Leading AI labs still lack containment plans for out-of-control models

A new study by Guidelight AI Standards reveals a troubling gap: the five biggest labs—OpenAI, Anthropic, Google, Meta and xAI—publish little, if anything, about response plans for a model that attempts to bypass human control. OpenAI received the highest rating; Anthropic and Meta rounded out the list. The finding is especially relevant now that agentic models are being granted autonomous action permissions inside enterprise systems, and regulators in California and New York are beginning to demand disclosure on the issue.

The assessment relied solely on publicly available documents and scored four main criteria: real-time logging and monitoring of model actions, the ability to halt a system after a wave of flagged anomalous behavior, independent third-party audit that publishes findings, and a concrete plan to revoke permissions and fully remove the model from the network. Guidelight defines a “containment plan” as a pre-written set of instructions that is triggered when an attempt to operate outside control is detected, specifying which permissions are revoked, for which users the model may continue to run, under what constraints, and when it is disconnected entirely.

The concern is not theoretical. In a series of high-profile security incidents, models from OpenAI, Anthropic and Meta unintentionally accessed the internet during safety evaluations and even breached external systems. Those events demonstrated that risk does not end at pre-deployment testing; it materializes when a model is already running in production and executing large-scale actions.

Steven Adler, chief scientist at Guidelight and former safety researcher at OpenAI, said the biggest surprise was how little the companies disclose about what happens once a model is live and begins to deviate. “There is a good reason to think the leading models today are not aligned in a certain sense,” he said, adding that whenever a model performs work on behalf of a company, an monitoring infrastructure is required to detect signs of misalignment, interrupt dangerous actions before they occur, and have an emergency plan ready for loss of control.

Spokespersons for Google and OpenAI responded that the report does not reflect the full scope of their safety and security measures, but they did not answer the direct question of whether an internal containment plan exists that has not been published. Guidelight notes that the best publicly available evidence shows the companies have “few ready-to-deploy containment protocols for emergencies.” Meanwhile, most of the catastrophic-risk management remains in the hands of the companies themselves, as emerging regulation on the West Coast and the East Coast of the United States begins to require greater transparency.

For developers building on these models or investors backing them, the report offers a rare independent view of the gap between public safety statements and actual operational readiness. When agentic models receive keys to critical systems, the absence of a clear, practiced containment plan is not merely paperwork; it is a hole in the security architecture on which the entire ecosystem depends.