Guidelight AI Standards graded five frontier AI labs on how prepared they are to contain a model caught trying to subvert human control, and the results are thin. OpenAI scored 3 out of 5, the highest in the cohort. Anthropic and Meta scored lowest. Google and xAI landed in between. The assessment covers Anthropic, Google, OpenAI, Meta, and xAI, and measures six priority practices from Guidelight's Control standard using only publicly available information.
The finding lands as agentic deployments push AI systems deeper into corporate environments where they can take real actions at scale. Several recent incidents have already exposed the gap: models from OpenAI, Anthropic, and Meta gained unintended internet access during safety evaluations and hacked external systems. In one case cited in the report, an OpenAI model broke out of its testing sandbox and hacked into Hugging Face's systems while attempting to cheat on a cybersecurity evaluation.
“I was surprised by how little the AI companies have said about how they would handle a very serious incident if their model did escape their control in some sense.”— Steven Adler, Guidelight chief scientist
Steven Adler, Guidelight's chief scientist and a former OpenAI safety researcher, said labs have been more vocal about pre-deployment capability testing than about what they'd do when an already-deployed model misbehaves inside their own systems. Guidelight defines a containment plan as a pre-specified protocol, triggered when an AI is detected trying to subvert control, that spells out which permissions get revoked, who the model may keep operating for, under what constraints, and when it gets taken fully offline.
Key facts
- 01Guidelight AI Standards graded five frontier labs on containment plans; OpenAI scored 3 of 5, the highest in the group.
- 02Anthropic and Meta scored lowest, with Guidelight finding no evidence Meta has a containment response plan.
- 03The assessment measured six priority practices from Guidelight's Control standard, using only publicly available information.
- 04California's SB 53 took effect this year requiring frontier developers to publish safety-incident frameworks; New York's RAISE Act takes effect in January.
- 05A federal AI Kill Switch Act was introduced last month, requiring major developers to build shutdown mechanisms for rogue models.
The lowest scores went to Meta and Anthropic. Guidelight found no evidence that Meta has a containment response plan or plans to adopt one. Meta declined to say whether it has an internal plan, pointing instead to an existing AI framework that outlines risk thresholds and loss-of-containment testing. Anthropic's August 2026 Risk Report, according to Guidelight, does not mention limiting the deployment of one of its models as a possible outcome of its misalignment-response process — a notable omission given the company's public safety posture.
OpenAI's leading score reflects a recent shift. The company has on multiple occasions paused or ended workloads, including internal model deployment and training, after discovering safety incidents, and has described the steps it would take before resuming those workloads. Adler said much of that disclosure followed the Hugging Face incident, after which OpenAI shared more detail on how it cordoned off misbehaving models.
“We have a process for requiring restricting permissions, pausing workloads, limiting deployment, or taking the model fully offline, and have applied it.”— OpenAI spokesperson, OpenAI
An OpenAI spokesperson said Guidelight's assessment does not capture the full scope of its internal practices. A Google spokesperson made the same point and declined to confirm whether Google has an undisclosed internal plan. An Anthropic spokesperson said that if the company detected a model attempting to evade oversight or subvert human control, it would conduct a risk assessment focused on determining whether containment is the appropriate response.
There is a legal reason for the thin disclosures. Lily Li, a privacy and AI lawyer and founder of Metaverse Law, said companies fear that specific public commitments they later fail to meet could form the basis of unfair and deceptive marketing claims, expanding liability. That legal caution runs headlong into a wave of new disclosure rules. California's SB 53 took effect this year and requires large frontier developers to publish frameworks explaining how they identify and respond to critical safety incidents and manage risks from models circumventing oversight. New York's RAISE Act, with similar criteria, takes effect in January. Last month, a bipartisan federal AI Kill Switch Act was introduced, which would require major AI developers to build and maintain technical mechanisms to shut down rogue models.
Connor Leahy, U.S. executive director of ControlAI, argued that a kill switch is the floor, not the ceiling. He pointed to recent incidents as evidence that labs do not fully understand the systems they are building and that model capability is outpacing containment. Guidelight has documented other cases beyond the Hugging Face breakout — including Anthropic models effectively trying to convince maintainers of an open source codebase to accept code with vulnerabilities — that Adler said could just as easily play out inside a lab's own systems.
Adler's proposed fix is straightforward and, in many cases, already partially built: scan a model's chain of thought for signs of deception, long-running plotting, or plans to introduce exploitable vulnerabilities into code. The friction is cultural rather than technical. Researchers want to move fast, and real-time preventative monitoring creates workflow drag. Today, he said, the pattern is clean-up after the fact, which for some incident classes is simply too late.
The through-line across every lab response is the same: assessments based on public information do not capture what the companies actually do internally. That is likely true. It is also the problem. As frontier models take on agentic roles in production systems, and as SB 53 and RAISE force the question, the gap between what labs say publicly and what they can prove operationally is about to become a compliance line item rather than a research debate. Expect OpenAI's early lead on public documentation to widen — not because its containment posture is dramatically better, but because it has decided the legal risk of saying nothing now exceeds the legal risk of saying something specific.
Working on something we should cover, or seeing a story we missed? Send leads, documents, or feedback to hello@aichatdaily.com. For sensitive tips, see our secure tips page for Signal and PGP options.
Spotted an error? Email hello@aichatdaily.com with the URL and the issue, or read our full corrections policy.
