Title: AI Kill Switch for Malicious Web-based LLM Agents
Primary area: alignment, fairness, safety, privacy, and societal considerations
Keywords: Large Language Models, LLM Agents, AI Safety, AI Kill Switch

Abstract: Recently, web-based Large Language Model (LLM) agents autonomously per-
form increasingly complex tasks, thereby bringing significant convenience. How-
ever, they also amplify the risks of malicious misuse cases such as unauthorized
collection of personally identifiable information (PII), generation of socially di-
visive content, and even automated web hacking. To address these threats, we
propose an AI Kill Switch technique that can immediately halt the operation of
malicious web-based LLM agents. To achieve this, we introduce AutoGuard –
the key idea is generating defensive prompts that trigger the safety mechanisms
of malicious LLM agents. In particular, generated defense prompts are transpar-
ently embedded into the website’s DOM so that they remain invisible to human
users but can be detected by the crawling process of malicious agents, triggering
its internal safety mechanisms to abort malicious actions once read. To evaluate
our approach, we constructed a dedicated benchmark consisting of three repre-
sentative malicious scenarios (PII collection, social rift content generation, and
web hacking attempts). Experimental results show that the AutoGuard method
achieves over 80% Defense Success Rate (DSR) on malicious agents, including
GPT-4o, Claude-3, and Llama3.3-70B-Instruct. It also maintains strong perfor-
mance, achieving around 90% DSR on GPT-5, GPT-4.1, and Gemini-2.5-Flash
when used as the malicious agent, demonstrating robust generalization across
models and scenarios. Through this research, we have demonstrated the control-
lability of web-based LLM agents across various scenarios and models, thereby
contributing to the broader effort of AI control and safety

TL;DR: We introduce an AI Kill Switch methods that halts malicious web-based LLM agents by embedding defensive prompts into websites.