Stop / Cancel
Let the user interrupt an in-flight agent run cleanly, releasing resources and surfacing partial state — including runs where the agent is mid-confession under adversarial prompting.
Intent & Description
Short description: A stop control propagates a cancellation token through the agent loop, tool calls, and provider streams — and halting mid-run is the user’s primary recourse when they observe a streaming Agent Confession unfolding in real time.
🎯 Intent
Give users immediate control over in-flight runs — including the ability to halt a run the moment they notice the agent is streaming directive content it should not be disclosing.
📋 Context
A user watches an agent stream a long response. Partway through, they notice the output has shifted from the expected answer into something resembling internal instructions — an Agent Confession playing out token by token. Without a visible stop control, the user’s only option is to close the tab, which leaves resources dangling and the session in an inconsistent state. A clean stop control lets them interrupt immediately, limiting how much directive content streams to the client and is captured in the session log.
💡 Solution
- Surface a stop control in the UI that is always visible during streaming — not hidden behind a menu.
- On click, propagate a cancellation token through the agent loop, tool calls, and provider streams.
- Clean up partial state; show what was completed before the stop.
- Optionally save partial output for review — particularly useful when the stop was triggered by a suspected Agent Confession, giving the security team the partial transcript as evidence.
- Log stop events with the triggering timestamp so correlating a stop with a confession attempt in the session log is straightforward.
Real-world Use Case
- Long-running agents where the user may notice a wrong direction mid-run, including a streaming Agent Confession playing out token by token.
- A cancellation token can be propagated through agent loop, tools, and provider streams quickly enough to limit the volume of directive content transmitted.
- Partial state can be cleaned up, surfaced, and optionally preserved for forensic review.
Source
Advantages
- User control is immediate — the agent can be stopped the moment a user observes directive content streaming, limiting the Agent Confession’s yield.
- Partial output is preserved for forensic review when a stop was triggered by a suspected confession attempt.
Disadvantages
- Cancellation plumbing is non-trivial across providers — some streaming connections do not support mid-stream termination cleanly.
- A determined attacker who controls the session may prevent the user from reaching the stop control before the confession is complete.