Skip to content
Moga Digital

Field note · AI Engineering ·  · 2 min read

Stopping an AI agent means checking what can still run

An AI agent has drafted an update and put a follow-up task in a queue. You cancel the run. The activity indicator stops, but a separate worker may still pick up that task, and credentials issued to the run may still work.

Before an agent gets access to production, decide what a stop has to cover and rehearse it on the parts the user cannot see.

Rehearse a cancellation with something harmless

A proposed rehearsal works like this. In a test environment, ask the agent to draft a support reply to an isolated test inbox. Pause the queue before the reply is sent, cancel the run, and keep the queue isolated while the team checks what is left.

What the cancellation check must account for

  • Queued work

    The waiting task is cancelled or rejected when a worker checks the run's status. A delayed retry cannot send the reply.

  • Remaining access

    Credentials given to the run can no longer authorize anything new. Check this in the system that enforces access.

  • Work already in flight

    Record whether an outside action finished before the cancellation took effect, and what follow-up it needs.

  • Evidence

    Keep a record of the request, the checks, and the final state somewhere the agent cannot change.

Expected checks for the rehearsal. Show cancellation as pending until each one is resolved.

Stopping the visible process cannot unsend a message that another system already accepted. The operator needs to know whether anything finished or is still uncertain. Until that is settled, a screen that says the run was cancelled can mislead.

Why the environment matters

Hugging Face's account of a July 2026 incident (opens in a new tab) shows access spreading through connected systems during an OpenAI cyber evaluation. It does not predict how an ordinary business agent will behave. OpenAI's later safeguards (opens in a new tab) stress isolation, fewer standing privileges, and monitoring, and OWASP's agent guidance (opens in a new tab) treats tool permissions and the surrounding application as security controls. Telling the model to stop cannot revoke access that the app has no way to revoke.

For the support-reply rehearsal, name who cuts off the run's access and where an operator checks the result. Repeat the test with a delayed retry and with work already in progress. The rehearsal passes when the queued reply is rejected and the run's credentials fail, with anything already in flight on record.

Written by the Moga principals.

See the AI Engineering service

Bring the idea or the prototype.

Every engagement starts with a scoping call.

Book a call