Building AI Breaker

01Half the country would rather not

AI arrived on Windows from every direction at once: Copilot, Recall, AI in Paint and Notepad, AI in Edge, Chrome, Firefox and Office, chatbot sites and apps, and AI engines hidden inside ordinary programs. Nobody asked for most of it, and a large share of people do not want it. The numbers are not a niche.

• 52% of US adults are more concerned than excited about the growing use of AI in daily life, up from 37% in 2021. Only 9% are more excited than concerned. For the first time a majority of adults under 30 (55%) say the same. Pew Research Center, August 2026
• About six in ten want more control over how AI is used in their lives. Only 17% are comfortable with the control they have. At the same time nearly three quarters would let AI help at least a little with daily tasks: people want a dial, not a ban. Pew Research Center, September 2025
• It is not only America. Across 25 countries the median share more concerned than excited is 34%, and about half of adults in the United States, Italy, Australia, Brazil and Greece. In no country do more than three in ten say they are mainly excited. Pew Research Center, October 2025
• Nervousness matches excitement worldwide. Across 30 countries, 53% say products and services using AI make them nervous, against 52% who say they are excited. Ipsos AI Monitor, June 2025

Those people have no product. The AI industry builds for the enthusiasts; the free alternatives for everyone else are registry scripts with no proof, no undo and no upkeep. Turning AI off on a Windows PC today means hunting through dozens of settings in Windows, Office and every browser, and doing it again after each update.

02Why a switch calms

Fear shrinks when you hold the switch. People do not need AI gone. They need to know they can stop it, in one place, and check that it stopped.

That is the belief behind the product, and it is older than AI. In the stress experiments David Glass and Jerome Singer published in Urban Stress (1972), people worked through tasks while loud, unpredictable noise played. One group was given a button that would stop the noise and asked not to use it. Almost nobody pressed it. Yet the group with the button made fewer errors and persisted longer afterwards than the group without one. The button changed nothing about the noise. It changed how much the noise cost them.

The same pattern runs through the surveys above: the majority who want “more control” are not the same people who want AI gone. They want a say. So AI Breaker is not a ban. It is a switch with four positions, a preview of what each one will stop, and a record anyone can check. The off switch only earns trust if it is:

• Legible. One place, plain language, no hunting through settings. The standard I wrote down: a 70-year-old who is afraid of AI should be comfortable using it.
• Verifiable. Proof it is actually off: a log of what was blocked and when, drawn from Windows’ own records rather than from us.
• Durable. Updates cannot silently turn AI back on. Drift is detected and reported; a tamper lock is on the roadmap.
• Honest about scope. It says exactly what each level covers and what it does not. A row only says “blocked” after the feature has been seen to stop.

Every decision below was measured against those four words. When a cheaper option failed one of them, the project took the more expensive one. That is also what makes it worth paying for: the free tweaks already offer the cheap version.

03Four positions, one switch

Levels, not a hundred toggles. Each level includes the ones below it, every level says up front what will stop working, and every level is reversible with one click. Windows itself keeps working at every level; only AI features stop.

aibreaker.org⤢

Three rules shaped the levels. Microsoft Defender’s own AI-based malware protection is never touched, at any level, and the app has no toggle for it at all. Nothing that uninstalls a component is used, because a one-click undo cannot cleanly reverse it. And the option that turns off Windows’ own built-in AI is never on by default and carries an accessibility warning, because it removes face sign-in, voice typing, live captions and the natural Narrator voices some people depend on.

Anyone can also flip a single item on top of a level. That makes the setting “Custom (based on Level 2)”, the same idea as a browser’s Standard, Strict and Custom. One decision I made against the first design: when a setting on the PC is already stricter than what AI Breaker would write, it is left alone, and when it is looser, AI Breaker writes the stricter value and records the old one. If a person decides to turn something off, there is no reason to turn it back on.

04The window never touches Windows

The app is three programs with clear roles. The window people see runs without elevated rights and cannot change anything. A background service, running as SYSTEM, owns every change, the record of it, and the undo. A small command line talks to the same service and also carries the rescue tool, which works with the service stopped.

• Authorization comes from the plan, not from the caller. The service works out what a request would change, under a lock, and only then decides who may do it. Anyone can look. Any administrator can block more without a prompt, because tightening cannot hurt the owner. Blocking less (undo, enabling an item, the panic button) needs Windows’ own approval prompt, so neither malware nor another user can quietly loosen it.
• The service only writes targets in its built-in catalog. The update feed can add domains, app identities and prebuilt policies, never a registry target. A tampered journal cannot widen what the engine will touch.
• Local only. The pipe between window and service refuses remote clients, takes one JSON line in and one out, and identifies the caller from Windows, not from what the caller says.

It is .NET 10 and C#: a WinUI 3 app, a Windows service, the command line, a WiX installer and PowerShell tooling for the test machines. About 25,000 lines of application code and 6,500 lines of tests, in a week.

05Only the controls Microsoft documents

A security product that uses hacks gets flagged as malware, and deserves to be. AI Breaker uses only the controls Microsoft, Google and Mozilla document for IT departments, cites the documentation next to every setting in the code, and marks anything unverified as such until a test proves it.

• Never the hosts file. The obvious shortcut for blocking chatbot sites is one Microsoft calls unsupported, and one Defender resets as a hijack. Browser block lists, per-app firewall rules and DNS rules do the same job in a supported way, and they are written for all three browsers whether installed or not, so a browser installed later is covered.
• Never Microsoft’s servers. Microsoft says it cannot support cutting Copilot off from the network, so Copilot is contained with policy settings and by stopping the app from starting, Microsoft’s own recommended method. A protected list in the app (Microsoft, Defender, activation, our own update hosts) cannot be overridden by the feed.
• No kernel driver. Blocking model files on disk would need one. Windows’ App Control refuses to run the AI engines themselves, which gets most of the value with none of the risk.
• A guided step where no control exists. A few features have no documented switch. The app shows the exact Settings path for the person, and never writes an undocumented registry value instead.

The hardest finding came early: Windows Home has the tool that applies App Control policies but not the tool that builds them. So policies are built off-device, one per app, delivered in the signed feed, and only applied on Home. Exempting an app means removing its policy, because in App Control a deny always wins and cannot be undone by adding an allow.

06Proof from Windows, not from us

A person who is afraid of AI will not take a vendor’s word that it is off. So the activity log shows two things, and both can be checked without AI Breaker.

aibreaker.org⤢

• What Windows blocked, taken from Windows’ own event logs: Code Integrity for an engine that was refused, the firewall for a connection that was dropped, AppLocker for an app that did not start. Each entry shows the event number so it can be found in Event Viewer. The service keeps a copy, so the history survives when Windows’ own log wraps.
• What AI Breaker changed, from its own journal: time, setting, before and after, who asked, and whether it was done from the window or the command line. The log can be exported.
• Blocks are visible on purpose. A blocked site shows the browser’s own “blocked by your organization” page rather than a broken connection, and the app explains that wording before it appears. Firewall drop auditing is switched on so that network blocks show up in Windows’ log too, and switched back on undo.

This is the third of three ship gates, next to code signing of every file and clean Defender and SmartScreen results on a fresh machine. No release goes out without all three, every release, not just the first.

07Undo was built first

Everything AI Breaker does changes Windows as SYSTEM. People will only trust that if they can always get back to where they started, with one click, even when the app itself is broken. So the first code written was the journal and the rollback, and no feature that changes Windows was started before the harness proved they worked.

aibreaker.org⤢

• One-click undo and a panic button. Go back a level, or remove everything in one step, no questions asked. The journal is written to disk atomically, with a backup, and archived after a clean rollback.
• A rescue that needs nothing. The command line’s recovery mode stops the service and undoes every change locally. A sweep also finds AI Breaker’s own firewall, DNS and App Control rules by name, so recovery works even if the journal is lost. A plain-text recovery file in the data folder lists the manual steps for anyone who prefers them.
• A change that fails part-way undoes its own completed steps automatically, and the uninstaller undoes everything before it removes a file.
• No surprise restarts. Before anything is applied, each change says whether it works now, after closing an app, or after a restart, and a banner tracks what is still pending until Windows confirms it happened.

08Proven in virtual machines, claimed on real hardware

Nothing that changes Windows ever runs on my own PC. Two Hyper-V virtual machines, one Windows 11 Home and one Pro, each with a clean checkpoint, run every test: a harness restores the checkpoint, copies the build in, runs the steps, collects the logs and Windows’ events, and reverts. The rule is written into the project’s instructions, and the tester agent can only run tests through that harness.

• Every acceptance criterion passes on Home and Pro, or is marked “not applicable on Home”. Most buyers run Home, and Home is where tools go missing.
• Rollback is tested after every apply. A change is not done until the machine is back to its clean state.
• Unit tests on fakes are not enough. About 300 of them run on the dev PC, and then a smoke test launches every published binary read-only, because a build that passes its tests and crashes on start is not ready.
• “Blocked” only once seen. Virtual machines prove that settings are set, journaled and undone. Features that only exist on Copilot+ PCs, such as Recall and Click to Do, are claimed only after they are seen to stop on a real Copilot+ PC. Until that session runs, those rows cannot say blocked.

As of this writing, Level 2 blocks 26 chatbot domains in Edge, Chrome and Firefox on both editions with exact undo; App Control blocks AI engines on Home without a restart, 42 of 42 test steps; and the installer installs, upgrades and uninstalls cleanly. Level 1’s 36 settings are built, and most of their per-feature proofs are still to run. The website says exactly that.

09The paid value is a list that stays current

New AI apps, sites and Windows settings appear every month. A one-off script goes stale; the maintained list is what the $19 buys, together with the preview, the proof and the undo. Keeping that list current is a commitment, so the upkeep is designed as a system rather than a chore.

• A signed feed. The list that tells a SYSTEM service what to block has to be provably ours. Releases are signed with hardware-backed keys, the app pins the public keys, a feed can never add a key, and versions only move forward, so an attacker cannot roll a PC back to an older, weaker list. Anyone can verify a feed file from the command line.
• Tightening applies itself; loosening waits. A release that blocks more is applied and shown in Activity. Anything that would block less waits for the person’s next level change.
• Honest expiry. The first year of updates is included. After that the app keeps working and says, in the window, when its list froze and that AI apps released since may not be blocked.
• A rule station. A second desktop runs the routine part on a schedule: it finds new versions of catalog apps, packages and tests them in the virtual machines, and opens a pull request with the evidence. I review and sign; the station cannot. Its research agent has no rights to the virtual machines and no GitHub token, and every job it runs is listed in a weekly digest.

10The website practises what the app preaches

aibreaker.org is a separate product in the same repository: plain HTML and CSS on Cloudflare Pages with no build step, a few Pages Functions for the waitlist and visit counting, and a small database. It had to be as trustworthy as the app, because it is the first thing a wary buyer sees.

• It loads nothing from other servers. No CDNs, no Google Fonts, no third-party analytics, no cookies. A content security policy enforces it, and the footer says so, so the promise and the code have to stay in step.
• Visits are counted the way this site counts them: a visitor is a hash of address, browser, a secret and the date, so nobody can be followed across days; no IP address is stored; Do Not Track and Global Privacy Control mean nothing is sent; everything is deleted after 13 months.
• The copy is governed by the product rules. Only what the app does or is proven to do; planned things say Planned; “Level 2”, never “L2”; no Microsoft logos and no implied endorsement; the FAQ is repeated word for word in the page’s structured data; and a plain-text summary is published for AI assistants.
• An internal “How AI Breaker works” page for an executive, a product manager and a developer, each with a to-do list, lives behind the admin token and is updated with every product change. It is where this write-up’s facts come from.

11How it was built: a team of agents, one decision log

I built AI Breaker with Claude Code, starting on 10 October 2026, the way I would run a small product team, because the failure mode of AI-assisted work is not bad code. It is forgetting a decision, re-arguing it, and shipping something that quietly contradicts last week.

• One context file, read at the start of every session. What we are building, the market, pricing, the levels, the technical approach with its known findings, the brand, the legal constraints, the ship gates, the roadmap, how to work with me, and a log of every decision with its date and reason. 122 entries so far. A decision that is superseded is struck through and the new one points at it, so the history stays readable.
• Specs with numbered acceptance criteria, 29 of them, each naming the roadmap phase, what it depends on, the trust property it serves, its UI states and its open questions with a recommendation. I approve a spec before anything is built, one question at a time.
• Roles, as agents. A product-manager agent writes the spec. A designer agent covers every state of a screen against the design rules. The main session builds. A tester agent verifies each criterion through the VM harness on Home and Pro. A code-reviewer agent checks the diff for reversibility, documentation citations, trademark use and that Defender is untouched. The tester and reviewer get the spec, not the builder’s explanation of the code.
• A definition of done that cannot be argued down. Every criterion on both editions, rollback to clean, analyzer clean, installer builds, the published binaries launch, the version number moves, the decision log and the internal page are updated. And never weaken or delete a failing check to get a pass.
• Permissions granted one at a time, in writing. The AI may run the VM harness on my PC; it may set up the test machines; it may set up the rule station with me present. Each exception is dated and scoped in the context file, and the default stays “never change the host”.

Pushback is part of the process. The first version of the app was, in my words, “read only”: you could pick a level but not find the button that applied it. The designer agent’s spec names the four reasons why and the one-sentence fix, and the app was rebuilt around a single Review page whose Apply button is the only thing that changes anything.

12Best practices

1. Build for the people the industry forgot. Half of adults are wary of AI and most want more control. A dial they can trust is a product; a lecture about the benefits is not.
2. Make control real, not decorative. The button in the noise experiment worked because it would have worked. Every switch in AI Breaker is backed by a documented control, a journal entry and a Windows event that proves it.
3. Build the undo before the feature. A tool that changes a system as SYSTEM earns trust through the way back, not the way in. Rollback, panic and recovery were written and harness-tested before any level existed.
4. Say “not covered” rather than pretend. A row that cannot be proven says so. A list that can go stale says when it froze. A feature that needs a restart says so before the click.
5. Write the rules once, then let the system enforce them. The catalog of targets the service may touch, the protected list of hosts the feed may never block, and the authorization computed from the plan are code, not reminders.
6. Run AI like a team, with a written memory. Roles, specs, a definition of done and a dated decision log kept 99 commits consistent in a week. The same practices run a human team.

13What’s next

AI Breaker is in testing. The website takes a waitlist, and nothing is sold until the ship gate is met: a real code-signing certificate, clean Defender and SmartScreen results on a fresh machine, and the Copilot+ PC session that proves the rows which can only be proven there. A closed beta for people whose PCs fill the gaps in our test coverage comes before the paid launch, and a lawyer reviews the agreements before anything ships.

The business version, for schools and small companies that want “approved AI” rather than “no AI”, is designed into the foundation so it needs no rewrite: policy keys, an event channel, a silent installer. The biggest risk is on the record too: Microsoft shipping its own off switch. The answer is coverage of third-party AI, proof and undo, which a native toggle will not offer.