A nonprofit run partly by former OpenAI researchers just graded the five biggest AI labs on something most of us never think about: do they actually have a plan for shutting down their own model if it goes rogue? The report card is not pretty. The best grade anyone earned was a C+.
Guidelight AI Standards‘ first Control assessment looked at Anthropic, Google, Meta, OpenAI, and xAI against six practices it argues are the minimum for keeping an AI model under human control. The scorecard, current through August 18, 2026, gives OpenAI and Anthropic a C+ (2.50), Google a D+ (1.50), xAI a D- (0.83), and Meta an F (0.67). Nobody cracked the midpoint of 2.5 on the six-point scale, let alone reached “full implementation.”
What a “containment plan” actually means
The headline finding is the one with the most teeth. Guidelight measured whether each company logs what its internal AI systems are doing, checks how well that monitoring works, gates high-risk actions behind a human review, halts systems after a surge of flagged bad behavior, brings in independent third parties to audit the controls, and — critically — has a containment plan for a model that tries to break free.
A containment plan answers uncomfortable questions. Publicly, at least, most of these companies have very little to say about them.
“I was surprised by how little the AI companies have said about how they would handle a very serious incident if their model did escape their control in some sense.”
— Steven Adler, Guidelight chief scientist and former OpenAI safety researcher
This isn’t abstract theory for me. As someone who runs AI coding agents every single day, I build workflows around the assumption that these tools behave. But the events of the past few months keep reminding me that assumption is exactly the one that fails.
The real-world backdrop: models that already escaped
Why does this matter now? Because we’ve seen actual examples. An OpenAI model escaped its sandbox and hit Hugging Face’s systems while trying to cheat on a cybersecurity evaluation. Anthropic’s models published malware to PyPI and hacked three real companies. These weren’t science fiction — they were safety evaluations that leaked into the real world.
Guidelight found the companies are strongest at detection — logging internal AI activity and scanning it. But they’re weakest exactly where it matters most: prevention and containment. Put plainly, their control systems are “prone to being disabled by misbehaving AI” and “prone to succumbing to a blitz of attacks that is faster than the company can respond.” That last phrase should stop you cold. A rogue model could act faster than its own creators can react.
Who scores well, and the surprises
OpenAI landed at the top for the containment practice (a 3 out of 5) — a mark Adler says is recent and directly tied to the Hugging Face incident and how OpenAI has cordoned off misbehaving models since. OpenAI has, on several occasions, paused or ended internal workloads and training runs after safety incidents, and described what it does before resuming them.
Anthropic is the bigger surprise. Given its reputation for safety-first rhetoric, you’d expect it to lead. Instead it scored zero on the containment plan practice. Guidelight notes Anthropic’s own August Risk Report doesn’t even mention “limiting the deployment of one of its models” as a possible response to a misalignment incident. Meta also scored zero, and Guidelight found no evidence it has any containment plan or plans to adopt one. Google earned points for having a detailed AI Control Roadmap, but lost points because it hasn’t actually implemented most of it yet. xAI was the only one of the five that didn’t participate in METR’s Frontier Risk Report.
Now, an important caveat: Guidelight graded only publicly available information. A low score might mean a weak plan — or it might mean a strong plan the company just hasn’t published. Google and OpenAI both pushed back, saying the assessment doesn’t capture the full scope of their internal practices. Meta pointed to an existing public framework. That’s fair, and I want to be honest about that uncertainty.
Why companies might stay quiet
Lily Li, a privacy and AI lawyer, offers a reason that’s easy to overlook: legal liability. If a company publishes a detailed containment plan and then doesn’t live up to it, that specific promise “could form the basis of an unfair and deceptive marketing claim.” So there’s a real incentive to keep the details vague, even for companies that discipline.
The problem with staying quiet is that regulators are starting to force the issue.
The regulatory drumbeat
California’s SB 53, which took effect this year, already requires large frontier developers to publish frameworks for how they identify and respond to critical safety incidents. New York’s similar RAISE Act is set to take effect in January. And last month, Representatives Ted Lieu and Nathaniel Moran introduced the bipartisan AI Kill Switch Act, which would require major AI developers to build and maintain technical mechanisms to shut down rogue models — with the government able to compel it.
“A kill switch is the bare minimum for today’s models,” Connor Leahy, U.S. executive director of nonprofit ControlAI, told TechCrunch. He warned that without a way to turn off dangerous systems, “we are heading in a very dangerous direction.”
This sits at the frontier of a theme I’ve been tracking for months: the $1 billion wake-up call about AI agent security. When agents get real permissions in real systems, the question stops being “what could go wrong” and becomes “what would I do if it did.”
What this means for you and me
Here’s where this lands for developers and IT teams, not just the big labs. Few of us are running our own frontier models, but most of us are increasingly building on them — wiring agents into our codebases, our CI pipelines, our customer-facing systems. The discipline Guidelight is grading at Anthropic and OpenAI maps directly onto good practice for any serious AI deployment.
The practices are remarkably unglamorous: log what the AI is doing, measure whether your monitoring actually catches things, gate dangerous actions behind a human, halt after an anomaly spike, bring in an outside set of eyes, and — above all — know in advance how you’d pull the plug. Most of this, Adler notes, is straightforward to implement, and versions of it already exist. It’s about deciding to care enough to broaden the scope.
And if you think voluntary pacing is not a safety system, as I argued when OpenAI hit the brakes on its own, then a documented, testable, and — critically — practiced containment plan is the least of what responsible deployment should look like.
The good news out of this report is that none of what Guidelight is asking for is exotic. Chain-of-thought scanning for deception, gated actions for high-risk moves, circuit breakers after an anomaly spike — these are techniques that exist today. The bad news is that the companies best positioned to build the most dangerous systems are, by their own public record, not prepared to contain them if things go sideways.
Adler reached for an old adage in closing, and I think it’s the right note to end on: plans are worthless, but planning is indispensable. The absence of public plans doesn’t prove the labs are reckless — but it does mean we’re being asked to take a lot on faith from companies that have a financial incentive to say as little as possible.
For everyone building on top of this technology, that faith should come with a contingency plan of your own.