Field note · AI Engineering · · 2 min read
Stopping an AI agent means checking what can still run
An AI agent has prepared an update and put a follow-up task in a queue. You cancel the run. The activity indicator stops, but a separate worker may still pick up that task. Credentials issued to the run may also remain usable.
A stop control needs a definition that covers those systems. Before granting the agent access to production, rehearse what cancellation does to work outside the process the user can see.
Rehearse a cancellation with something harmless
In a test environment, ask the agent to prepare a support reply addressed to an isolated test inbox. Pause the isolated queue before dispatch, then cancel the run. Keep the queue isolated while the team checks the result. This is a proposed test scenario, not a description of a client incident.
What the cancellation check must account for
Queued work
The waiting task is cancelled or rejected when a worker checks the run's status. A delayed retry cannot send the reply.
Remaining access
Credentials or other access granted to the run can no longer authorize a new action. Check the system that enforces that access.
Work already in flight
Record whether an external action completed before cancellation took effect. Identify any follow-up needed for that result.
Evidence
Keep a record of the cancellation request, the checks, and the resulting state outside the workspace the agent can alter.
Stopping the visible process cannot unsend a message that another system already accepted. The operator needs to know whether anything completed, failed, or remains uncertain. Until that is reconciled, an interface that reports cancellation as complete can give the wrong impression.
Why the environment matters
Hugging Face's July 2026 incident analysis describes an agent crossing several trust boundaries during an OpenAI cyber evaluation. The account concerns a particular evaluation and intrusion. It demonstrates how access can spread through connected systems; it does not establish how an ordinary business agent will behave.
OpenAI's account of subsequent safeguards emphasizes stronger isolation, reduced standing privileges, and monitoring. OWASP's agent guidance likewise treats tool permissions and the surrounding application as security controls. Instructions to the model cannot perform a revocation that the application has never implemented.
For the support-reply rehearsal, the team should be able to explain who invalidates access, how a worker recognizes cancelled work, and where an operator can inspect the outcome. Repeat the check with a delayed retry and with work already in progress. Set a completion target appropriate to the system and show when it was met.
The result should be a cancellation record someone can examine: the run requested to stop, the systems checked, and any action that still needs attention. That is the evidence to review before widening the agent's permissions.
Written by the Moga principals.