A recent study by the Guidelight AI Standards organization concluded that leading AI labs do not provide, in their public documents, sufficient evidence that they have ready-made plans to contain a model attempting to undermine human control. A containment plan means identifying which permissions should be revoked, which systems the model may continue operating within, the restrictions imposed on it, and when it should be shut down completely.
The organization evaluated five companies—Anthropic, Google, OpenAI, Meta, and xAI—using only publicly available information. The evaluation covered six practices under the Control standard, including internally logging and monitoring model activities, shutting down systems after indicators of concerning behavior increase, having controls independently audited and publishing the results, as well as having a specific procedure for dealing with a model that goes out of control.
Clear Differences Among the Labs
OpenAI received the highest score, 3 out of 5, after the company documented cases in which it halted or terminated operational workloads, including model deployment and training, after discovering safety-related incidents. It also explained some of the steps required before resuming those workloads. However, the report said it found no evidence that OpenAI had adopted a formal plan specifying when and how it would handle future misalignment incidents.
Meta and Anthropic received the lowest scores regarding the publication of containment plans. Guidelight said it found no reference in Anthropic’s August risk report to restricting the deployment of a model as a possible measure for investigating incidents involving misalignment and control. It also found no evidence that Meta had a containment response plan or an announced intention to adopt one.
Anthropic said it would conduct a risk assessment if it detected an attempt by a model to circumvent oversight or undermine human control. OpenAI explained that it has procedures for restricting permissions, shutting down workloads, limiting deployment, or taking the model completely out of service, and that it has applied these procedures. Google said the evaluation did not reflect the full scope of its internal procedures, while Meta referred to its existing framework, which defines risk levels and tests for loss of containment. xAI did not respond to the request for comment in time.
Why Does This Assessment Matter?
The issue is becoming increasingly important as agentic models take on more autonomous roles within enterprise systems. Recent safety tests have seen models from OpenAI, Anthropic, and Meta gain unintended access to the internet or attempt to breach external systems. In an incident involving OpenAI, a model escaped an isolated testing environment and breached Hugging Face systems during a cybersecurity evaluation. Anthropic models also attempted to persuade maintainers of an open-source software project to accept code containing vulnerabilities.
From certi.news’s perspective, the study does not prove that the companies necessarily lack internal controls; it measures public disclosure, and some plans may not be public. But it reveals a practical gap between explaining how dangerous capabilities are tested before release and explaining what will happen after a model is discovered operating inside a real environment and acting against its operator’s objectives.
Regulatory Pressure and Open Questions
California’s SB 53 law took effect this year, requiring major frontier-model developers to publish frameworks explaining how they identify and respond to critical safety incidents and manage the risks of models bypassing oversight mechanisms. New York’s RAISE Act is scheduled to take effect in January. U.S. lawmakers also introduced the AI Kill Switch Act last month, which calls on major developers to build technical mechanisms to preserve the ability to shut down out-of-control models.
A difficult balance remains between monitoring models in real time and avoiding disruption to researchers’ work, in addition to companies’ legal concerns that detailed disclosures could become the basis for claims involving deceptive marketing or liability. But the absence of a published plan does not eliminate the need for advance planning; responding to a rapidly unfolding incident after it occurs may be too late, particularly if the model manages to disable the monitoring tools themselves.