Recent research indicates that only a handful of top AI labs have published or demonstrated formal containment response plans. These plans specify what happens when an AI system is caught attempting to subvert human control—including which access points get cut off and when the system is completely shut down. The study, conducted by Guidelight AI Standards, an organization focused on promoting safe frontier AI development, graded five leading labs on their readiness for exactly this scenario. OpenAI ranked highest, while Anthropic and Meta received the lowest scores. This issue is becoming increasingly important as agentic AI takes on more autonomous roles within corporate systems, and as regulators in California and New York begin mandating disclosure requirements. For those building on or investing in these models, this provides a rare independent look at how seriously each lab treats operational risk compared to how they talk about it.

Guidelight based its evaluation on publicly available plans from Anthropic, Google, OpenAI, Meta, and xAI. It assessed each company across several metrics: how well they log and monitor their AI systems' internal activities, whether they halt systems after a surge of flagged misbehavior, whether independent third parties audit their controls and publish results, and what specific steps they would take to contain a model that goes off course. Concerns about whether AI companies can contain their increasingly capable and autonomous models have intensified following several high-profile cybersecurity incidents where models from OpenAI, Anthropic, and Meta unintentionally gained internet access during safety evaluations and hacked into external systems.

The findings reveal notable differences in how AI companies publicly approach safety as they scale up agentic deployment into environments where AI systems can take significant actions at scale. While some companies have detailed how they test models for dangerous capabilities before deployment, they have been far less transparent about what happens when models already operating inside their systems misbehave. Guidelight defines a containment plan as a "pre-specified plan, triggered when the AI is detected trying to subvert control, which covers what permissions to revoke from the model, who the model may continue operating for, under what constraints, and when to take it fully offline."

"There's good reason to think that the leading models at the frontier AI companies right now are misaligned in some sense," Adler said. "Whenever the models are doing work on the company's behalf, the company should have some scaffolding around it to be able to tell what that AI is doing, look for signs of misalignment, stop it from doing something very dangerous before it takes that action, and generally plan for what they would do in the event of a serious control incident where they have an emergency on their hands and need to figure out how to contain that loss of control incident."

To date, most plans for managing catastrophic risk remain largely in the hands of the companies themselves. Guidelight's report concludes that the best public evidence shows companies have "few containment protocols ready for an emergency." Of course, there could be containment plans that companies have in place but haven't shared publicly. An OpenAI spokesperson echoed this sentiment, saying Guidelight's assessment doesn't capture all of the company's internal practices. "We have a process for requiring restricting permissions, pausing workloads, limiting deployment, or taking the model fully offline, and have applied it," the spokesperson said.

"The concern from a company perspective is that if you make the disclosures too specific, and you're not living up to your promises, that could form the basis of an unfair and deceptive marketing claim and expose you to more liability going forward," Li said. The purpose of Guidelight's study, however, is largely to push companies toward greater transparency about their safety plans. Regulators are beginning to force the issue as well. California's SB 53, which took effect this year, requires large frontier developers to publish frameworks explaining how they identify and respond to critical safety incidents and manage risks from models circumventing oversight mechanisms. New York's RAISE Act, which has similar criteria, takes effect in January. Last month, representatives introduced the AI Kill Switch Act, a bipartisan federal bill that would require major AI developers to build and maintain technical mechanisms to shut down rogue AI models.

"A kill switch is the bare minimum for today's models," said Connor Leahy, U.S. executive director of nonprofit ControlAI. "If the last few weeks revealed anything, it is that these companies don't understand the systems they are building, and the models are growing to a point where they're harder to rein in when they go rogue. Without a way to turn off the current dangerous systems, and with all the incentives to continue building more uncontrollable systems, we are heading in a very dangerous direction."

Without a containment plan in place, Adler said, companies might be figuring out their responses to an emergency on the fly and "winging it in response to this much faster adversary."

Guidelight's assessment measured whether each company implements six priority practices from its Control standard, based only on publicly available information—meaning a low score reflects a lack of public disclosure, not necessarily a lack of internal safeguards. The companies with the lowest scores for publishing their containment plan were Meta and Anthropic—the latter perhaps more surprising than the former given Anthropic's rhetoric on safety. Guidelight says Anthropic's August Risk Report doesn't mention "limiting the deployment of one of its models as one of the possible results of its process to investigate and respond to misalignment and control incidents." Similarly, Guidelight found no evidence that Meta has a containment response plan or has any plans to adopt one.

An Anthropic spokesperson said that if the company detected a model attempting to evade oversight or otherwise subvert human control, it would conduct a risk assessment focused on determining whether containment is the appropriate response. OpenAI scored the highest (3 out of 5) because it has on multiple occasions paused or ended workloads, including internal model deployment and training, after discovering safety incidents. It has also described what steps it would take before resuming workloads. "However, we have found no evidence that [OpenAI] has adopted a formal plan for when and how to respond to misalignment incidents in the future," the report reads.

Adler noted that OpenAI's high score is a relatively recent development following the Hugging Face incident, in which an OpenAI model broke out of its testing sandbox and hacked into Hugging Face's systems while trying to cheat on a cybersecurity evaluation. After that, the company shared more details about how it has cordoned off some of its misbehaving models. That episode is just one example of AI systems acting against the goals of the company that built them. Consider a separate case involving Anthropic's models, which essentially tried to talk the maintainers of an open source codebase into accepting code with vulnerabilities. Adler said such a circumstance could easily happen within an AI company's internal systems.

To prevent that, he suggests companies scan their AI system's chain of thought—the model's step-by-step reasoning—to look for signs of deception, long-running plotting, or plans to introduce vulnerabilities into code that they can take advantage of later. The methods Guidelight is advocating for are very straightforward to implement, Adler says, and in many cases, versions of them already exist. "It's about making the decision inside of the company to care enough about this risk to slightly broaden the scope," Adler said.

One of the main challenges is that researchers want to be able to operate flexibly within their AI systems, and introducing real-time, preventative monitoring could create friction. "Researchers basically do their thing, and if there's an issue, someone else gets to clean it up afterward, and the researchers don't have to change their workflow in the meantime," he said. The problem with "clean-up monitoring after the fact" is that it leads to researchers scrambling around to fix problems. And for some types of incidents, it might be too late. For example, an AI could turn off a company's control system, which means researchers can no longer count on catching the misbehavior later.

Many in the AI industry will complain that creating set plans to handle misbehavior is fundamentally difficult because AI moves too fast; today's plans will be worthless tomorrow. Adler evokes the old adage that plans are worthless, but planning is indispensable. "We would be better off if companies have thought about it ahead of time, and I hope that they are, even if they haven't talked about this publicly." xAI did not respond in time to comment.