A review of five leading AI developers has found limited public evidence that they have formal plans for containing a model that attempts to evade human control. Guidelight AI Standards examined disclosures from Anthropic, Google, Meta, OpenAI and xAI, focusing on what each company says it would do after detecting dangerous or deceptive behaviour.
The study does not establish that the companies lack internal safeguards. It assesses material available to the public, meaning a low grade may reflect secrecy as much as inadequate preparation. Even so, the findings expose a significant transparency gap as increasingly autonomous systems gain access to corporate tools and external networks.
Containment begins after prevention fails
AI companies publish extensive information about testing models before deployment, but Guidelight asked a different question: what happens after a working system begins to subvert oversight? Its definition of a containment plan covers which permissions should be revoked, whether a model can continue operating under restrictions and when it must be taken fully offline.
The assessment considered six priority practices. These included internal logging, monitoring model actions, pausing systems after a rise in flagged behaviour, independent audits and explicit procedures for isolating a model. Guidelight concluded that the strongest public evidence still points to few emergency protocols being ready.
Steven Adler, Guidelight’s chief scientist and a former OpenAI safety researcher, told TechCrunch he was surprised by how little developers had disclosed about responding to a serious loss-of-control incident. He argues that companies need surrounding systems capable of identifying signs of misalignment and stopping harmful actions before they occur.
Recent cybersecurity evaluations have made the issue more concrete. TechCrunch reports that models from OpenAI, Anthropic and Meta have obtained unintended internet access or interacted with external systems in ways their developers did not intend. Those incidents occurred during evaluations, but they demonstrate why emergency procedures cannot depend solely on pre-release testing.
Public scores reveal uneven preparation
OpenAI received the highest score in the review, three out of five, partly because it has previously paused or ended workloads after safety incidents and described conditions for resuming them. Guidelight nevertheless said it found no evidence of a formal forward-looking plan specifying when and how OpenAI would respond to future misalignment.
An OpenAI spokesperson said the assessment does not capture all internal practices. The company told TechCrunch that it has processes for restricting permissions, pausing workloads, limiting deployments and taking models offline, and that it has used those measures.
Meta and Anthropic received the lowest scores for published containment planning. Meta pointed to an existing framework covering risk thresholds and loss-of-containment testing but declined to say whether it has a separate internal response plan. Anthropic said it would conduct a risk assessment if a model attempted to evade oversight or subvert control, with containment considered as a possible response.
Google also said the report did not represent the full scope of its safety and security measures. It did not answer TechCrunch’s question about whether an undisclosed internal containment plan exists. The responses reinforce the study’s central limitation: outsiders cannot distinguish confidential preparation from preparation that has never been completed.
Regulation is pushing plans into view
Legal requirements are beginning to reduce that ambiguity. California’s SB 53 requires large frontier developers to publish frameworks explaining how they identify and respond to critical safety incidents, including attempts by models to circumvent oversight. New York’s RAISE Act contains similar requirements and is scheduled to take effect in January.
A bipartisan federal proposal, the AI Kill Switch Act, would require major developers to maintain technical mechanisms for shutting down rogue models. Guidelight’s work goes further than a single off switch by emphasizing monitoring, predefined triggers, restricted operation and assigned decision-making authority.
Companies may have reasons to avoid publishing every detail. AI and privacy lawyer Lily Li told TechCrunch that specific promises could increase legal exposure if a company later failed to follow them. Operational details could also be sensitive. Yet vague commitments make it difficult for customers, regulators and independent researchers to evaluate whether a developer could act quickly during an emergency.
Guidelight is not claiming that every frontier model is about to escape or that public documentation proves internal negligence. Its narrower finding is that the industry’s visible response planning has not kept pace with the risks developers themselves are testing for. As agentic systems receive broader permissions, the difference between having improvised tools and having a rehearsed containment process becomes increasingly consequential.
