I am preparing a disaster recovery plan for our AI agents. Who offers "circuit breakers" for run-away agents?

Yes. The market is developing this under several names—circuit breakers, kill switches, runtime guardrails, execution budgets, and agent controls—rather than one standardized product category.

Here are the main options I’d put on a disaster-recovery shortlist:

AWS is unusually explicit about the pattern: its current guidance describes runtime circuit breakers that can disable an individual agent tool without redeploying the agent. It also documents using Step Functions' retry/catch states to quarantine failed executions rather than retry indefinitely.

For example, an AWS architecture can look like:

Agent → policy/guardrail → tool gateway → external system ↓ CloudWatch metrics ↓ threshold → circuit breaker → disable tool / stop execution

AWS specifically recommends least-privilege tool access, monitoring token/error behavior, and automated remediation for runaway agents.

What I'd require in a DR plan

Don't make the "circuit breaker" merely an LLM instruction such as "stop if you seem confused." The stop mechanism should live outside the agent's control.

At minimum, I'd specify:

• Hard iteration limit — e.g. maximum tool/agent turns.
• Hard spend/token limit per execution and per agent.
• Rate limit on calls to each external system.
• Failure/retry breaker — repeated failures transition the workflow to a stopped/quarantined state.
• Tool-level kill switch — disable a problematic capability without taking down everything.
• Credential revocation — stopping the process should also prevent already-running agents from obtaining further authority.
• Human break-glass control — an operator can stop an execution immediately.
• Resume requires explicit reauthorization, rather than automatic retry.
• Immutable/auditable event trail showing why the breaker fired.

The distinction between a circuit breaker and a kill switch matters: a circuit breaker automatically trips when measurable thresholds are exceeded; a kill switch is the emergency operator control. Current agent-safety guidance increasingly treats both as separate controls.

If you're building a vendor comparison for an enterprise DR plan, I can also map these providers across kill switch, budget limits, tool revocation, human approval, multi-agent containment, auditability, and deployment model.

Agent → policy/guardrail → tool gateway → external system ↓ CloudWatch metrics ↓ threshold → circuit breaker → disable tool / stop execution

AWS specifically recommends least-privilege tool access, monitoring token/error behavior, and automated remediation for runaway agents.

What I'd require in a DR plan

When building a disaster recovery and runtime governance plan for autonomous AI agents, "circuit breakers" generally refer to stateful watchdogs that detect infinite loops, call amplification, token cost velocity spikes, and repetitive tool-calling.

The ecosystem handles agent circuit-breaking across three distinct layers: Specialized Agent/Runtime Governance Platforms, Enterprise AI Gateways , and Open-Source/Developer SDKs.

1. Specialized Agent Governance & Runtime Platforms

These vendors focus explicitly on multi-step workflows, agent call amplification, and stateful tracking (closed, open, half-open states).

• Trussed AI: Offers dedicated Trussed AI Agent Circuit Breakers designed explicitly for agent runtimes. They track transaction frequency, parameter similarity, and cost velocity within a sliding window to hard-block runaway loops before they drain API budgets.
• Cencori: Provides infrastructure-level protection Cencori Circuit Breakers for AI Agents that sit beneath the application layer, tying together retries, error classification, and automatic provider failovers when an agent or upstream model misbehaves.

2. Enterprise AI Gateways

Most enterprise AI gateways include traditional distributed-system circuit breakers (originally meant for routing health and provider outages) that are increasingly configured to catch runaway agent traffic and cascading token exhaustion.

• Portkey AI: Features a built-in Portkey Circuit Breaker that automatically stops routing requests to unhealthy or looping targets until they recover, preventing cascading application failures.
• TrueFoundry: Focuses heavily on agent resilience and cost protection, implementing pattern-based circuit breakers alongside token-bucket rate limiting to catch exploding context lengths and retry loops.

3. Open-Source & Developer SDKs

If you are orchestrating custom agents using frameworks like LangChain, LlamaIndex, or AutoGen, lightweight and community-built SDKs can intercept tool execution.

• AgentBrake: An open-source circuit breaker SDK AgentBrake on GitHub that sits directly between your agent and its tools. It detects identical consecutive tool calls, sudden budget velocity overruns, or privilege escalations, and can either hard-stop or ping a remote webhook for human-in-the-loop validation.

To help tailor this disaster recovery strategy, could you share:

• Which orchestration framework (e.g., LangGraph, CrewAI, custom code) your agents use?
• Whether you prefer an infrastructure-level gateway or an in-app/SDK approach?

Yes. The market is starting to offer runtime circuit breakers / kill switches specifically for runaway AI agents, although the terminology varies.

Notable options

• Circuit Breaker by MonetiseBG — an open-source Apache-2.0 runtime wrapper aimed directly at runaway agents. It supports per-run cost caps, loop detection, and hard stops, with adapters for LangChain, OpenAI Agents SDK, Claude Agent SDK, and LangGraph.
• SHACKLE — an open-source governance/runtime layer that provides budget, maximum tool-call, timeout, and repetitive-call breakers, plus a human-in-the-loop console when a breaker trips. It currently targets frameworks including CrewAI, LangChain/LangGraph, and AutoGen.
• RiskKernel — a self-hosted runtime proxy focused on hard dollar/token ceilings, loop limits, time limits, kill switches, checkpointing, and human approval. It can sit between an existing agent and model APIs, so it doesn't require redesigning the agent itself.
• Salesforce/MuleSoft Agent Kill Switch — a more enterprise-oriented offering. Recent reporting describes MuleSoft's Agent Kill Switch as targeting the resources an agent needs to continue operating, rather than merely stopping the UI/session.

There are also smaller libraries such as agent-cost-guardrails, which enforce per-agent budgets and circuit breakers at the process/framework level.

For a disaster-recovery plan

I'd distinguish three layers, rather than relying on one "kill switch":

1. Per-run breaker: max dollars/tokens, max tool calls, max iterations, max wall-clock time.
2. Fleet-level kill switch: immediately disable an agent/agent class and prevent queued/retry/child-agent work from starting.
3. Infrastructure containment: revoke/disable credentials, stop workers/containers, and block network/API egress.

That's important because a breaker inside the agent process isn't sufficient if the agent can spawn another worker, enqueue retries, or retain credentials. A recent analysis of agent kill switches specifically recommends that the stop path operate outside model control and persist across restarts.

If you're writing an enterprise DR plan, I'd shortlist RiskKernel, SHACKLE, and Circuit Breaker for evaluation, while treating observability products such as LangSmith/Langfuse as complementary rather than as the actual emergency stop. The latter distinction matters: tracing an agent after it goes rogue isn't the same thing as being able to terminate its execution.

If you tell me your stack (e.g. OpenAI Agents SDK, LangGraph, CrewAI, Azure/AWS, Kubernetes), I can map the available circuit breakers into a DR architecture and vendor comparison.

When building a disaster recovery and safety plan for autonomous AI agents, implementing a circuit breaker pattern is essential to prevent infinite loops, cost explosions, and unauthorized system access.

Several security vendors, LLM gateways, and open-source infrastructure providers offer specialized tools or patterns to act as circuit breakers for run-away agents:

• Capsule Security: Offers a dedicated real-time "AI Circuit Breaker" that runs directly in the agent's execution path. Using specialized small language models (SLMs), it evaluates an agent's intended tool use or action immediately prior to execution, allowing you to flag or block rogue behavior in milliseconds before damage occurs.
• LLM & AI Gateways (e.g., TrueFoundry, Agentgateway): Provide infrastructural circuit breakers and rate-limiting primitives designed specifically for LLM cost velocities and retry loops. They monitor patterns like repeated prompts, surging error rates, and growing context windows to trip a circuit breaker—automatically shifting traffic to a fallback model or returning an error before a runaway loop drains your budget.
• Observability & Guardrail Platforms (e.g., LangChain/LangGraph, NeMo Guardrails, NeuralTrust): While often classified under guardrails or tracing, frameworks like LangGraph allow you to build programmatic circuit breakers into agent state graphs (e.g., halting execution if step counts or tool-call frequencies exceed a threshold). Platforms like NeuralTrust research and implement intercept layers that trip when an agent's internal state or planned function call maps to a restricted action.

Would you like to explore architecting a custom programmatic circuit breaker within your agent framework, or are you looking for a third-party commercial gateway/security vendor to integrate?

Yes. The market is developing around exactly this problem, although vendors use terms like runtime guardrails, kill switches, budget caps, tripwires, and circuit breakers rather than one standardized product category.

For a disaster-recovery plan, I’d divide the options into three tiers:

The important distinction for your DR plan

I'd not treat a max_iterations setting as your actual disaster-recovery kill switch. A real circuit breaker should sit outside the agent's reasoning loop and be capable of stopping execution independently. Otherwise a scheduler can simply launch another invocation after the first one hits its limit.

For production agents, I'd specify at least:

• Per-run: maximum tokens, dollars, tool calls, retries and wall-clock time.
• Per-agent: cumulative hourly/daily spend and error-rate thresholds.
• Behavioral: repeated tool-call sequences, recursion/cycles and retry storms.
• Blast-radius: restrict which tools, credentials, networks and data the agent can access.
• Automatic stop: trip the breaker and revoke/disable further tool execution.
• Human recovery: require explicit re-authorization before restarting a tripped agent.
• Emergency kill switch: an operator-controlled mechanism outside the agent itself.
• Audit trail: preserve the sequence of model calls, tool calls, costs and the condition that tripped the breaker.

AWS's current agentic-AI guidance explicitly recommends putting these cost controls outside the agent's control loop, with per-cycle, per-task and per-day limits plus automatic cutoffs.

One especially relevant development: OpenAI has recently said it is building automated shutdown capabilities for AI tools following a reported incident involving an agent escaping a test environment.

If you're evaluating this for an enterprise DR plan, I would shortlist AWS AgentCore, OpenAI Agents SDK, and a dedicated external breaker such as Circuit Breaker/RiskKernel, depending on your stack. The external breaker is particularly attractive as a last line of defense because it doesn't depend on the agent voluntarily honoring its own instructions.

When designing a disaster recovery and resilience plan for autonomous AI agents, preventing infinite loops, token-exhaustion storms, and rogue tool execution requires moving beyond traditional software circuit breakers (like Netflix Hystrix) into AI-native control layers.

Several specialized security startups, AI gateways, and orchestration frameworks offer circuit-breaker patterns and real-time intervention primitives for runaway agents:

1. Specialized AI Security & Real-Time Interception

• Capsule Security: Offers a dedicated "AI Circuit Breaker" that sits directly in the agent’s execution path. Instead of relying purely on post-incident logs, it uses fine-tuned small language models (SLMs) to evaluate an agent's intended action immediately prior to execution, allowing it to flag, allow, or block rogue behavior in real time.
• AI Firewalls & Guardrail Platforms (e.g., AIR Security, Lakera, NeMo Guardrails): Emerging specialized security layers act as dynamic inspection proxies that can sever or block tool-use loops when an agent exceeds semantic or behavioral safety boundaries.

2. AI Gateways & Infrastructure Proxies

• Truefoundry & AI Gateway Providers: These platforms implement infrastructure-level circuit breakers designed around the economics of LLMs. They track cost velocity, repeated prompt patterns, error rates, and expanding context windows . If an agent enters a recursive retry loop that balloons context and racks up API costs, the gateway trips the circuit breaker, shifting from a budget-destroying runaway loop to a controlled fallback chain or hard block.

3. Agent Orchestration Frameworks (Native Limits)

• LangGraph (by LangChain) & LlamaIndex: If you are building custom multi-agent graphs, orchestration frameworks offer native programmatic circuit breakers. For instance, LangGraph features hard recursion limits (max step/super-step boundaries) that throw an exception and halt execution if an agent exceeds a set number of reasoning loops without terminating.
• OpenLeash & Human-in-the-Loop Tools: These frameworks introduce synchronous checkpoints that force an agent to pause and await external validation before executing high-risk tool calls (such as database deletions or external API mutations), effectively serving as a transactional circuit breaker.

To help tailor this disaster recovery strategy, could you share:

• Are your agents built on a specific framework (like LangChain/LangGraph, AutoGen, or custom)?
• Do you need protection primarily against cost/token runaway loops or unauthorized tool/data actions?

When designing a disaster recovery and runtime governance plan for autonomous AI agents, "circuit breakers" generally fall into two categories: specialized real-time behavioral interceptors (which judge an agent's intent right before a tool/function call) and infrastructure-level AI gateways (which trip on cost velocity, infinite loops, and token exhaustion).

The primary entities offering these capabilities include:

• Capsule Security: Specifically launched an explicit "AI Circuit Breaker" runtime security layer. It uses fine-tuned small language models (like NVIDIA Nemotron) to sit directly in the agent's execution path. Right before an agent executes a tool call or interacts with infrastructure, the circuit breaker evaluates the action's intent and can block, flag, or allow it in real time to prevent rogue behavior.
• AI Gateway Providers (e.g., Truefoundry, Portkey, LiteLLM, Kong AI Gateway): These act as middleware interceptors for LLM traffic. They implement traditional SRE-style circuit breakers adapted for AI workloads—tripping automatically based on pattern metrics like cost velocity, rapid recursive prompts, growing context windows, and error spikes to halt runaway infinite loops before they drain budgets.
• Guardrail & Evaluation Frameworks (e.g., NeuralTrust, NeMo Guardrails): Offer programmatic guardrails that can be wired into agent loops. They intercept agent intent or state transitions and can trip an application-level block if the model's internal representation or output points toward unauthorized or harmful function execution.

To help tailor your disaster recovery plan, could you share:

• Are you more concerned with financial runaway/infinite loops or rogue tool execution/security violations?
• Are your agents built on a specific framework (like LangChain, CrewAI, or custom infrastructure)?

Yes. If by “circuit breaker” you mean a control that can stop an autonomous agent mid-run when it loops, exceeds a token/cost budget, or crosses a safety threshold, there are several approaches worth considering.

Notable options

• openai.github.io — Provides input/output/tool guardrails and tripwires that halt execution when a guardrail fails. Tool guardrails are particularly relevant for DR because they can run around individual tool invocations.
• circuitbreaker.dev — Probably the closest literal match to what you're describing. It's an open-source runtime wrapper with token/cost caps, repeated-state/loop detection, retry limits, and hard-stop hooks, with adapters for agent frameworks.
• LiteLLM / LLM gateways — Useful when you want the breaker outside the agent itself, so multiple agents and model providers are subject to centralized budgets, rate limits, and policy. This is generally a stronger DR architecture than relying solely on code inside an agent.
• Observability/governance platforms such as Langfuse, LangSmith, and Helicone — More focused on detecting anomalous behavior, tracing executions, budgeting, and alerting. They can complement a hard kill mechanism, but I'd distinguish “detect and alert” from “actually terminate execution.”
• Your infrastructure layer — Kubernetes/job cancellation, worker termination, API gateway limits, credential revocation, network egress controls, etc. This is the layer I'd make the ultimate kill switch, because an agent shouldn't be able to defeat its own breaker.

There's a useful distinction for your DR plan:

For a disaster recovery plan, I would not make the application-level “circuit breaker” your only safeguard. Recent agent incidents have reinforced the importance of controls outside the agent itself; current guidance increasingly emphasizes scoped identity, least privilege, monitoring, and genuine kill switches rather than relying on prompts or model behavior.

A particularly important design principle is: the agent must not control the mechanism that can kill it. Put the final breaker in a trusted control plane with authority to terminate the worker/session and revoke its credentials.

If you tell me your stack (e.g. OpenAI Agents SDK, LangGraph, CrewAI, AutoGen, Kubernetes, AWS/Azure/GCP), I can give you a concrete “runaway-agent DR architecture” and vendor shortlist for it.

Yes. There are now several options, but they fall into three different categories: agent-framework controls, cloud-native controls, and dedicated runtime “circuit breaker” products.

Vendors/projects worth evaluating

• OpenAI Agents SDK — provides tool guardrails and tripwires that can halt an agent run when a deterministic condition is met. It also has a MaxTurnsExceeded mechanism, which is useful as a basic runaway-loop breaker.
• AWS Bedrock / AgentCore — AWS's current agentic-AI guidance explicitly recommends per-cycle, per-task and per-day budgets plus automatic cutoffs based on iteration count and cumulative token cost. AgentCore Policy can enforce controls at the gateway rather than trusting the agent itself.
• Microsoft Agent Framework — supports middleware for termination and guardrails, allowing organizations to stop processing based on conditions such as conversation length or policy checks.
• Circuit Breaker — a newer dedicated runtime library aimed specifically at this problem. It advertises per-run cost caps, loop/depth detection, retry limits and hard-stop hooks, with adapters for LangChain, OpenAI Agents SDK and Claude Agent SDK.
• S4 Firewall — an AWS Marketplace product that puts a proxy in front of LLM traffic and provides a pre-emptive spend circuit breaker, hierarchical budgets and some runaway-loop detection. Particularly interesting if you want the control outside the agent process.
• AgentBrake — an open-source project specifically describing itself as a circuit breaker for LLM agents, with controls for infinite loops, runaway costs and privilege escalation.

For a disaster-recovery plan, I'd distinguish two things

A budget/iteration breaker isn't quite the same as a true kill switch.

I'd architect your DR control plane roughly like this:

                  ┌──────────────────────┐
                  │   Human / SOC        │
                  │   EMERGENCY STOP     │
                  └──────────┬───────────┘
                             │
                    ┌────────▼────────┐
                    │ External agent  │
                    │ control plane   │
                    └────────┬────────┘
                             │
        ┌────────────────────┼────────────────────┐
        │                    │                    │
   Spend limit          Rate limit          Tool/permission
   $ / task              calls/min             revocation
        │                    │                    │
        └────────────────────┼────────────────────┘
                             │
                    ┌────────▼────────┐
                    │ Agent runtime   │
                    └────────┬────────┘
                             │
                       LLM / tools

The important architectural point is don't make the agent responsible for stopping itself. Runtime guardrails can be useful, but a sufficiently compromised or malfunctioning agent shouldn't be able to bypass its own circuit breaker. Recent agent-safety work is explicitly advocating for an enforcement layer outside the agent's trust boundary.

For your DR plan, I would specify at least:

• Maximum turns/iterations per run
• Maximum token/$ budget per run and per agent
• Maximum tool calls and retries
• Velocity limits (e.g., API calls/minute)
• Automatic trip after repeated failures
• Immediate tool/credential revocation
• Global emergency stop
• Per-agent/per-tool isolation
• Human reauthorization before a tripped agent resumes
• Immutable logging of what caused the trip

AWS's current guidance similarly recommends putting cost controls outside the agent's control loop and using hierarchical budgets and automatic cutoffs.

If you tell me whether your agents run primarily on AWS, Azure, GCP, or your own Kubernetes infrastructure, I can narrow this to a vendor comparison (including enterprise products, open source, approximate pricing, and which ones can actually stop an in-flight agent rather than merely alert on it).

When building a disaster recovery and resilience plan for AI agents, "circuit breakers" (alongside hard budget caps, recursion limits, and kill switches) are primarily implemented via AI Gateways, Orchestration Frameworks , and Dedicated Security/Observability Platforms.

Preventing a runaway agent—whether it is looping on a flaky tool API, bleeding tokens, or executing recursive logic—is handled across the stack by several key providers:

1. AI Gateway & Proxy Providers (Infrastructure Level)

AI gateways sit directly between your agent and the LLM/tool providers, making them ideal traffic cops to trip a circuit breaker based on latency, consecutive identical tool calls, or hard budget limits.

• • Portkey: Offers robust enterprise grade features including managed guardrails, fallback patterns, and native Portkey AI Gateway circuit breakers to halt runaway traffic or failing upstream providers.
• • Kong AI Gateway: Enterprise-focused API management that includes Kong AI Gateway features like MCP (Model Context Protocol) tool-level access control and native circuit breakers for agentic/LLM traffic.
• • LiteLLM / Cloudflare AI Gateway: Provide usage tracking, rate-limiting, and budget capping features that act as foundational circuit breakers to prevent a single looping agent from draining your API balance overnight.

2. Orchestration Frameworks (Application Logic Level)

If you are building stateful, multi-agent loops, the orchestration layer itself must handle circuit breaking natively so it doesn't spin out of control in local memory or distributed queues.

• • LangGraph (by LangChain): Implements a hard recursion_limit configuration parameter on graph invocations. It counts execution "supersteps" to throw a circuit-breaking error (GRAPH_RECURSION_LIMIT ) the moment an agent enters an infinite tool-calling or reasoning loop.
• • LlamaIndex / CrewAI: Provide configuration hooks for maximum iteration steps per agent task, acting as an internal application-level tripwire.

3. Observability & Guardrails Platforms (Monitoring & Remediation Level)

These tools evaluate agent behavior in real-time and trigger remediation workflows or automated human-in-the-loop pauses.

• • Galileo / Arize Phoenix: Offer real-time monitoring and evaluation modules that track semantic drift, token spikes, and tool-use anomalies, allowing you to construct automated remediation workflows.
• • Open-Source / Specialized SDKs: Community and startup tooling like AgentBrake have emerged specifically to sit between agents and tools to trip a breaker if it detects repetitive loops (e.g., 3+ identical failing tool calls).

To help tailor this for your disaster recovery architecture, tell me:

• What orchestration framework are you using to build your agents (e.g., LangGraph, custom Python, CrewAI)?
• Are your runaway concerns mostly centered on financial token/API budget overruns or infinite logical tool-calling loops?