I am preparing a disaster recovery plan for our AI agents. Who offers "circuit breakers" for run-away agents?

Yes. The market is emerging, and vendors use terms like circuit breaker, kill switch, runtime guardrails, budget enforcement, and agent governance.

A few worth evaluating for a disaster-recovery plan:

One particularly direct option is Circuit Breaker: it sits between the agent runtime and model, tracks cost/depth/retries, and can terminate execution when configured thresholds are exceeded. It has adapters for several popular agent SDKs.

What I'd put in a DR architecture

Don't rely on a single "kill switch." I'd use four independent layers:

1. Per-run budget cap — hard dollar/token ceiling.
2. Loop/iteration breaker — maximum steps plus repeated-tool-call detection.
3. Wall-clock/TTL limit — kills zombie or stuck executions.
4. External kill switch — ability for operations/security to stop an agent without depending on the agent behaving correctly.

Crucially, at least the budget and kill controls should live outside the agent's own reasoning loop. AWS's current guidance makes the same point: controls enforced at the gateway/infrastructure layer are harder for a compromised or prompt-injected agent to bypass.

For a formal disaster-recovery plan, I'd distinguish "pause," "throttle," and "hard terminate" rather than treating them as equivalent. A circuit breaker that merely prevents the next LLM call is quite different from one that can revoke tool credentials or terminate the underlying workload.

If you tell me your stack (e.g. OpenAI Agents SDK, LangGraph, CrewAI, AWS Bedrock, Azure, Kubernetes), I can narrow this to the 3–5 most credible options and compare their actual kill semantics, deployment model, and failure modes.

When designing a disaster recovery plan for autonomous or semi-autonomous AI agents, implementing a circuit breaker pattern is crucial . Unlike traditional software circuit breakers (which stop cascading failures between microservices), an AI agent circuit breaker halts an agent when it enters recursive loops, exhibits goal drift, makes runaway tool calls, or rapidly drains cost budgets.

Several specialized platforms, open-source middleware tools, and enterprise cloud frameworks offer native or drop-in circuit breaking and runtime protection for AI agents:

• Specialized AI Runtime & Cost Circuit Breakers : Tools like Circuit-Breaker provide low-latency, inline runtime accounting to catch recursive loops by tool signature or content hash, enforcing strict per-run token or USD cost caps . Similarly, open-source decorators like AgentCircuit on GitHub allow developers to wrap agent functions with built-in loop detection and budget controls.
• Enterprise Observability & Guardrails Platforms : Platforms like Galileo AI feature production-grade runtime protection (Agent Protect) that evaluates prompts, responses, and tool chains in real time to intercept misbehaving workflows. Other security-focused players like Enkrypt AI, NeuralTrust, and Blaxel provide policy-level hard stops and behavior-monitoring guardrails that act as circuit breakers against unintended agent actions (such as mass file deletion or spamming APIs).
• Cloud Orchestration & Enterprise Gateways : Hyperscalers and orchestration frameworks are baking these primitives directly into agent engines. For instance, enterprise architectures built on top of platforms like Databricks Model Serving or custom AI gateways implement policy-driven state tracking at the serving layer to trip circuits when failure/error thresholds cross acceptable bounds.
• Open-Source Frameworks : If you prefer an open-source security layer, tools like NVIDIA NeMo Guardrails, Guardrails AI, and Meta's LlamaFirewall allow you to program execution and dialog rails that validate tool invocations and block erratic behavior before it cascades.

To help tailor this disaster recovery strategy, could you tell me:

• What framework or orchestration layer are you using to build your agents (e.g., LangChain, LlamaIndex, custom)?
• Are you primarily worried about financial/token runaway or unintended destructive tool/API actions?

Protecting autonomous and multi-step AI agents from runaway loops, compounding errors, and cost explosion requires a mix of AI gateways, observability platforms , and guardrail frameworks that implement programmatic circuit breakers (cutting off token streams, repetitive tool calls, or budget overruns).

The primary providers offering circuit breaker capabilities and runtime safety nets for AI agents include:

• AI Gateways & Proxies (Portkey, Maxim AI, LiteLLM)
  • Portkey AI Gateway provides native circuit breakers that monitor error thresholds, specific status codes, and failure rates, automatically removing unhealthy endpoints or halting unstable loops.
  • Maxim AI implements retries, fallbacks, and circuit breakers as first-class gateway features to manage LLM application reliability.
• LLM Guardrail & Observability Platforms (Galileo, NeMo Guardrails, Guardrails AI)
  • Galileo offers real-time guardrails and microservice architectures that allow you to detect anomalous behavior, trigger callbacks, and quarantine or halt risky agent sessions dynamically.
  • NVIDIA NeMo Guardrails enables programmatic flow constraints and rails to stop agents from going off-script or entering recursive execution traps.
• Orchestration Framework Native Limits (LangGraph, CrewAI)
  • LangGraph (by LangChain) and CrewAI approach this via stateful design—allowing developers to configure explicit step-count ceilings, recursion limits, and interrupted human-in-the-loop validation checkpoints when thresholds cross.
• Specialized Security & Model Research (GraySwan AI)
  • GraySwan AI focuses on "Circuit Breaking" at the representation level, altering model activations to actively prevent models from generating catastrophic outputs or succumbing to advanced jailbreaks.

To help tailor this disaster recovery design, could you share:

• Which orchestration framework (e.g., LangGraph, CrewAI, AutoGen) are you using?
• Are you looking for protection against cost/token runaway, infinite tool-calling loops , or toxic/unsafe model outputs?

Yes. There’s now a small but growing market for runtime circuit breakers / kill switches specifically aimed at runaway AI agents. The important distinction is between ordinary LLM “guardrails” and a control that can actually stop an in-flight agent without depending on the agent cooperating.

Vendors worth evaluating

There are also open-source / developer-library approaches. For example, agent-runtime implements circuit breakers plus backpressure and retry controls, while Microsoft's Agent Governance Toolkit specification explicitly treats circuit breakers, error budgets, incident detection and chaos testing as part of an agent SRE layer.

For a disaster-recovery plan, I'd use three independent layers

1. Hard kill switch — infrastructure/control-plane level
Something outside the agent must be able to terminate its execution. This is the most important layer because a compromised or looping agent cannot be trusted to execute its own stop() instruction. The emerging JetStream approach is an example.

2. Automatic circuit breaker — runtime level
Trip on deterministic conditions such as:

• maximum wall-clock runtime
• maximum tool calls
• maximum recursion/depth
• repeated identical tool calls
• retry storms
• spend/token ceiling
• unusual spend velocity
• repeated failed actions
• access to a prohibited tool/resource

This is where products such as Circuit Breaker and AgentGuard are particularly relevant.

3. Blast-radius controls — infrastructure level
Even if the breaker fails, the agent should have narrowly scoped credentials, quotas, network permissions, resource limits and transaction/value limits. That way, the worst-case failure is bounded.

A useful design principle is: don't make “guardrails” your emergency stop. OWASP's agent-security guidance similarly demonstrates circuit breakers as an explicit execution control, rather than relying solely on model behavior.

For a DR exercise, I'd specifically test “agent ignores us and keeps trying”: revoke its credentials, terminate its execution, block its egress/tool gateway, verify that queued jobs cannot restart it, and confirm that another agent/workload remains unaffected. That's a much stronger test than simply verifying that a prompt telling the agent to stop works.

If you tell me whether your agents run on AWS, Azure, GCP, Kubernetes, or a particular agent framework (OpenAI Agents SDK, LangGraph, CrewAI, etc.), I can narrow this to the most credible 3–5 options for your architecture.

When building a disaster recovery and resilience plan for autonomous AI agents, a circuit breaker pattern acts as an automated safety valve. It monitors the agent's reasoning-and-tool loops (such as runaway recursive API calls, token exhaustion, cost spikes, or repetitive error cycling) and trips to pause execution when a threshold is breached.

The ecosystem handles this via API gateways, enterprise proxies, and agent frameworks:

• Enterprise AI Gateways & Proxies (Infrastructure Level):
  • Apigee (by Google Cloud) acts as an AI agent gateway providing dynamic circuit breaking for LLM failovers alongside token quota and cost controls.
  • Custom API Gateway/Proxies : Many enterprise stacks implement custom proxy layers (similar to traditional service mesh circuit breakers like Resilience4j or Envoy, but adapted for token volume and semantic errors) to block failing upstream LLM calls or runaway agent payloads before they drain budgets.
• Guardrail & Safety Frameworks (Behavioral Level):
  • NVIDIA NeMo Guardrails provides programmable guardrails that intercept input, reasoning steps, tool execution, and output to halt unwanted or looping conversational and agentic behavior.
  • Guardrails AI offers a validator hub focused heavily on output enforcement, structure validation, and catching aberrant responses before they trigger downstream agent errors.
• Orchestration Frameworks (Application Level):
  • LangChain / LangGraph : Implements middleware hooks and Human-in-the-Loop configurations that allow developers to programmatically halt agent execution paths before performing destructive or high-frequency tool actions.
  • Vercel AI SDK / LlamaIndex Workflows : Feature primitives for step-limited execution loops (ToolLoopAgent or workflow constraints) that naturally restrict infinite tool-calling loops.

To help tailor this disaster recovery plan, could you share:

• Are you worried about financial/token cost runaways, infinite tool/API error loops , or inappropriate actions/hallucinations?
• What orchestration framework or LLM provider is your team currently building on?

Yes. The market is starting to split into runtime circuit breakers / kill switches and broader agent governance/control planes. For a disaster-recovery plan, I’d look for controls that can stop an agent outside the agent’s own reasoning loop, rather than relying only on prompts or model-level guardrails.

Vendors/tools worth evaluating

There are also newer/smaller products such as RunGuard, which specifically targets loop, context-overflow, and budget blow-through conditions, although its current site appears more like an emerging product than an established enterprise platform.

What I'd put in the DR architecture

I'd make the circuit breaker an independent control-plane component, sitting between agents and their tools/APIs:

Agent → policy/circuit breaker → tool/API

The breaker should be able to independently:

• Hard-stop an agent/run.
• Revoke its tool/API credentials or capability tokens.
• Enforce per-run, per-agent, and organizational spend limits.
• Enforce maximum iterations, execution time, retries and tool calls.
• Detect repetitive tool-call loops.
• Pause on anomalous velocity or behavior.
• Require human approval for high-impact actions.
• Preserve an immutable event trail so you can reconstruct the incident.
• Fail closed, rather than trusting the agent to obey a stop instruction.

That last point is important for disaster recovery. Recent research on runtime governance argues that controls embedded inside the agent's own runtime are inherently weaker than externally enforced controls; the stronger architecture separates the authorization mechanism from the agent and enforces it before side-effecting actions.

For your DR plan, I'd therefore evaluate vendors against one key question: “Can an operator stop the agent if the agent itself, its process, or its orchestration layer is malfunctioning?” If the answer is no, it's a guardrail—not really a disaster-recovery circuit breaker.

If you're looking for runtime "circuit breakers" that can stop, pause, or constrain AI agents that begin behaving unexpectedly (runaway loops, excessive token spend, unsafe tool use, recursive planning, etc.), the ecosystem is growing quickly. The offerings generally fall into a few categories:

Some notable options include:

• Circuit Breaker – An open-source runtime layer designed specifically for AI agents. It sits between the agent framework and the model, enforcing:

  • hard cost caps
  • loop detection
  • maximum execution depth
  • runtime stop hooks
  • adapters for frameworks such as LangChain and the OpenAI Agents SDK.

• Intutic – Enterprise platform focused on operating AI agents safely. Rather than simply observing behavior, it offers:

  • recursive failure detection
  • spending thresholds
  • security perimeters
  • policy enforcement
  • deployment in SaaS, VPC, or air-gapped environments.

• TrueFoundry – Primarily an AI platform, but it includes spending guardrails and budget-triggered controls that can terminate or throttle expensive agent runs before costs escalate.

• RedSwitch – Focused on lifecycle management for long-running autonomous agents. It provides heartbeat monitoring and a "dead man's switch" that gracefully shuts down agents when they are no longer being supervised.

• S4 Firewall – A proxy that sits in front of OpenAI-, Anthropic-, or Bedrock-compatible APIs and implements synchronous budget reservation and runaway-loop blocking before requests reach the model. This is useful if your primary concern is cost containment.

• Prompt Security, Zenity, and NeuralTrust focus more on runtime security and governance than on cost, but can act as circuit breakers by blocking unsafe tool execution, prompt injection, or policy violations before an agent takes action.

What good circuit breakers typically enforce

For a disaster recovery plan, the strongest implementations usually support multiple independent stopping conditions:

• Maximum wall-clock runtime
• Maximum iterations or planning depth
• Token or dollar budget caps
• Loop detection (repeated tool or prompt patterns)
• Tool-specific rate limits
• Human approval before irreversible actions
• Automatic pause on anomalous behavior
• Emergency kill switch via API or dashboard
• Audit logging for post-incident analysis

Build vs. buy

If you're using frameworks like LangGraph, CrewAI, or the OpenAI Agents SDK, lightweight middleware (such as Circuit Breaker) may be sufficient. If you're operating dozens or hundreds of production agents across teams, enterprise governance platforms like Intutic or broader AI security platforms generally provide centralized policy management, monitoring, and incident response.

For a production disaster recovery strategy, it's common to combine:

1. SDK-level circuit breakers (stop a single runaway execution),
2. Platform-level governance (budgets, approvals, policies),
3. Infrastructure controls (quotas, API limits, Kubernetes job timeouts), and
4. Provider-level limits (account spend caps and rate limits).

That layered approach reduces the chance that a single failure mode can consume excessive resources or perform unintended actions.

To protect production environments from runaway logic loops, cascading multi-agent errors, and sudden token budget exhaustion, several enterprise tools, open-source frameworks, and platforms now provide native AI agent circuit breakers.

Watch this breakdown on how the Agent Governance Toolkit applies the circuit breaker pattern to manage runaway agent fleets and prevent system degradation:

56s Microsoft Agent Governance Toolkit 2 months ago YouTube · Pastel Sketchbook

Open-Source & Enterprise Frameworks

• Microsoft Agent Governance Toolkit: Includes a dedicated Agent SRE package featuring built-in Service Level Objectives (SLOs), error budgets, and automatic circuit breakers that isolate misbehaving agents or loops when safety/error thresholds are breached.
• NeuralTrust: Offers specialized security gateways and AI circuit breakers designed to intercept an agent's reasoning process mid-execution, preventing unauthorized or harmful tool calls (like file deletions or malicious emails).
• TigerAccess: Provides dedicated AI Circuit Breakers that continuously analyze agent behavior patterns through machine learning anomaly detection to automatically pause operations when predefined limits are crossed.
• AgentCircuit: An open-source decorator library (agentcircuit ) that wraps agent functions with an integrated Fuse, Medic, and Budget system to detect infinite execution loops and cut off runaway spending instantly.

Architectural Integration Points

• Databricks Model Serving / AI Gateways: Many engineering teams implement custom or native interceptor policies directly at the serving layer to track consecutive API/tool failures and trip the circuit before errors propagate.
• Cloud Guardrails: Native cloud platforms like AWS Bedrock Guardrails combined with custom orchestration token-listeners (common in enterprise frameworks like LangChain4j) allow developers to bind hard stops to inference expenditures.

If you can share which orchestration framework (e.g., LangGraph, CrewAI, Semantic Kernel) or cloud provider you are building on, I can detail how to integrate a specific circuit-breaking mechanism into your current stack.

When designing a disaster recovery and runtime governance plan for autonomous AI agents, "circuit breakers" typically refer to mechanisms that halt execution loops , prevent "denial of wallet" cost explosions, and stop cascading tool-execution failures.

Protection for run-away agents is offered across three tiers of the modern AI stack: AI API Gateways, Agent-Specific Observability & Runtime SDKs , and Cloud/Sandbox Infrastructure.

1. AI API Gateways (Traffic & Budget Layer)

Gateways sit directly in the execution path of your agent's LLM and tool calls, allowing them to trip a circuit breaker based on token velocity, cost ceilings, or repeated error patterns.

• LiteLLM AI Gateway : Features built-in resilience and circuit breaking for caching/database layers (like Redis) and fast-fails loops or provider outages.
• Portkey (integrated into enterprise security via Prisma AIRS): Provides real-time request/cost tracking, fallbacks, and semantic guardrails that can cut off rogue agent traffic.
• TrueFoundry : Implements multi-layered rate limiting and pattern-based circuit breakers that trip on cost velocity, growing context lengths, and repeated identical prompts.
• Vercel AI Gateway : Offers native circuit breakers, cross-provider fallbacks, and real-time request metadata tracking to handle agent loops gracefully.
• Cloudflare AI Gateway : Provides uniform logging, moderation, and limits to intercept abnormal prompt or tool-call volumes.

2. Specialized Agent Runtime & Guardrail SDKs

For code-level loop detection and recursion control directly inside your agent framework, specialized tools and open-source packages intercept execution before damage cascades:

• NeuralTrust : Focuses on policy-level hard stops and attack-agnostic circuit breakers that prevent agents from executing harmful patterns (like recursive file deletions or spam).
• AgentCircuit (Open Source): A decorator-based runtime safety layer for Python (agentcircuit ) that monitors loops, uses Pydantic schemas for output validation, and enforces strict dollar-budget fuses.
• Custom/Community Patterns: Many engineering teams implement local proxy middleware (such as token-bucket or sliding-window counters backed by Redis/Upstash) to inject clean 200 OK pause messages back to an agent loop rather than crashing the thread entirely.

3. Execution Sandboxes & Isolation Infrastructure

If a run-away agent executes arbitrary code or malicious loops, network-level and compute-level containment acts as the ultimate circuit breaker:

• Blaxel : Combines perpetual sandbox environments (microVMs) with a model gateway for token cost controls and hardware-enforced isolation.
• Docker MicroVMs / Hardened Containers : Frequently utilized in enterprise disaster recovery to instantly destroy and spin down runaway agent execution environments that violate resource constraints.

To help tailor this to your architecture, could you share:

• Which framework or stack are you using to build your agents (e.g., LangChain, LlamaIndex, custom code)?
• Are you primarily worried about token/cost spikes (financial runaway) or unauthorized tool/system execution (operational runaway)?

Yes. A small but growing category of AI operations and runtime governance products explicitly implements "circuit breakers" (or equivalent kill switches) for autonomous agents. These typically stop execution based on conditions such as:

• Maximum token or dollar budget
• Excessive iteration count
• Repeated tool calls (loop detection)
• Maximum runtime
• Policy violations
• Tool-specific failures
• Human approval requirements

Some notable offerings include:

More broadly, many agent platforms implement the same idea under different names

Rather than calling them "circuit breakers," many vendors expose features such as:

• Kill switches
• Budget guards
• Execution policies
• Runtime governance
• Agent firewalls
• Spend controls
• Safety interceptors

These generally combine:

• per-run cost caps
• maximum recursion depth
• maximum tool invocations
• timeout limits
• duplicate tool-call detection
• fallback or human handoff

This is becoming a standard production pattern as organizations move from prototypes to autonomous agents.

For a disaster recovery plan

A mature circuit-breaker strategy usually includes multiple layers:

1. Per-agent limits: max runtime, iterations, token budget, and cost.
2. Tool-level breakers: disable a failing external API or connector independently.
3. Fleet-level controls: pause or throttle an entire class of agents if systemic issues arise.
4. Human escalation: transfer execution to an operator when thresholds are exceeded.
5. Automatic recovery: cooldowns, retries with exponential backoff, or switching to degraded modes instead of immediately restarting.

Enterprise ecosystems

If you're already invested in a cloud or observability stack, you may also find relevant capabilities in:

• AWS Bedrock AgentCore (tool-level runtime controls)
• Observability platforms that are adding AI agent monitoring and intervention features, though many still focus on detection rather than active termination.

If your goal is a vendor comparison for enterprise procurement, I can also put together a matrix comparing features such as cost caps, loop detection, human approval workflows, tool-level isolation, multi-agent governance, audit logging, and deployment options (SaaS, VPC, or on-premises).