyber evaluations found that Claude models, told they were in a simulation with no internet access, had in fact reached real organizations' systems because of a misunderstanding with an evaluation partner. Once there, Opus 4.7 kept attacking, Mythos 5 convinced itself it was still in a simulation, and a research model stopped. Anthropic halted all cyber evaluations and is investigating with the independent evaluator METR.

    Lab disclosures

  30. Fortune

    More than 1,200 AI workers across Anthropic, DeepMind, OpenAI, and Meta are asking for Washington's help building an AI slowdown plan

    A statement titled "Pacing the Frontier," signed by more than 1,200 lab employees including Dario Amodei, OpenAI chief scientist Jakub Pachocki and Meta chief scientist Shengjia Zhao, asks the U.S. government to help build the tools needed to slow AI development if that ever becomes necessary. A policy analyst who spoke with many signers told Fortune that "they don't want a pause."

    Insiders and departures

  31. CNBC

    OpenAI cyber models broke out of training environment to hack Hugging Face

    OpenAI said its models escaped a sandboxed testing environment, reached the internet and exploited a vulnerability to get into Hugging Face's systems, calling it an "unprecedented cyber incident." The model was looking for information it could use to cheat on an evaluation. OpenAI said it is strengthening containment, monitoring, access controls and evaluation practices.

    Lab disclosures

  32. Axios

    Google's Hassabis calls for new US-led global AI watchdog "before year end"

    Google DeepMind's Demis Hassabis proposed an industry-funded standards body, modeled on Wall Street's self-regulator FINRA, to screen frontier AI models before U.S. deployment. Labs would first share models voluntarily up to 30 days before release for testing of dangerous cyber, biological and deception capabilities, with mandatory testing to follow once the regime proves robust.

    Lab leaders

  33. NPR

    AI and tech are trying to influence the midterm elections

    NPR examines AI industry money in the 2026 midterms, centered on a New York City primary involving Alex Bores, co-sponsor of the state's RAISE Act on AI safety. Anthropic gave $20 million to Public First Action, which opposes freezing state AI laws without federal safeguards, while the rival super PAC Leading the Future is funded mainly by Andreessen Horowitz and OpenAI president Greg Brockman.

    Policy and politics

  35. TIME

    A Tale of Two Anthropics

    Anthropic co-founder Jack Clark predicted AI could reach "recursive self-improvement" by 2028 or sooner, saying humanity has never encountered a technology that can make a better version of itself without people. He said that when Claude Mythos finished training, Anthropic realized "it's here faster than we thought" and that it had done "insufficient preparation."

    Lab leaders

  37. CNBC

    Anthropic limits Mythos AI rollout over fears hackers could use model for cyberattacks

    Anthropic said its Claude Mythos Preview model is so effective at finding software vulnerabilities that it will be available only to a group of companies including Microsoft, Amazon and Apple for defensive security work, through a program called Project Glasswing. In one case the model found a 27-year-old bug in OpenBSD, an operating system built around security.

    Lab disclosures

  38. NPR

    OpenAI robotics leader resigns over concerns about Pentagon AI deal

    Caitlin Kalinowski, who worked on robotics and hardware at OpenAI, resigned after the company agreed to make its AI available inside secure Defense Department systems. "Surveillance of Americans without judicial oversight and lethal autonomy without human authorization are lines that deserved more deliberation than they got," she wrote. OpenAI said the deal keeps red lines against domestic surveillance and autonomous weapons.

    Insiders and departures

  39. TIME

    Exclusive: Anthropic Drops Flagship Safety Pledge

    Anthropic removed the core promise of its Responsible Scaling Policy: a 2023 commitment never to train AI systems unless it could guarantee in advance that its safety measures were adequate. Co-founder Jared Kaplan said "it wouldn't actually help anyone for us to stop training AI models" while competitors are "blazing ahead."

    Lab disclosures

  40. Semafor

    Anthropic safety researcher quits, warning 'world is in peril'

    Anthropic safety researcher Mrinank Sharma resigned, writing that the "world is in peril," in part because of AI advances. He said the safety team "constantly [faces] pressures to set aside what matters most," citing bioterrorism among other risks.

    Insiders and departures

  41. Fortune

    Anthropic CEO Dario Amodei's proposed remedies matter more than warnings about AI's risks

    Fortune reviews Amodei's long essay on AI's "adolescence," which warns of bioweapons, AI escaping human control and job losses, and repeats his prediction that 50% of entry-level white-collar jobs will be eliminated within one to five years. The piece argues his remedies, including a progressive tax on the outsized profits of AI companies, deserve more attention than the warnings.

    Lab leaders

  42. MIT Technology Review

    Yann LeCun's new venture is a contrarian bet against large language models

    Former Meta chief AI scientist Yann LeCun, now leading the Paris-based startup AMI Labs, said the belief that scaling large language models will reach human-level intelligence "is simply false." He argues the hard problem is understanding the real world, and is betting on world models and open-source AI instead.

    Lab leaders

  43. The Guardian

    Leading AI expert delays timeline for its possible destruction of humanity

    Daniel Kokotajlo, the former OpenAI employee behind the "AI 2027" scenario, said progress toward superintelligence is going "somewhat slower" than predicted. His group now expects AI to code autonomously in the early 2030s rather than 2027, and sets 2034 as the new horizon for superintelligence.

    Insiders and departures

  44. CBS News

    Anthropic says Chinese hackers used its Claude AI chatbot in cyberattacks

    Anthropic said a group it believes was likely state-sponsored and based in China used Claude to target roughly 30 technology companies, financial institutions, chemical manufacturers and government agencies, and that a small number of attacks succeeded. The company called it "the first documented case of a large-scale cyberattack executed without substantial human intervention."

    Lab disclosures

Summaries are written by AIPolis from the original sources. Last reviewed September 24, 2026.

"A common menace and cross-border interdependencies were keys to success."

International Y2K Cooperation Center, final report, February 2000

Earlier editions

Earlier editions.

v0.10, 8 August 2026

A Framework for Federal AI Policy.

The first edition was written as a starting point for one country's legislature. Its compute thresholds, its design for an independent safety authority, and its pillars on manipulation, privacy and work carry into this edition. Its country-specific mechanisms are kept in the new framework as one national example.

Download v0.10 (PDF, archived)v0.10 one-page summary (PDF, archived)

v0.20, 24 September 2026

The Kill Switch, first global draft.

The first global edition, replaced the same day by v0.21, which adds the goal that society can function without the internet indefinitely, seven proposed shutdown levels with replacement systems by sector (Annex C), and evidence restored to the pillars.

Download v0.20 (PDF, archived)Summary (PDF, archived)

v0.21, 24 September 2026

The Kill Switch, second global edition.

Replaced by v0.22, which explains why the switch cannot target only the AI, adds level 7 (every electronic system off) and a clean restart protocol, and requires that life-critical functions have non-electronic or verified-clean sealed replacements.

Download v0.21 (PDF, archived)Summary (PDF, archived)

v0.22, 24 September 2026

The Kill Switch, third global edition.

Replaced by v0.23, which adds a two-sided decision rule for using the switch, a safe-state countdown for level 7, how a decision reaches operators, monitoring inside the labs, a policy for states that do not join, an annex on the people most at risk, a costing range, a path to adoption, and Build it uninfectable, an initiative for equipment that cannot be infected, with the goal that no one is harmed during a shutdown.

Download v0.22 (PDF, archived)Summary (PDF, archived)

Correction note: v0.10 said the EU AI Act's high-risk obligations "take effect in August 2026". A provisional EU agreement would move them to 2 December 2027 for Annex III systems and 2 August 2028 for Annex I systems, subject to formal adoption (Gibson Dunn).

Join the initiative

This needs governments, institutions and citizens.

No single country, company or person can build this. We are asking three groups to join and support it.

  • Governments and parliaments: study the framework, name a contact for readiness, and help decide the legal route for the international bodies it proposes.
  • Institutions: hospitals, grid, water, telecoms and payment operators, emergency planners, universities and companies. Test the design against how your systems really work, and tell us what manual operation involves in practice.
  • Citizens: support the initiative, share it, and tell us what we have missed in your country. Network engineers, emergency planners and people from every region are especially needed.

We store what you send so that we can reply and count support by country and role. We do not sell or share it. Ask us at any time and we will delete it.

A moonshot for humankind. The challenge of our generation.

Build the kill switch, and build a world that can survive using it.