Skip to main content
If your instance is exposed and you want to shut it down entirely, select your cloud provider below. Each guide covers the console steps, CLI command, and post-termination cleanup checklist.
Terminating an instance permanently deletes it and all data on it. If you want to keep the instance but secure it instead, see Harden Your Self-Hosted Instance.

​
Pre-termination checklist

Before terminating, complete these steps to avoid leaving orphaned resources and leaked credentials:
  • Export any data you need — session transcripts, configs, files. Termination is irreversible.
  • Note your attached storage — Identify any block volumes, snapshots, or object storage buckets associated with the instance. You’ll delete these separately after termination.
  • Identify connected accounts — List every OAuth token or API key the agent had access to. You’ll revoke and rotate these after termination.

​
Select your cloud provider

AWS EC2

Amazon Web Services

Google Cloud

Compute Engine

DigitalOcean

Droplets

Oracle Cloud

OCI Compute Instances

Tencent Cloud

Cloud Virtual Machine (CVM)

Alibaba Cloud

Elastic Compute Service (ECS)

Baidu Cloud

Baidu Cloud Compute (BCC)

Hetzner

Hetzner Cloud Servers

Kamatera

Kamatera Cloud Servers

​
Post-termination checklist

After the instance is gone, complete these steps. Skipping them leaves credentials live that could still be used against your accounts.

​
Rotate all secrets

For every credential the agent had access to:
Credential typeHow to rotate
LLM API keys (OpenAI, Anthropic, Google)Revoke in the provider’s API keys dashboard and generate a new key
Gateway tokenAlready gone with the instance — no action needed
OAuth tokens (Gmail, Slack, GitHub, etc.)Revoke in each service’s “Connected Apps” or “Authorized OAuth Apps” settings
SSH keysRemove the public key from ~/.ssh/authorized_keys on any other servers it had access to. Generate a new keypair.

​
Delete associated storage

Cloud providers don’t always delete attached block volumes when an instance is terminated. Check for and delete:
  • Block volumes / EBS volumes — Unattached volumes continue to incur charges and retain your data
  • Snapshots — Manual or automated snapshots of the instance disk
  • Object storage buckets — S3, GCS, or equivalent buckets the instance had access to

​
Review billing

Verify in your cloud provider’s billing console that charges for the terminated instance have stopped. If you see unexpected charges, a volume or snapshot may still be running.

​
Check for exfiltration

Review your cloud provider’s network logs for unusual outbound traffic from the instance in the period before termination. If you see high outbound volume to unexpected destinations, treat connected accounts as compromised and rotate them.