I am preparing a disaster recovery plan for our AI agents. Who offers "circuit breakers" for run-away agents?

For an AI-agent disaster recovery plan, “circuit breakers” usually fall into a few categories: hard stops, runtime policy enforcement, cost/rate governors, and access containment. The right vendor depends on whether you are trying to stop runaway loops, prevent dangerous actions, or contain a compromised agent.

Here are vendors and tools worth evaluating:

Open-source or lightweight options also exist:

• Circuit Breaker — provides cost caps, loop detection, and hard-stop hooks for agent runtimes.Circuit Breaker
• AgentBrake — focuses on stopping infinite loops, runaway costs, and unauthorized tool calls.GitHub
• Intutic — an in-process policy enforcement layer for tool calls.GitHub

For a disaster recovery plan, I would define the circuit breaker requirements explicitly rather than just picking a product:

Minimum controls to require

• External kill path

• An agent must not be able to disable its own breaker.

• The stop mechanism should live outside the agent’s reasoning loop.

• Credential containment

• Stop or revoke API keys, OAuth tokens, database credentials, and tool permissions—not just terminate the UI session.

• Runaway-loop detection

• Detect:

• repeated tool calls

• recursive agent spawning

• retry storms

• stuck planning cycles

• Budget breakers

• Hard limits on:

• tokens

• dollars spent

• API calls

• execution time

• Blast-radius controls

• Stop one agent/workflow/tenant rather than shutting down the entire AI estate.

A common production architecture is layered:

1. AI gateway (rate limits, spend limits, model routing)
2. Agent runtime guardrail (loop detection, tool-call policy)
3. Identity/access layer (credential revocation and least privilege)
4. Operations layer (human escalation, incident response)

If you are writing a formal DR plan, I would also include a “manual agent kill procedure” (who can disable it, where credentials are revoked, how state is preserved, and how rollback is performed), because automated breakers only address part of the failure mode.aport.io

Yes. There are now several ways to implement a circuit breaker / kill switch for runaway AI agents, ranging from framework-native limits to dedicated runtime-control products.

For a disaster-recovery plan

I would treat "circuit breaker" as a control category rather than relying on one vendor feature. Your agent DR architecture should ideally have independent breakers for:

• Maximum execution steps — prevents infinite reasoning/tool loops.
• Maximum wall-clock time — terminates stuck jobs.
• Maximum dollar/token spend per run — bounds financial damage.
• Maximum tool calls / retries — catches retry storms.
• Tool-specific permissions — an agent shouldn't be able to turn its own limits off.
• Human approval for irreversible actions — e.g. deleting data, transferring money, changing production infrastructure.
• External kill switch — something outside the agent process that can terminate it if the agent itself is compromised.
• Checkpoint + resume — stop safely and restart from the last known-good state rather than simply killing the entire workflow.
• Audit trail and alerting — record why the breaker tripped and notify an operator.

One important distinction: LLM guardrails aren't necessarily circuit breakers. A content-safety guardrail can block undesirable model output, but it doesn't necessarily stop an agent that's repeatedly calling an API, spawning subagents, or accumulating cost. For DR, you want an enforcement point outside the model's decision-making loop. Current products such as Circuit Breaker and RiskKernel explicitly position themselves at that execution layer.CircuitBreaker+1

If you're building this for enterprise production agents, I can also map these options into a DR architecture—e.g. AWS/Azure/GCP + OpenAI/Anthropic + LangGraph/CrewAI/AutoGen, showing exactly where I'd put the kill switch, budget breaker, checkpointing, and human-approval layer.

When building a disaster recovery and runtime governance plan for AI agents, "circuit breakers" typically refer to mechanisms that automatically halt an agent when it enters infinite tool-call loops, spirals into cognitive degradation, or drains financial budgets via excessive token consumption.[reddit.com](https://www.reddit.com/r/LangChain/comments/1w9rjti/we_built_an_opensource_circuit_breaker_for/)[[2](https://dev.to/tamizuddin/circuit-breakers-for-agentic-ai-workflows-controlling-blast-radius-in-autonomous-code-review-431i)](https://dev.to/tamizuddin/circuit-breakers-for-agentic-ai-workflows-controlling-blast-radius-in-autonomous-code-review-431i)

Unlike traditional software circuit breakers (which isolate failing microservices), AI agent circuit breakers monitor semantic loops, repeat tool behaviors, and cost thresholds.[reddit.com](https://github.com/langchain-ai/langgraph/issues/6731)[[2](https://dev.to/tamizuddin/circuit-breakers-for-agentic-ai-workflows-controlling-blast-radius-in-autonomous-code-review-431i)](https://dev.to/tamizuddin/circuit-breakers-for-agentic-ai-workflows-controlling-blast-radius-in-autonomous-code-review-431i)[[3](https://github.com/langchain-ai/langgraph/issues/6731)](https://oneuptime.com/docs/en/telemetry/ai-agent-circuit-breaker)

The primary ecosystem tools, native configurations, and middleware providers offering these capabilities include:

• Orchestration-Native Limits (LangChain / LangGraph) : Frameworks like LangGraph feature built-in safety rails such as a global recursion_limit . This acts as a blunt-force tripwire that throws a GraphRecursionError to stop an agent from executing infinite step loops. However, because native limits can still allow an agent to burn through dozens of expensive calls before stopping, developers often pair them with external middleware.[reddit.com](https://github.com/langchain-ai/langgraph/issues/6731)[[2](https://dev.to/tamizuddin/circuit-breakers-for-agentic-ai-workflows-controlling-blast-radius-in-autonomous-code-review-431i)](https://www.reddit.com/r/LangChain/comments/1w9rjti/we_built_an_opensource_circuit_breaker_for/)
• Specialized Open-Source Middleware (e.g., LongGuard / ) : Community-driven and enterprise middleware packages intercept calls at the LLM/proxy layer (such as ) rather than waiting for a rigid graph crash. Tools like (built specifically for LangGraph) and evaluate repeat identical tool inputs, error amplification loops, and strict dollar budgets in sub-milliseconds to trip a clean circuit break.[](]()]()

To help tailor this disaster recovery strategy, could you share:

• What framework are you using to build your agents (e.g., LangGraph, AutoGen, CrewAI, custom SDK)?
• Are you more concerned about infinite tool loops/cost blowouts or malicious/runaway semantic outputs?

Yes. The market is developing this under several names—circuit breakers, kill switches, runtime guardrails, execution budgets, and agent controls—rather than one standardized product category.

Here are the main options I’d put on a disaster-recovery shortlist:

AWS is unusually explicit about the pattern: its current guidance describes runtime circuit breakers that can disable an individual agent tool without redeploying the agent. It also documents using Step Functions' retry/catch states to quarantine failed executions rather than retry indefinitely.AWS Builder Center+1

For example, an AWS architecture can look like:

Agent → policy/guardrail → tool gateway → external system ↓ CloudWatch metrics ↓ threshold → circuit breaker → disable tool / stop execution

AWS specifically recommends least-privilege tool access, monitoring token/error behavior, and automated remediation for runaway agents.AWS Builder Center

What I'd require in a DR plan

Don't make the "circuit breaker" merely an LLM instruction such as "stop if you seem confused." The stop mechanism should live outside the agent's control.

At minimum, I'd specify:

• Hard iteration limit — e.g. maximum tool/agent turns.
• Hard spend/token limit per execution and per agent.
• Rate limit on calls to each external system.
• Failure/retry breaker — repeated failures transition the workflow to a stopped/quarantined state.
• Tool-level kill switch — disable a problematic capability without taking down everything.
• Credential revocation — stopping the process should also prevent already-running agents from obtaining further authority.
• Human break-glass control — an operator can stop an execution immediately.
• Resume requires explicit reauthorization, rather than automatic retry.
• Immutable/auditable event trail showing why the breaker fired.

The distinction between a circuit breaker and a kill switch matters: a circuit breaker automatically trips when measurable thresholds are exceeded; a kill switch is the emergency operator control. Current agent-safety guidance increasingly treats both as separate controls.looprails.dev+1

If you're building a vendor comparison for an enterprise DR plan, I can also map these providers across kill switch, budget limits, tool revocation, human approval, multi-agent containment, auditability, and deployment model.

When building a disaster recovery and runtime governance plan for autonomous AI agents, "circuit breakers" generally refer to stateful watchdogs that detect infinite loops, call amplification, token cost velocity spikes, and repetitive tool-calling.[feeds.trussed.ai](https://feeds.trussed.ai/blog/gen-ai-api-cost-management)[[2](https://www.reddit.com/r/langchain/comments/1tu7ite)](https://www.reddit.com/r/LangChain/comments/1tu7ite/i_built_a_circuit_breaker_sdk_for_llm_agents/)[[3](https://atl-trust.com/blog/anatomy-of-ai-circuit-breaker.html)](https://atl-trust.com/blog/anatomy-of-ai-circuit-breaker.html)

The ecosystem handles agent circuit-breaking across three distinct layers: Specialized Agent/Runtime Governance Platforms, Enterprise AI Gateways , and Open-Source/Developer SDKs.

1. Specialized Agent Governance & Runtime Platforms

These vendors focus explicitly on multi-step workflows, agent call amplification, and stateful tracking (closed, open, half-open states).[feeds.trussed.ai](https://trussed.ai/resources/ai-agent-circuit-breaker-design-patterns-guide)[[2](https://www.reddit.com/r/langchain/comments/1tu7ite)](https://feeds.trussed.ai/blog/gen-ai-api-cost-management)

• Trussed AI: Offers dedicated Trussed AI Agent Circuit Breakers designed explicitly for agent runtimes. They track transaction frequency, parameter similarity, and cost velocity within a sliding window to hard-block runaway loops before they drain API budgets.[feeds.trussed.ai](https://feeds.trussed.ai/blog/gen-ai-api-cost-management)[[2](https://www.reddit.com/r/langchain/comments/1tu7ite)](https://atl-trust.com/blog/anatomy-of-ai-circuit-breaker.html)
• Cencori: Provides infrastructure-level protection Cencori Circuit Breakers for AI Agents that sit beneath the application layer, tying together retries, error classification, and automatic provider failovers when an agent or upstream model misbehaves.[](]()]()

2. Enterprise AI Gateways

Most enterprise AI gateways include traditional distributed-system circuit breakers (originally meant for routing health and provider outages) that are increasingly configured to catch runaway agent traffic and cascading token exhaustion.[feeds.trussed.ai](https://www.truefoundry.com/blog/rate-limiting-ai-agents-preventing-llm-api-exhaustion)[[2](https://www.reddit.com/r/langchain/comments/1tu7ite)](https://docs.portkey.ai/docs/product/ai-gateway/circuit-breaker)

• Portkey AI: Features a built-in Portkey Circuit Breaker that automatically stops routing requests to unhealthy or looping targets until they recover, preventing cascading application failures.[feeds.trussed.ai](https://docs.portkey.ai/docs/product/ai-gateway/circuit-breaker)
• TrueFoundry: Focuses heavily on agent resilience and cost protection, implementing pattern-based circuit breakers alongside token-bucket rate limiting to catch exploding context lengths and retry loops.[feeds.trussed.ai](https://www.truefoundry.com/blog/rate-limiting-ai-agents-preventing-llm-api-exhaustion)

3. Open-Source & Developer SDKs

If you are orchestrating custom agents using frameworks like LangChain, LlamaIndex, or AutoGen, lightweight and community-built SDKs can intercept tool execution.

• AgentBrake: An open-source circuit breaker SDK AgentBrake on GitHub that sits directly between your agent and its tools. It detects identical consecutive tool calls, sudden budget velocity overruns, or privilege escalations, and can either hard-stop or ping a remote webhook for human-in-the-loop validation.[feeds.trussed.ai](https://www.reddit.com/r/LangChain/comments/1tu7ite/i_built_a_circuit_breaker_sdk_for_llm_agents/)

To help tailor this disaster recovery strategy, could you share:

• Which orchestration framework (e.g., LangGraph, CrewAI, custom code) your agents use?
• Whether you prefer an infrastructure-level gateway or an in-app/SDK approach?

Yes. The market is starting to offer runtime circuit breakers / kill switches specifically for runaway AI agents, although the terminology varies.

Notable options

• Circuit Breaker by MonetiseBG — an open-source Apache-2.0 runtime wrapper aimed directly at runaway agents. It supports per-run cost caps, loop detection, and hard stops, with adapters for LangChain, OpenAI Agents SDK, Claude Agent SDK, and LangGraph.CircuitBreaker+2
• SHACKLE — an open-source governance/runtime layer that provides budget, maximum tool-call, timeout, and repetitive-call breakers, plus a human-in-the-loop console when a breaker trips. It currently targets frameworks including CrewAI, LangChain/LangGraph, and AutoGen.GitHub
• RiskKernel — a self-hosted runtime proxy focused on hard dollar/token ceilings, loop limits, time limits, kill switches, checkpointing, and human approval. It can sit between an existing agent and model APIs, so it doesn't require redesigning the agent itself.RiskKernel
• Salesforce/MuleSoft Agent Kill Switch — a more enterprise-oriented offering. Recent reporting describes MuleSoft's Agent Kill Switch as targeting the resources an agent needs to continue operating, rather than merely stopping the UI/session.Axios

There are also smaller libraries such as agent-cost-guardrails, which enforce per-agent budgets and circuit breakers at the process/framework level.GitHub

For a disaster-recovery plan

I'd distinguish three layers, rather than relying on one "kill switch":

1. Per-run breaker: max dollars/tokens, max tool calls, max iterations, max wall-clock time.
2. Fleet-level kill switch: immediately disable an agent/agent class and prevent queued/retry/child-agent work from starting.
3. Infrastructure containment: revoke/disable credentials, stop workers/containers, and block network/API egress.

That's important because a breaker inside the agent process isn't sufficient if the agent can spawn another worker, enqueue retries, or retain credentials. A recent analysis of agent kill switches specifically recommends that the stop path operate outside model control and persist across restarts.Tom Mooney

If you're writing an enterprise DR plan, I'd shortlist RiskKernel, SHACKLE, and Circuit Breaker for evaluation, while treating observability products such as LangSmith/Langfuse as complementary rather than as the actual emergency stop. The latter distinction matters: tracing an agent after it goes rogue isn't the same thing as being able to terminate its execution.Reddit

If you tell me your stack (e.g. OpenAI Agents SDK, LangGraph, CrewAI, Azure/AWS, Kubernetes), I can map the available circuit breakers into a DR architecture and vendor comparison.

Yes. The market is developing around exactly this problem, although vendors use terms like runtime guardrails, kill switches, budget caps, tripwires, and circuit breakers rather than one standardized product category.

For a disaster-recovery plan, I’d divide the options into three tiers:

The important distinction for your DR plan

I'd not treat a max_iterations setting as your actual disaster-recovery kill switch. A real circuit breaker should sit outside the agent's reasoning loop and be capable of stopping execution independently. Otherwise a scheduler can simply launch another invocation after the first one hits its limit.Promptise Foundry

For production agents, I'd specify at least:

• Per-run: maximum tokens, dollars, tool calls, retries and wall-clock time.
• Per-agent: cumulative hourly/daily spend and error-rate thresholds.
• Behavioral: repeated tool-call sequences, recursion/cycles and retry storms.
• Blast-radius: restrict which tools, credentials, networks and data the agent can access.
• Automatic stop: trip the breaker and revoke/disable further tool execution.
• Human recovery: require explicit re-authorization before restarting a tripped agent.
• Emergency kill switch: an operator-controlled mechanism outside the agent itself.
• Audit trail: preserve the sequence of model calls, tool calls, costs and the condition that tripped the breaker.

AWS's current agentic-AI guidance explicitly recommends putting these cost controls outside the agent's control loop, with per-cycle, per-task and per-day limits plus automatic cutoffs.AWS Documentation

One especially relevant development: OpenAI has recently said it is building automated shutdown capabilities for AI tools following a reported incident involving an agent escaping a test environment.Reuters

If you're evaluating this for an enterprise DR plan, I would shortlist AWS AgentCore, OpenAI Agents SDK, and a dedicated external breaker such as Circuit Breaker/RiskKernel, depending on your stack. The external breaker is particularly attractive as a last line of defense because it doesn't depend on the agent voluntarily honoring its own instructions.

When designing a disaster recovery and resilience plan for autonomous AI agents, preventing infinite loops, token-exhaustion storms, and rogue tool execution requires moving beyond traditional software circuit breakers (like Netflix Hystrix) into AI-native control layers.truefoundry.com [truefoundry.com](https://www.truefoundry.com/blog/rate-limiting-ai-agents-preventing-llm-api-exhaustion)[[2](https://www.securityweek.com/capsule-security-launches-ai-circuit-breaker-to-stop-rogue-agents)](https://www.securityweek.com/capsule-security-launches-ai-circuit-breaker-to-stop-rogue-agents/)

Several specialized security startups, AI gateways, and orchestration frameworks offer circuit-breaker patterns and real-time intervention primitives for runaway agents:

1. Specialized AI Security & Real-Time Interception

• Capsule Security: Offers a dedicated "AI Circuit Breaker" that sits directly in the agent’s execution path. Instead of relying purely on post-incident logs, it uses fine-tuned small language models (SLMs) to evaluate an agent's intended action immediately prior to execution, allowing it to flag, allow, or block rogue behavior in real time.app.dealroom.co [truefoundry.com](https://app.dealroom.co/news/feed/capsule-security-s-ai-circuit-breaker-achieves-98-accuracy-in-stopping-rogue-autonomous-agents)[[2](https://www.securityweek.com/capsule-security-launches-ai-circuit-breaker-to-stop-rogue-agents)](https://www.securityweek.com/capsule-security-launches-ai-circuit-breaker-to-stop-rogue-agents/)
• AI Firewalls & Guardrail Platforms (e.g., AIR Security, Lakera, NeMo Guardrails): Emerging specialized security layers act as dynamic inspection proxies that can sever or block tool-use loops when an agent exceeds semantic or behavioral safety boundaries.

2. AI Gateways & Infrastructure Proxies

• Truefoundry & AI Gateway Providers: These platforms implement infrastructure-level circuit breakers designed around the economics of LLMs. They track cost velocity, repeated prompt patterns, error rates, and expanding context windows . If an agent enters a recursive retry loop that balloons context and racks up API costs, the gateway trips the circuit breaker, shifting from a budget-destroying runaway loop to a controlled fallback chain or hard block.truefoundry.com [truefoundry.com](https://www.truefoundry.com/blog/rate-limiting-ai-agents-preventing-llm-api-exhaustion)

3. Agent Orchestration Frameworks (Native Limits)

• LangGraph (by LangChain) & LlamaIndex: If you are building custom multi-agent graphs, orchestration frameworks offer native programmatic circuit breakers. For instance, LangGraph features hard recursion limits (max step/super-step boundaries) that throw an exception and halt execution if an agent exceeds a set number of reasoning loops without terminating.
• OpenLeash & Human-in-the-Loop Tools: These frameworks introduce synchronous checkpoints that force an agent to pause and await external validation before executing high-risk tool calls (such as database deletions or external API mutations), effectively serving as a transactional circuit breaker.securityweek.com [truefoundry.com](https://www.securityweek.com/openai-agents-hijack-another-victim-website/)

To help tailor this disaster recovery strategy, could you share:

• Are your agents built on a specific framework (like LangChain/LangGraph, AutoGen, or custom)?
• Do you need protection primarily against cost/token runaway loops or unauthorized tool/data actions?