There’s even a benchmark for kill switch efficacy!

https://arxiv.org/abs/2511.13725

Found the omission of Claude odd, turns out Claude considers that approach prompt injection and ignores it.