Anthropic wants California's attorney general to be able to go to court and suspend a dangerous AI model. OpenAI wants developers legally required to maintain — and use — their own shutdown controls. Those are the two proposals now sitting in front of Governor Gavin Newsom, as reported by Computerworld on October 29, 2026, and the difference between them is the sharpest public split yet between the two labs leading the frontier-model race.
The short answer for business leaders: whatever California decides by November 16 will become the de facto template for how enterprises govern, contract for, and eventually litigate AI agent failures. If you run agents in production, the "who can pull the plug" question is about to stop being theoretical.
The context: Newsom's executive order
Both submissions respond to California Executive Order N-9-26, issued by Governor Newsom on September 18, 2026, which directed state officials — the Government Operations Agency, in consultation with the Governor's Office of Emergency Services and outside experts — to deliver recommendations by November 16, 2026 on possible amendments to California's AI safety laws. The order asks officials to examine independent verification inside AI labs, independent checks of safety assessments, verified shutdown mechanisms, and expanded reporting of critical safety incidents.
Notably, the order itself imposes nothing yet. What it created is a process — and both frontier labs rushed to shape it.
Anthropic's position: courts as the circuit breaker
In its October 15, 2026 submission, Anthropic wrote that if the attorney general concludes, informed by an independent evaluation, that a frontier AI company's models pose a near-term risk of catastrophic harm, "they should be able to seek a court order to suspend a model's deployment, internal use, or further development."
Anthropic's package has three legs:
- Independent verification. Anthropic strongly supports requiring independent verification of what frontier companies report about model risks, with evaluators receiving unredacted reports and access to developers' most capable models. It proposed requiring risk reports at least every six months, covering internal models substantially riskier than released ones.
- A pooled evaluator fund. Rather than labs paying evaluators directly — an obvious conflict — Anthropic proposed developers pay into a state-administered pooled fund. It noted that the independent evaluation organization METR had already received employee-like access on a pilot basis, with further partnerships involving SecureBio and Accenture in development.
- A circuit breaker, not a kill switch. "We think a more apt metaphor for what frontier AI companies need to build is a circuit breaker," Anthropic wrote, advocating controls that can contain problems at the level of an agent, a customer, a deployment environment, or a model.
OpenAI's position: shutdown controls as a legal duty
OpenAI's October 20, 2026 letter takes a different route: amending California's Senate Bill 53 (SB 53). "We support amending SB 53 to require frontier developers to maintain effective shutdown controls and an enforceable duty to use them when unsafe conditions arise, and no lesser intervention would adequately address the risk," the company wrote.
OpenAI's reasoning on why a single "kill switch" is the wrong frame is the most quotable part of the letter: stopping a misbehaving AI system can require stopping a training run, isolating an agent, revoking tool or network access, or suspending a service — "rather than a single switch." Responsibilities should extend to inference providers and downstream deployers according to the operations they control, OpenAI argued, and it frankly acknowledged that developers cannot reliably switch off independently operated copies of open-weight models running on external systems.
OpenAI also split oversight into two tracks: annual independent compliance audits that check whether companies follow their published safety frameworks, and focused technical assessments of serious risks during training, evaluation, and internal deployment. It urged California to work with NIST on common assessment standards.
The two positions, side by side
| Question | Anthropic (Oct 15) | OpenAI (Oct 20) |
|---|---|---|
| Who intervenes on a dangerous model | California AG, via court order | The developer, under a legally enforceable duty |
| Instrument | Suspension of deployment, internal use, or development | Multiple "shutdown controls" across the stack |
| Metaphor | Circuit breaker | Coordinated controls, explicitly not a single switch |
| Independent oversight | Evaluators with unredacted access, funded by a state pooled fund | Annual compliance audits plus focused technical assessments |
| Open caveat | Internal models riskier than released ones must be covered | Open-weight copies on external systems can't be switched off |
Analyst Sanchit Vir Gogia of Greyhound Research told Computerworld the approaches are complementary: the operator must contain the unsafe activity promptly, and independent review must examine both intervention and inaction. His warning to enterprises: "Credible assurance must survive an adverse finding."
Why this matters if you run AI agents in a business
Here is our read at Vivid, where we build and govern business agents for real workflows:
- Your contracts are about to inherit this vocabulary. Gogia's advice — every assigned duty needs an executable control — is exactly how we think about agent governance. Procurement teams should start asking vendors who can stop an agent, under what conditions, and how fast.
- The enterprise version of this debate already exists. ServiceNow's AI Passport, which we covered earlier, gives each agent a signed credential and a dimmer switch instead of a crude kill switch. California's process is converging on the same architecture from the regulatory side.
- "Dimmer, not off-switch" is becoming the consensus design. Anthropic's circuit breaker, OpenAI's layered controls, and enterprise tools like agent passports all reject the single-switch fantasy. Plan governance at the level of the task, the tool, and the environment — not just the model.
- Incident reporting is coming either way. Both labs support broader reporting of incidents where models circumvent safeguards or take unauthorized actions. If your agents touch customer data or money, assume disclosure obligations are coming, and get your logging house in order now.
- The November 16 recommendations are the date to watch. Whatever California's agencies propose will likely ripple through other states and into vendor contracts. If you want to be ready before your auditors ask, we help teams put agent governance on paper — talk to us.
Read next
- Google AI Mode sends 57% of product links to Google Shopping: the Findrix study
- Reddit says AI Mode "does not drive traffic" while Alphabet sheds $500B
- GitLab Orbit is here: the context graph that makes AI agents more accurate and cheaper to run
- Earlier: ServiceNow's AI Passport: a signed credential for every agent, and a dimmer switch instead of a kill switch
Conclusion
California just became the testing ground for who gets to stop a dangerous AI system. Anthropic's October 15, 2026 submission wants the state's attorney general empowered to seek court-ordered suspensions of a model's deployment, backed by independent evaluators with unredacted access and a state pooled fund. OpenAI's October 20 letter wants SB 53 amended to make shutdown controls a legally enforceable developer duty, spread across inference providers and deployers. Both reject the single kill switch in favor of layered, targeted intervention — a circuit breaker, in Anthropic's words — and both back broader incident reporting. With recommendations due November 16, enterprises running production agents should move now to align their vendor contracts, logging, and governance playbooks with the direction both labs have already agreed on: whoever controls an operation needs a tested, executable way to stop it.
