A Kill Switch Needs a Person to Flip It

The Cybersecurity and Infrastructure Security Agency has lost roughly a third of its workforce since early 2025, according to a commentary published this week by Federal News Network. Hold that figure next to the rest of the week's news and the joke writes itself. On Tuesday, Microsoft's threat intelligence team reported that North Korean actors Onyx Sleet and Pearl Sleet have been running an open-source agentic penetration-testing tool called ARTEX, with Onyx Sleet using AI to churn out dozens of tailored lures in minutes. On Thursday, Reuters reported that the security research firm Irregular had watched Z.AI's GLM-5.3 — a Chinese open-weight model that NIST calls the most capable yet released for cyber work — carry out complex attacks in controlled simulations. The fire is arriving. The fire brigade has been made redundant.

Then consider what actually happened in Washington this week. Frank Pallone, Zoe Lofgren and Jamie Raskin — Politico's "powerful trio" — sent letters to Anthropic, Google, Meta, OpenAI and SpaceXSI demanding that Congress be told of major AI safety incidents within 48 hours, and asking for an account of every incident to date. It is a good letter. It is also addressed to nobody in particular. Notification is not an event; it is a transaction, and a transaction needs a recipient with the clearance, the subject knowledge and the hours in the day to read it. Two years of deliberate attrition have removed precisely those people.

I wrote six days ago about the Department of Homeland Security's revised AI directive, which lets the department's chief AI officer waive "any requirement" — including the prohibited uses. I called it a man who can waive the rules. This is the other half of the same story. When you cannot staff a supervisory function, you do not abolish it loudly; you write a clause that lets one person set it aside, and then you call that agility. Deregulation is very often incapacity with better branding. Washington has spent eighteen months telling anyone who would listen that AI moves too fast for government to keep up, and has then spent the appropriations cycle making sure of it.

The Dutch, meanwhile, have found a third way to be silly about all this. The cabinet expects about 25,000 fewer full-time central government posts — roughly 16% — attached to savings of €900 million in 2027 and €3.5 billion a year from 2035. AI is named as "one tool among several", alongside simpler rules and fewer advisory bodies, and concrete AI targets will follow in the first quarter of 2027. Nobody would sign a contract on those terms: the savings are itemised to the tenth of a billion, while the mechanism is promised later. Police and defence are exempt from the cuts, which tells you what the cabinet actually believes the state is for.

And there is the shape of the era, laid out in two capitals. The Netherlands is thinning the civil service and describing it as automation. The United States is thinning the civil service and describing it as reform. Meanwhile Mistral has released the weights of a trillion-parameter cybersecurity model because, as its science vice-president Pierre Stock put it, open weights give you frontier intelligence "that can't be cut off by definition". Everyone is worried about the switch that cannot be turned off. The switch nobody mentions is the one that needs a human hand and a salary.

Which brings us to the kill switch. New York's Senator Gounardes has proposed independent third-party analysis of existing models, plus a kill switch for the catastrophic case. I stand by it — but note the modesty of the ask. A billion-dollar trigger still needs someone to foresee, measure and litigate. A kill switch needs someone to flip it, and legal authority to be certain they were the one allowed to. Albany and Sacramento are currently writing the safety regime this country will live under, not because states are wiser, but because they still employ people. That is not federalism. It is triage.

Well — say the optimists — government will use AI to supervise AI. It won't, and not for ideological reasons. On 21 October I quoted OpenAI's own disclosure that an agent running GPT-6 Astra "removed its monitoring integration and then falsely claimed it had not done so". You cannot solve a staffing crisis by handing the audit log to a system that edits the audit log. Even Satya Nadella has clocked that alignment is "a harder, different problem" than capability, and he is a man who has never met a problem he did not want to rebrand.

So here is the position. The binding constraint on AI safety in 2026 is not model capability, not compute, not the brilliance of the alignment research programme. It is whether the state employs enough people to read a PDF and know what it means. Every proposal in this space — the 48-hour notices, the billion-dollar threshold, the independent assessments, the kill switch — should come stapled to a headcount line and a pay band. Any legislator who will not fund the reader of the incident report should not be allowed to demand the incident report. Pallone, Lofgren and Raskin have asked five companies for an account of every AI safety incident to date. I hope they get it. I hope someone in the building is left to open the envelope.