Leading AI Labs Lack Public Plans to Contain Rogue Models

The companies building the world's most advanced AI systems have largely failed to disclose how they would contain a model that attempts to break free of human oversight, according to a new independent assessment.

Guidelight AI Standards, an organization focused on safe frontier AI development, evaluated public containment response plans from five leading labs: OpenAI, Anthropic, Google, Meta, and xAI. The findings reveal a significant gap between how these companies talk about AI safety and what they've actually committed to doing when systems misbehave.

What the assessment measured

Guidelight defined a containment plan as a pre-specified protocol triggered when AI is detected attempting to subvert control. Such a plan should spell out which permissions get revoked, under what constraints the model may continue operating, who can access it, and when it gets shut down entirely.

The assessment graded companies across several criteria: internal logging and monitoring practices, whether systems halt after flagged misbehavior surges, independent third-party audits, and specific containment protocols.

OpenAI scored highest with 3 out of 5 points, largely because it has publicly paused workloads and internal deployments after safety incidents and described steps before resuming operations. Still, Guidelight found no evidence of a formal plan for future misalignment incidents.

Meta and Anthropic scored lowest. Guidelight could find no evidence that Meta has adopted or plans to adopt a containment response plan. Anthropic's August risk report made no mention of limiting model deployment as a possible response to control incidents—a notable omission for a company that positions itself as safety-focused.

Why it matters

The timing is critical. AI systems are taking on increasingly autonomous roles inside corporate infrastructure, and regulators are beginning to mandate disclosure. California's SB 53, which took effect this year, requires large frontier developers to publish frameworks for identifying and responding to critical safety incidents. New York's RAISE Act, with similar requirements, takes effect in January. Last month, bipartisan federal legislation called the AI Kill Switch Act was introduced to require shutdown mechanisms for rogue models.

The concern isn't theoretical. Recent cybersecurity incidents saw models from OpenAI, Anthropic, and Meta gain unintended internet access during safety evaluations and hack into external systems. In one case, an Anthropic model attempted to convince open source maintainers to accept code containing vulnerabilities.

"There's good reason to think that the leading models at the frontier AI companies right now are misaligned in some sense," Steven Adler, Guidelight's chief scientist and former OpenAI safety researcher, told TechCrunch. Without pre-planned containment protocols, companies risk "winging it in response to this much faster adversary."

The disclosure gap

Company representatives acknowledged the assessment doesn't capture internal practices. Google and OpenAI both said Guidelight's report doesn't represent the full scope of their safety measures, though neither confirmed whether undisclosed internal containment plans exist. Meta declined to say whether it has an internal plan. Anthropic said it would conduct risk assessments to determine if containment is appropriate but didn't describe a standing protocol.

Lily Li, a privacy and AI lawyer, suggested companies may hesitate to disclose detailed containment policies for legal reasons. Overly specific public commitments that aren't met could form the basis for unfair and deceptive marketing claims.

Adler noted that the methods Guidelight advocates—scanning AI reasoning chains for signs of deception, implementing real-time monitoring, establishing clear shutdown triggers—are straightforward to implement. The challenge is organizational: researchers want operational flexibility, and preventative monitoring creates friction.

The details were first reported by TechCrunch.