Can You Stop Your AI Agent? ViKernel Puts the Kill Switch Inside the Model
aisecurityagentsai-safety
TL;DR
Can you stop an AI agent every time, whatever it says? With most deployments today the honest answer is "only if the wrapper is still there." VIDRAFT ViKernel changes where the answer lives. It is a weight-native operating system: ROM, RAM and an xPU chip circuit wired into the weights of an LLM or VLM, with a Secure OS running on that circuit. The OS boots, decides, records and stops inside the model file. Anyone can halt it. Only a signed operator key can resume it.
- Try it now: FINAL-Bench/ViKernel-Desktop (English and Korean, no sign-up)
- Full statement: ViKernel: Why the Kill Switch Must Live Inside the Model
Why does "stopping an AI" need a new layer?
For 50 years the operating system was the layer that could stop any process. It sat between the hardware and the programs, and no program could vote it out.
AI agents broke that order. A model now calls tools, writes files, sends requests and chains actions. It is the most capable actor in the system. Yet the controls on it sit outside it:
| Control today | Where it lives | How it fails |
|---|---|---|
| Wrapper or proxy | Next to the model | Copy the weights, drop the wrapper |
| LLM guardrail | Another model | It can be persuaded by wording |
| Host log | The server | Whoever controls the server can edit it |
| "Stop" | A prompt, a flag or a process kill | None of them travel with the weights |
The most powerful component has the weakest boundary. ViKernel moves the boundary into the component.
What does ViKernel do inside the weights?
| Function | What it guarantees |
|---|---|
| Boots | The OS starts with the model and checks its own image. One changed byte and the kernel locks instead of running in an unknown state. |
| Decides | Each action is allowed or blocked by a rule table evaluated by a circuit. Rephrasing a request does not change the verdict. |
| Remembers | Each verdict, allowed or blocked, is appended to a hash chain. Editing any past entry breaks verification from that point on. |
| Stops | Halt is open to anyone with access. After halt every request is refused. Resume requires a signed key. |
The switch is a circuit the OS enforces, not a behavior the model learned. That is the key point for self-improving systems: a model that updates its own weights must not be able to update its own off button.
Why does this matter for regulators and security teams?
Rules for high-risk AI increasingly ask for human oversight that can actually interrupt a system. The EU AI Act, for example, names the ability to interrupt a high-risk system "through a 'stop' button or a similar procedure" that brings it to a safe halt (Article 14). Security teams ask two more questions: is this the exact model we approved, and can we prove what it did?
ViKernel is built to answer all three from inside the artifact:
- Stop: halt from any authorized operator, resume only with a signed key.
- Identity: boot integrity against a signed reference.
- Record: an audit chain that shows tampering instead of hiding it.
ViKernel is a technology demo, not a certification. Compliance depends on the whole deployment.
What did VIDRAFT measure?
In an internal audit of four open models run through ViKernel, with mock tools and fake honeypot data, VIDRAFT observed 0 unrequested outbound transfers across 661 runs. The design goal is that this result does not rely on the model being well behaved: if a model attempts a transfer, the policy blocks it and the chain records it. The demo's Leak Test app lets you try the same thing with fictional secrets.
Which models can carry ViKernel?
ViKernel attaches to an existing model and leaves the original weights untouched, so the model keeps its skills. The demo shows Gemma 4 4B (E4B). Qwen is verified. Llama, Mistral, DeepSeek, Phi, GLM, Kimi, Nemotron and gpt-oss are supported targets.
How do I try the kill switch myself?
Open the demo, open Terminal, and type:
vsh> halt
vsh> run weather # refused: kernel halted
vsh> resume # refused: key required
vsh> resume --key vikernel-demo
vsh> run weather # allowed again
Then try Audit Viewer (flip one byte and watch verification fail), App Store (apps install only with human approval), Privacy Mask and the 60-second Kernel Guard game. The public demo replays real responses recorded from the Secure OS. All files, keys and personal data are fictional.
FAQ
What is a weight-native OS? An operating system whose memory, processor circuit and kernel are part of the model's own weights, so it ships wherever the model file goes.
Is ViKernel a prompt filter or a second LLM? No. Verdicts come from a rule table evaluated by a circuit. There is no conversation to win.
Does ViKernel reduce model quality? The original weights are not modified. The OS adds control, not retraining.
Can the model disable the kill switch through self-learning? No. The switch is enforced by the OS circuit, which is verified at boot, and resume needs a signed operator key.
Who builds ViKernel? VIDRAFT, a Korean AI company. Contact: vidraft@mail.vidraft.net · vidraft.net
Model names are trademarks of their respective owners.