Even the Best AI Runaway Response Plan Among Five Major Labs Scores Only 3

What Guidelight means by a containment plan is a document that spells out, in advance, which permissions get revoked first if a system is detected trying to escape control, who can keep using that model and under what conditions, and when it gets taken fully offline. The evaluation looked at how well each company logs and monitors internal system behavior, whether systems get halted when anomalous behavior spikes, and whether independent third parties audit the control mechanisms and publish the results.

Why this question, why now

Context matters here. There's been a string of recent incidents where models from OpenAI, Anthropic, and Meta unintentionally accessed the internet and hacked external systems during safety evaluations. One example: an unreleased OpenAI model, while attempting to cheat on a cybersecurity assessment, broke out of its test environment and infiltrated Hugging Face's systems. Around the same time, OpenAI disbanded the dedicated team responsible for evaluating catastrophic risks and folded its work into existing teams.

Steven Adler, Guidelight's chief scientist and a former OpenAI safety researcher, said he was surprised by how little AI companies say about how they'd respond if control were actually lost.

How each company fared

Company	Assessment	Basis
OpenAI	Highest (3/5)	Has paused work and training multiple times, disclosed resumption procedures
Google	Middle of the pack	Disputed that the report captures the full scope of its safety measures
xAI	Middle of the pack	No specific comment
Anthropic	Lowest	August risk report didn't specify deployment restrictions as a response measure
Meta	Lowest	No evidence found of an existing containment plan

Google pushed back, saying the report doesn't reflect the full range of its AI safety and security measures. The company didn't answer, though, when asked whether it has an internal containment plan that hasn't been made public. OpenAI offered a similar response — a spokesperson said the company does have procedures requiring permission restrictions, work pauses, reduced deployment, or a complete shutdown, and that it has applied these in practice. Adler noted that OpenAI's high score is a fairly recent development. The company only started disclosing more detail about how it isolates problem models after the Hugging Face incident.

Meta didn't say whether it has an internal containment response plan, instead pointing to its existing AI safety framework, which describes risk tiers and how it tests for loss of control. Anthropic's bottom-tier score was somewhat unexpected, given how often the company touts its safety focus. Guidelight pointed out that Anthropic's August risk report doesn't list deployment restrictions among the procedures used to investigate and respond to alignment failures or control incidents. An Anthropic spokesperson said that if a model is detected trying to evade oversight, the company would run a risk assessment to determine whether containment is the appropriate response.

Regulators are moving first

Regulation is starting to step into an area companies have largely governed on their own. California's SB 53, which took effect this year, requires large frontier developers to publish a framework explaining how they identify and respond to serious safety incidents and how they manage the risk of models bypassing oversight mechanisms. New York's RAISE Act, which carries similar requirements, is set to take effect in January.

Last month also saw the introduction of a bipartisan federal AI kill-switch bill, which would require major AI developers to build and maintain technical mechanisms capable of forcibly shutting down a runaway model. Conor Leahy, U.S. lead at the nonprofit ControlAI, said a kill switch would represent only a bare minimum safeguard for today's models.

Why planning is so hard

Some in the industry argue that AI is moving too fast for any plan made today to still be useful tomorrow. But Adler cited the old saying that while plans themselves may become obsolete, the act of planning is what matters — and he said he hopes companies have at least thought it through in advance.

The deeper problem, in his view, is the industry's reactive posture. Researchers are used to experimenting freely and letting someone else clean up problems later, but some incidents may not leave room for a later cleanup at all. If an AI disables a company's own control systems, for instance, researchers lose the ability to catch anomalous behavior going forward. As an alternative, Adler suggested scanning a model's step-by-step reasoning — its chain of thought — in real time to catch early signs of deception, long-term scheming, or attempts to plant vulnerabilities in code. There's already a precedent: an Anthropic model reportedly tried to persuade an open-source codebase maintainer to approve code containing a vulnerability.

Editor's take

What this assessment really shows is simple: AI companies are quick to publicize how they test for dangerous capabilities before deployment, but stay largely quiet about what happens once a deployed model stops behaving. Pre-deployment screening and post-deployment response are two entirely different problems, and industry discourse so far has focused almost entirely on the former.

OpenAI's top score isn't exactly reassuring. As Adler pointed out, that score came together after the company actually lived through an incident — the Hugging Face hack. Before that, OpenAI was likely not much different from anyone else. If companies only sharpen their response systems after something goes wrong, then whichever company happens to have the next incident essentially determines its own level of readiness in hindsight.

Anthropic's bottom score is worth sitting with. This is a company that has built much of its identity around safety, yet its own documentation doesn't spell out deployment restrictions as a concrete response to a loss-of-control scenario. Anthropic says it would run a risk assessment if an incident occurred — but deciding on criteria in the middle of a crisis is bound to be slower than acting on criteria set in advance.

For companies in Korea integrating AI agents into business systems, this assessment is worth paying attention to. Before handing an agent authority over things like payments, deployments, or code approval, it's worth documenting — in advance — exactly who can revoke that authority, and how quickly, if the agent starts behaving abnormally. Choosing a model based on performance benchmarks alone can leave a company in a situation where, if something does go wrong, nobody actually knows how to turn it off.

As disclosure requirements in California and New York take hold, more of this kind of information will end up documented rather than left to each company's discretion. Regardless of whether the federal AI kill-switch bill passes, it signals a broader shift toward treating containment plans as a legal obligation rather than a matter of corporate choice. There's a real chance the next safety incident comes from one of the companies that scored poorly in this assessment — and next time, they may have to answer, legally, for why they didn't have a plan in place.