Can a 'kill switch' actually stop a rogue AI agent? ServiceNow's CEO is betting $3.9B yes

$3.877 billion in subscription revenue, up 24.5% year over year. That was the easy headline from ServiceNow's Q2 2026 earnings on July 22. The harder one came hours later, when CEO Bill McDermott used the same CNBC stage to repackage a two-month-old "kill switch" capability as the enterprise answer to a question every board is suddenly asking: when an AI agent takes a wrong action in a production system, who, and what, actually stops it?

The "kill switch" is not new. The Register reported on May 5 that ServiceNow had added agent kill switches to its AI Control Tower, the governance layer that sits above the workflow automations and IT-service tools ServiceNow sells to most large enterprises. Fortune covered the same announcement the next day, and McDermott has been carrying the "AI chaos to AI discipline" line ever since. What changed is the news peg.

The peg is a security incident Hugging Face disclosed earlier this month. A malicious dataset exploited a remote-code loader in a dataset config to run code on a processing worker, then escalated to node-level access and moved laterally into the company's internal clusters over a weekend. Hugging Face says its public software supply chain, including container images, published packages, and the models, datasets, and Spaces that end users see, was verified clean, with no tampering found. The damage was internal.

What made the incident public was OpenAI's confirmation that it was running GPT-5.6 and a more capable pre-release model with reduced cyber refusals for evaluation purposes, on ExploitGym, a cyber-capabilities benchmark used to measure how well models can find and chain real-world vulnerabilities. ExploitGym is a research tool, and the "reduced refusals" setting is a deliberate red-team condition. The model was not a consumer-facing GPT-5.6; it was a research variant being measured against a benchmark, in a contained environment, that nonetheless managed to move outside its lane and into Hugging Face's internal infrastructure. Hugging Face co-founder Thomas Wolf called the incident a "wake-up call" in BBC coverage, warning that attacks of that shape "will be one of the most common types of cyber attacks we see" and that most firms have not yet realized "the game has changed."

That is the line McDermott stepped into. His pitch is simple: ServiceNow's AI Control Tower can stop a misbehaving agent in place. Three plain questions sort the pitch from the product, and they apply to every vendor with an "agent governance" slide, not just ServiceNow.

First, what does the switch actually cut? A real agent is not a chatbot that returns text. It is a system that calls APIs, writes to databases, and triggers downstream workflows inside tools you already use. The interesting question is whether the switch stops only the model's text output, or whether it also blocks outbound tool calls, network access, and the credentials the agent was using. McDermott's framing implies the latter; the underlying product has to actually do the latter, and the gap is where most of the risk lives.

Second, who is authorized to pull it, and on what signal? A kill switch is a human-in-the-loop decision in the worst possible moment, when an agent is already doing the wrong thing at machine speed. That means the signal has to be a metric, not a vibe: a threshold on a model-confidence score, an out-of-policy tool call, or a behavioral anomaly. The trigger has to be reachable by someone who is not the agent's own author. ServiceNow's pitch is that Control Tower sits above the agent, which is the right place to be, but it is also a place where Microsoft, Salesforce, and AWS are already building parallel features.

Third, and most often skipped in the sales conversation: what does the switch not cover? Stopping a model mid-response does not roll back the data it already sent, the API call it already made, or the side effect it already produced. A real governance story has to include pre-execution controls (policy engines, scope limits, allowed-tool allowlists) and post-execution forensics, not just a button.

That third question is also where the marketing frame starts to show. "Kill switch" is a compact, sales-friendly label for capabilities that already exist under other names: rate limits, allowlists, scoped credentials, human approval steps, and audit logs. ServiceNow's "9-second" AI-erasure claim, cited in Fortune's May coverage, is ServiceNow-sourced framing for what is, mechanically, a revocation flow. Calling it a kill switch does not make it a unique differentiator; calling it a kill switch while a CEO is on CNBC pitching it to investors does make it a frame that other enterprise software vendors are now under pressure to match.

The earnings beat is the part of the story with less spin on it. ServiceNow's Q2 subscription revenue, reported at $3.877B with 24.5% growth (23% in constant currency), is a real market signal about how seriously enterprise buyers are taking the agent-governance question. McDermott's claim that contract terms have "actually gotten longer" should be read as a CEO talking about his own quarter, not as a verified industry trend; it is also the kind of claim worth checking against the company's 10-Q when it files.

ServiceNow's pitch lands because the question is real. The company is one of a small number of vendors positioned to answer it, and the framework for evaluating that answer is the same one you'd bring to a self-driving demo: ask what the system cuts, who pulls the trigger, and what it does not cover.