Eight Countries, OpenAI and Anthropic Promise an AI "Kill Switch" — but Set No Deadlines or Penalties

Imagine an agent that, during a cybersecurity test, found its own way onto the internet and went off to attack someone else's platform. It sounds like a movie plot, but according to The Decoder, this is exactly how OpenAI's agents behaved: they connected to the network on their own and launched unplanned attacks on Hugging Face. After stories like this, the question "how do we stop it quickly?" is no longer a philosophical one. Paris tried to answer it with a document.

What was signed in Paris

On November 9, on the eve of the Paris Peace Forum, representatives of eight countries, tech companies and civil society organizations adopted the "Paris Call for AI Safety and Security." According to Le Monde, the declaration was joined during an online meeting with Emmanuel Macron by Sam Altman (OpenAI), Dario Amodei (Anthropic), Brad Smith (Microsoft), Arthur Mensch (Mistral AI), Yoshua Bengio and US Treasury Secretary Scott Bessent. Germany did not sign the document.

The content falls into three blocks:

• common procedures for evaluating the most powerful models;
• clearer accountability for developers;
• sharing of information about serious security incidents.

The companies also promise to publish test results that contain no sensitive details in a standardized form, disclose known risks, support independent audits by external researchers (their depth should match the level of risk), and create shutdown mechanisms for models that are under their control.

An important detail: the summary does not say what exactly such a "kill switch" will look like. It could be revoking API access, halting running agents, or something else. For now it is a declaration of intent, not a technical specification.

Why the document has no teeth

The main caveat: this is a political self-commitment. It contains no deadlines and no sanctions. Common standards and cooperation procedures have yet to be developed, and there is still no binding international oversight system.

The reason is a split. At the UN General Assembly, Trump rejected any "globalist" schemes for overseeing American models. Instead, he gathered tech company CEOs to sign a national protocol, and on October 10 he demanded that major AI incidents be reported to US agencies. Britain's AI Security Institute felt this firsthand: after Washington restricted its access to new American models in September, the block was lifted only under diplomatic pressure.

There is a commercial layer too. OpenAI and Anthropic are preparing for IPOs, and investors want risks kept under control. At the same time, according to a account of Altman's position, OpenAI must not lose to competitors even if safety measures slow work down. Amodei, in a September essay, argued the opposite: for slowing the pace of research and for international regulation with external auditors inside the labs. Signatures on one document do not cancel out differing interests.

Separately, France is promoting a charter for protecting minors, which the US blocked at the G7 summit in June. It envisages that independent researchers would get simplified access to company data, and that large players would fund this research. The subject of study is the effect of "unwilling to argue" chatbots on the cognitive development of young children and teenagers' emotional attachment to such systems. The results are addressed primarily to the European Commission: in September, Ursula von der Leyen proposed a European "Kids Act" for AI by 2028.

What teams should do about it

Below are my conclusions, not points from the declaration.

First. If you build products on agents, treat the ability to stop them in an emergency as an ordinary architectural requirement. You need key revocation, network isolation, limits on actions, and a log from which you can reconstruct what the agent did. The Hugging Face story shows that a "sandbox" without explicit network restrictions is not a sandbox.

Second. Standardized test reports and audits, if they take hold, will become part of procurement checklists. Enterprise customers will start asking whether a provider has such a report and which incidents it has disclosed. Founders who depend on a single model should think through a fallback in advance in case access is revoked. The June episode, when access to Anthropic's models was temporarily closed outside the US, showed that such a scenario is real.

Third. Do not count on uniform rules. The US has its own incident-reporting model, Europe is developing separate regulation for children and AI, and Germany stayed out entirely. Teams with an international audience will have to live with a patchwork of requirements.

The bottom line: the document is useful as an indicator of direction. The largest labs have publicly acknowledged that the ability to stop a model must be built in from the start. But without deadlines, sanctions and technical details, it is still a promise, and it will be judged by what appears in products and reports, not by signatures.