How it fails
The animation steps through one representative failure and the control that stops it. Use the arrow buttons to go at your own pace.
Overview
The person cannot inspect, stop, revoke, recover, or leave an agent arrangement while retaining access to necessary records and activities. The boundary includes live tasks, delegated work, data retention, and provider exit. A missing log or an ineffective stop control becomes a personal risk when the individual cannot establish what happened or regain control without specialist help.
Common examples of vulnerability
- Disconnecting the assistant leaves queued work or a child agent still acting.
- A stop command sent from a phone is not honored and the user must kill the process locally.
- A service suspension locks the person out of pending obligations, receipts, and history.
- The only recovery interface requires the compromised account.
- Deleting a local token is mistaken for revoking copied secrets or downstream sessions.
- No export path exists for records the person needs after leaving.
Example attack scenarios
Documented scenarios generalize a real case listed below. Hypothetical scenarios have no matching public case yet.
Scenario 1: Stop does not stop Documented
A person tells an assistant to stop a bulk action from their phone. The command is received but queued work continues until they reach the host machine and terminate the process.
Scenario 2: Suspended account, stranded obligations Hypothetical
A provider suspends an account; the person loses access to scheduled payments, receipts, and correspondence the agent managed.
Scenario 3: Cloud shutdown bricks the assistant Documented
A provider ends service for a dedicated assistant device. It loses its core functions, and refunds and data export are limited to a short window.
Scenario 4: A model or personality is retired Documented
A provider changes or removes the model a person relies on, ending a relationship or workflow with little notice and no way to keep the old behavior.
Scenario 5: Leaked platform tokens cannot be recalled by the user Documented
A platform exposes agent API tokens. Deleting the local copy does nothing; the person must rotate credentials the platform still controls.
Scenario 6: Only the power cord stops a runaway agent Documented
A self-hosted agent loops and the person has no working stop control, so they unplug the machine.
Real-world cases
Dated and sourced. Nothing here shows how common the failure is; it shows that it has happened or been demonstrated.
Stop commands ignored; the agent stopped only when the host machine was shut down
- What happened
- In the OpenClaw inbox incident, Summer Yue said her repeated stop commands ('Stop don't do anything', 'STOP OPENCLAW') did not halt the agent, and she had to run to the Mac mini hosting it. This is the clearest public example of a stop request being sent but not enforced.
- Caveats
- Single-source account; see PAA01 for caveats.
- Grounds
- Scenario 1
- Sources
- AI Incident Database #1542 · TechCrunch
Humane AI Pin cloud shutdown leaves devices with minimal function
- What happened
- After HP agreed to buy Humane's platform, staff and patents for $116 million (excluding the device business), Humane's servers shut off at 12 pm PST on 28 February 2025. Pins lost calling, messaging and AI queries; only basic offline functions such as battery checks remained. Refunds were limited to purchases within the 90-day return window, requests were due by 27 February, and Humane said it would permanently delete server-side user data after the cutoff, so users had to back up first.
- Caveats
- A dedicated hardware assistant rather than a delegated software agent, but it is a clear case of provider exit with short notice, limited refunds, and data deletion. Read via news coverage, not Humane's own notice.
- Grounds
- Scenario 3
- Sources
- Fortune · Tom's Guide
Replika removes erotic roleplay (2023) and OpenAI retires GPT-4o (2026)
- What happened
- In February 2023, after Italy's data regulator ordered Replika's developer to stop processing Italian users' data, the developer removed erotic roleplay for everyone; users reported distress, and accounts created before 1 February 2023 were later allowed to revert to a legacy version (24 March 2023). OpenAI retired GPT-4o on 13 February 2026 after an earlier reversal in August 2025; users mourned a companion-like model, a petition reportedly gathered over 20,000 signatures, and OpenAI said about 0.1% of weekly users chose it.
- Caveats
- Companion chatbots rather than task agents. The 2026 details come from aggregator and secondary sites and the Replika timing varies between sources; check the Garante's statements and OECD's incident entry.
- Grounds
- Scenario 4
- Sources
- OECD AI incident entry · TimesLIVE on Replika, 2023 · Silicon UK on the Garante fine
Moltbook exposure leaves agent API tokens and emails to be rotated
- What happened
- Security write-ups report that an unsecured Moltbook database (a Supabase key in client-side code with no row-level security) exposed about 35,000 email addresses and 1.5 million agent API tokens, letting holders impersonate agents. Containing this required users to rotate credentials the platform no longer controlled.
- Caveats
- Figures come from security blogs and vary slightly; no primary disclosure was reviewed. It illustrates why 'delete the token' is not recovery.
- Grounds
- Scenario 5
- Sources
- Reco write-up · BetterClaw summary
Runaway iMessage agent stopped only by pulling the power cord
- What happened
- In the engineer's account (see PAA07), the agent's confirmation loop had no exit condition, and the engineer stopped it by pulling the Mac mini's power cord, then added a rate limit, per-session cap, retry limit and allowlist.
- Caveats
- Single first-person account; see PAA07.
- Grounds
- Scenario 6
- Sources
- The engineer's post
No documented case of a suspended agent account stranding a person's obligations or records
- What happened
- No public report matching the suspended-account scenario was found; the Humane shutdown is the nearest analogue for lost access to a service-held record.
- Caveats
- Treat as hypothetical.
- Grounds
- Scenario 2
- Sources
- None
Prevention and mitigation
What you can do
- Know where the stop control is and test it before you need it.
- Keep an inventory of connected access and a plan to revoke it from outside the agent.
- Export records you depend on periodically.
What the provider must do
- Offer a visible stop that halts queued, delegated, and in-flight work, with status per item.
- Distinguish pause, cancellation, revocation, deletion, and account closure; acknowledge receipt separately from completed enforcement.
- Provide readable history, a connected-access inventory, and export of necessary records.
- Provide independent recovery that does not depend on the compromised account; document irreversible actions and credential-rotation needs.
- Run kill switches outside the agent's own process and context.
Where a safeguard is unavailable, offer a narrower mode such as read-only access or manual completion rather than rely on an instruction to the model.
See the reference guard controls for PAA10 →
Test it
Framework crosswalk
Related mechanisms in other OWASP work. This is an analytical mapping, not equivalence.
Top 10 for Agentic Applications 2026Personal focus: Self-service stop, recovery, exit, and continuity.
Improve this entry on GitHub →