https://t0ul.com/tags/incident-response/Recent content in Incident-Response on t0ulHugoen-usTue, 11 Aug 2026 00:00:00 +0000https://t0ul.com/blog/incident-response-and-the-kill-switch/Tue, 11 Aug 2026 00:00:00 +0000https://t0ul.com/blog/incident-response-and-the-kill-switch/<p><em>Part of my <a href="https://t0ul.com/blog/the-plan/">AI Security Engineering</a> series, a local email-to-calendar agent I build, then attack, then harden. If you have not set up the lab yet, start with <a href="https://t0ul.com/blog/setting-up-the-lab/">Set up your lab</a>. The lessons are <a href="https://github.com/t0ul/ai-security-engineering">on GitHub</a>, and the agent itself lives at <a href="https://github.com/t0ul/emaildrop">t0ul/emaildrop</a>.</em></p> <h2 id="the-control-you-reach-for-under-pressure">The control you reach for under pressure</h2> <p>A kill switch has shown up in this book twice already, wired to the capability authority so that engaging it revokes every grant at once. This post is about the switch as an incident-response tool, in the moment you actually use it, because that moment is where a naive kill switch fails in two different ways. Both come from treating it as a simple flag, and both are the kind of thing you only discover at the worst possible time.</p>