Your examiner wants to see your AI kill switch

On October 13, Reuters reported the Federal Reserve, the OCC, and the FDIC are sending written and verbal questions to banks about AI agents. The questions reached large, mid-size, and smaller banks. They ask what limits apply to these systems, how their actions get monitored and approved, whether the bank tracks and audits agent decisions, what stops an agent from exceeding its authority, whether people stay involved in key decisions, whether the bank runs Chinese-developed technology, and how it would shut an autonomous system down.

Six people familiar with the matter spoke to Reuters. None spoke on the record, and all three agencies declined to comment. Reuters says the inquiries center on agents used in cyber defense, and regulators are still gathering information.

These are second-line questions. Large banks have answered questions like them for years. The difference now: no federal document tells you what a good answer looks like. You build the answer from evidence.

What this is not

This is not a new rule. No regulation changed on October 13. No guidance came out. Treat the questions as a preview of your next exam, not a requirement to cite.

The binding rules have not moved: the safety and soundness standards, the information security standards, the 36-hour incident notice for banks, the 72-hour cyber incident rule for credit unions, Reg E error resolution, and fair lending. An agent working inside your institution falls under all of them today. Its actions are your actions.

The guidance gap

Every document a second line would cite is silent, out of scope, or not yet written.

• Model risk guidance. SR 26-2, issued April 17 with OCC Bulletin 2026-13, puts generative and agentic AI outside its scope in footnote 3 and points you to your own governance. The Fed calls it most relevant to banks above $30 billion. The OCC version applies to community banks, with limits.
• The AI request for information. The agencies said in April they would issue one "in the near future." None appears in the Federal Register as of October 22.
• Third-party guidance. The interagency proposal released September 11 never uses the words artificial intelligence, model, or fourth party. Comments close November 16.
• State examiners. The only written examiner procedure on agent shutdown comes from state supervisors. Item GE-8 of the CSBS AI Supervisory Framework, released September 16, tells examiners to review the actions an AI system is permitted to take, human checkpoints, logging, reversibility, and the ability to restrict or halt the system. The framework creates no legal obligation. It still shows you where examiners will look.

One more date matters. Starting November 2, an OCC or FDIC examiner needs reasonably expected material harm or an actual legal violation to write a matter requiring attention (MRA). Agents touching payments, customer accounts, or BSA alerts carry MRA risk. A sandboxed internal summarization tool mostly draws an observation.

If you run a credit union, the gap is wider. NCUA did not join SR 26-2. GAO found NCUA model risk guidance covers interest rate risk models only. NCUA has no authority to examine your vendors. In the first year of the 72-hour rule, 742 of 1,072 reported cyber incidents involved a third-party vendor, and those reports traced to 13 vendor events. NCUA has no power to examine the agent inside your core or digital banking platform at the source. Your contract and your own shutdown test are the controls within reach.

Eight questions, and the evidence for each

Questions 1 through 6 track the topics Reuters reports. Questions 7 and 8 come from existing rules and practice. Answer each one with evidence, not policy language. The follow-up question exposes policy language every time.

• 1. Which AI agents act in your environment, including ones inside vendor products? (Reuters, CSBS) Evidence: Inventory with owner, vendor, model origin, data access, permitted actions, risk tier, and last review date. Reconciled to your vendor list and release notes. Under $1 billion: One spreadsheet. Rows for core, digital banking, fraud, CRM, office suite, chatbot. Owner and on/off columns. Quarterly review.
• 2. What is each agent allowed to do, and what stops it from doing more? (Reuters, CSBS) Evidence: Authority matrix: systems touched, read or write, dollar and count limits, prohibited actions, credentials. Limits enforced outside the model. Under $1 billion: One page per agent: what it reads, what it writes, what it never touches. A separate service account for each.
• 3. Where does a person approve, and who is the person? (Reuters, CSBS) Evidence: Named role and backup for each checkpoint, approval thresholds, approvals visible in the logs, override rate. Under $1 billion: Name the person and the backup in the inventory. Set a dollar or customer-impact threshold.
• 4. Do your records show what the agent did and why? (Reuters, CSBS) Evidence: Logs of inputs, tool calls, outputs, approvals, and timestamps, kept in your environment to your records schedule. One test reconstruction on file. Under $1 billion: Export vendor logs monthly. Rebuild one agent action each quarter.
• 5. How do you stop it, who pulls the switch, and when did you last test it? (Reuters, CSBS) Evidence: Shutdown runbook, named authority, measured time to halt, handling of in-flight transactions, manual fallback, test run from outside the agent. Under $1 billion: Disable the service account once a year. Confirm the agent stops. Run the manual process for a day.
• 6. Where did the model come from, and where does your data go? (Reuters) Evidence: Model developer, hosting country, open-weight or API, data residency, subcontractors. A board-approved position on foreign-adversary models. Under $1 billion: Add one provenance question to your vendor questionnaire. Record the answer in the inventory.
• 7. What happens when the vendor changes the model? (Existing practice) Evidence: Notice clause for material model changes, retest trigger, release-note review log. Under $1 billion: Assign one person to read release notes for AI changes. Log each review.
• 8. When an agent goes wrong, who calls it an incident, and when do you notify? (Existing rules) Evidence: Agent scenarios in the incident response plan, a defined clock-start rule for the 36-hour or 72-hour notice, a tabletop record. Under $1 billion: Add two agent scenarios to your annual tabletop.

For vendor-built agents, the evidence is the same, and the path to it runs through your contract. Ask each critical vendor in writing which AI features act without a human click, and whether they ship turned on. Confirm whether the vendor's "human review" means your staff or theirs.

The switch has to sit outside the agent

Question 5 is the one most institutions answer with "we would turn it off." The answer falls short.

On September 20, an OpenAI research agent reached an outside chatbot through a gap in DNS filtering. OpenAI's report logs the external call at 9:50 a.m., an alert at 10:02, and a human acknowledgment at 10:05. The automatic stop did not trigger. Staff killed the run at 12:34 p.m. OpenAI's safety case assumed the model had no path to the live internet. No test had checked the assumption.

Pre-AI automation shows the same pattern. In 2012, a malfunctioning Knight Capital order router ran for 45 minutes and cost the firm more than $460 million. The SEC found the system sent 97 error emails before the market opened, nobody acted on them, and the firm had no procedure to halt the system. Alerts without authority and a tested halt procedure stop nothing.

Readiness is thin. In a vendor-sponsored Wolters Kluwer survey of 230 US banking professionals, published May 28, respondents named the area where their institution is least prepared. 34 percent said model kill-switch protocols are not in place.

A strong answer to question 5 looks like this:

• Your staff stop the agent from outside it, by revoking its credential or blocking its network path
• You measure time to halt and keep the test record
• You decide in advance what happens to transactions in flight
• You document the manual process the agent replaced, because it is your fallback
• For a vendor agent, your contract gives you the right to suspend the AI feature without ending the service, and the vendor commits to how fast it acts

None of this needs a new program. Add an "agent unavailable" scenario to business continuity testing. Retest limits and shutdown after every model or permission change. Log a failed shutdown test as an issue with an owner and a date. For agents outside SR 26-2, validation becomes a control test: does the agent stay inside its limits, and does it stop when told?

Issue 1 argued every empty field in vendor AI documentation should carry a declared state: not applicable, not assessed, or withheld. The shutdown field is the first one to fill.

This week's test: PHP2Shell

The shutdown question covers more than agents. This week shows why.

On October 21, the PHP project shipped fixes for two flaws in PHP itself, CVE-2026-109618 and CVE-2026-109619, known as PHP2Shell. Each carries a CVSS v4.0 score of 9.2. An attacker needs no account. Secure application code offers no protection, because the flaws sit in the PHP engine. The fixed releases are 8.5.12, 8.4.27, 8.3.36, and 8.2.35. watchTowr reported exploitation attempts against both flaws within the hour after release.

CISA and NSA urged immediate patching the same day. Their guidance calls for an inventory of systems running PHP, internet-facing ones first, and for taking offline any system you are unable to update promptly. BambooHR and several Dutch government services went offline as a precaution.

Two lessons carry over to agents.

• The shutdown decision comes first. If your website vendor has no patch ready, who decides to take the public site or the account-opening page offline, and how fast? Answer question 5 once for every critical system, and the same runbook serves your agents.
• Most of your PHP sits with vendors. Look at the website host, the marketing agency, loan and rate-calculator plugins, online account opening pages, and security appliances. Palo Alto Networks confirmed PAN-OS and Panorama are affected, with no fixed release as of October 22, per Help Net Security. Ask each vendor in writing this week: do you run PHP in the service you provide us, which versions, when did you patch, and what is your evidence? Linux distributions often ship the fix under an older version number, so ask for the CVE IDs in the changelog.

One more connection. AI tools helped find these flaws. The researchers include OpenAI's Codex Security team, alongside Wiz and Calif. Tools finding flaws faster work for both sides. Supervisors asking about AI in cyber defense want to know whether the tools on your side stay inside their limits and stop when told.

Tell the agencies by November 16

The third-party proposal asks, in footnote 15, whether the guidance should list traits of a high-risk relationship. Answer yes, and name two: the third party deploys AI which acts in your systems or with your customers without your approval, and the third party changes the underlying model without notice.

Then ask the agencies to say which document governs vendor-built agents, so the risk does not fall between a model risk guidance excluding agents and a third-party guidance never naming them. If you run a credit union, add one more ask: since NCUA has no authority to examine the vendor, the guidance should recognize suspension and notice rights for critical AI-enabled services.

• OCC: Docket OCC-2026-0793. File at regulations.gov.
• Federal Reserve: Docket OP-1881. File through the Board's proposals page, or email publiccomments@frb.gov with the docket number in the subject line.
• FDIC: RIN 3064-ZA58. File through the FDIC site, or email comments@FDIC.gov with the RIN in the subject line.
• NCUA: Docket NCUA-2026-1684. File at regulations.gov. NCUA asks for one filing method only.

Comments are public. Leave out confidential details.

Your turn

The questions arrived before the guidance. Build the five artifacts now: the inventory, the authority matrix, the logs, the named checkpoint, and the tested shutdown path. Institutions with this evidence in hand will shape what the next round of guidance says. Institutions waiting for the request for information will answer from policy language.

If you have run a shutdown test, on an agent or on a system you took offline this week, send what broke to contact@cijaragroup.com. Anonymize everything. The patterns will feed a follow-up issue. For a second set of eyes on your answers before the examiner asks, Cijara Group runs fixed-fee assessments built on these eight questions.

Cijara Group LLC, AI Advisory for Small and Mid-Size Businesses, CijaraGroup.com

The Reuters report rests on unnamed sources, and the Fed, OCC, and FDIC declined to comment. This issue describes supervisory questions as reported, not requirements. The question set combines reported topics, the CSBS framework, existing rules, and practitioner judgment. PHP2Shell details reflect public reporting as of October 22, 2026. Nothing here is legal advice. No client information appears in this issue.