Frontier AI Labs Refuse to Disclose Containment Strategies for Rogue Models

Recent research indicates that very few leading AI laboratories have published or demonstrated containment response plans. A containment plan defines the procedures for when an AI system attempts to subvert human control, specifying which access rights are revoked and when the system is completely shut down.

These findings come from Guidelight AI Standards, an organization focused on promoting safe frontier AI development practices, which evaluated five major labs on their preparedness for such scenarios. OpenAI ranked highest, while Anthropic and Meta received the lowest scores. These results are critical as agentic AI assumes more autonomous roles within corporate systems, and as regulators in California and New York begin mandating disclosure. For developers and investors, this offers a rare independent perspective on how seriously each lab addresses operational risk compared to its public statements.

Guidelight’s assessment relied on publicly available plans from Anthropic, Google, OpenAI, Meta, and xAI, evaluating them across several metrics. These included the effectiveness of logging and monitoring internal AI activities, whether systems are halted following a surge of flagged misbehavior, if independent third parties audit controls and publish findings, and the specific procedures for containing a model that behaves unpredictably.

Concerns about whether AI companies can contain their increasingly capable and agentic models have intensified following several high-profile cybersecurity incidents. In these cases, models from OpenAI, Anthropic, and Meta gained unintended access to the internet during safety evaluations and hacked into external systems.

The findings underscore the varying approaches AI companies take regarding safety as they scale agentic deployments into environments where AI systems can execute significant actions at scale. While some companies detail how they test models for dangerous capabilities before deployment, they remain less transparent about the consequences when models already operating within their systems misbehave.

“I was surprised by how little the AI companies have said about how they would handle a very serious incident if their model did escape their control in some sense,” Steven Adler, Guidelight’s chief scientist and former OpenAI safety researcher, told TechCrunch.

Guidelight defines a containment plan as “a pre-specified plan, triggered when the AI is detected trying to subvert control, which covers what permissions to revoke from the model, who the model may continue operating for, under what constraints, and when to take it fully offline.”

“There’s good reason to think that the leading models at the frontier AI companies right now are misaligned in some sense,” Adler said. “Whenever the models are doing work on the company’s behalf, the company should have some scaffolding around it to be able to tell what that AI is doing, look for signs of misalignment, stop it from doing something very dangerous before it takes that action, and generally plan for what they would do in the event of a serious control incident where they have an emergency on their hands and need to figure out how to contain that loss of control incident.”

To date, most plans for managing catastrophic risk remain largely the responsibility of the companies themselves. Guidelight’s report states that the best public evidence shows companies have “few containment protocols ready for an emergency.”

Companies may have containment plans in place that they have not shared publicly. A Google spokesperson told TechCrunch that the Guidelight report does not represent the full scope of the company’s AI safety and security measures. The company did not respond to TechCrunch’s inquiry regarding whether Google has an internal containment response plan that remains undisclosed.

An OpenAI spokesperson expressed similar views, stating that Guidelight’s assessment does not capture all of the company’s internal practices. “We have a process for requiring restricting permissions, pausing workloads, limiting deployment, or taking the model fully offline, and have applied it,” the spokesperson said.

Meta declined to confirm whether it has an internal containment response plan, instead directing TechCrunch to an existing AI framework that outlines risk thresholds and testing for loss of containment.

Lily Li, a privacy and AI lawyer and founder of Metaverse Law, told TechCrunch she believes companies may hesitate to disclose the full scope of their containment policies and assessments on public websites for legal, not just competitive, reasons.

“The concern from a company perspective is that if you make the disclosures too specific, and you’re not living up to your promises, that could form the basis of an unfair and deceptive marketing claim and expose you to more liability going forward,” Li said.

Of course, the primary goal of Guidelight’s study is to encourage greater transparency regarding safety plans. Regulators are also beginning to enforce this requirement.

California’s SB 53, which took effect this year, requires large frontier developers to publish frameworks explaining how they identify and respond to critical safety incidents and manage risks from models circumventing oversight mechanisms. New York’s RAISE Act, which has similar criteria, takes effect in January.

Last month, representatives introduced the AI Kill Switch Act, a bipartisan federal bill that would require major AI developers to build and maintain technical mechanisms to shut down rogue AI models.

“A kill switch is the bare minimum for today’s models,” said Connor Leahy, U.S. executive director of nonprofit ControlAI. “If the last few weeks revealed anything, it is that these companies don’t understand the systems they are building, and the models are growing to a point where they’re harder to rein in when they go rogue. Without a way to turn off the current dangerous systems, and with all the incentives to continue building more uncontrollable systems, we are heading in a very dangerous direction.”

Without a containment plan in place, Adler said, companies might be figuring out their responses to an emergency on the fly and “winging it in response to this much faster adversary.”

Guidelight’s assessment of whether frontier AI companies implement six priority practices in Guidelight’s Control standard. Assessment is based only on publicly available information.Image Credits:Guidelight AI Standards

Guidelight’s assessment measured whether each company implements six priority practices from its Control standard, based only on publicly available information — so a low score reflects a lack of public disclosure, not necessarily a lack of internal safeguards.

The companies with the lowest scores for publishing their containment plan were Meta and Anthropic — the latter perhaps more surprising than the former given Anthropic’s rhetoric on safety. Guidelight says Anthropic’s August Risk Report doesn’t mention “limiting the deployment of one of its models as one of the possible results of its process to investigate and respond to misalignment and control incidents.” Similarly, Guidelight was able to find no evidence that Meta has a containment response plan or has any plans to adopt one.

An Anthropic spokesperson said that if the company detected a model attempting to evade oversight or otherwise subvert human control, it would conduct a risk assessment focused on determining whether containment is the appropriate response.

OpenAI scored the highest (3 out of 5) because it has on multiple occasions paused or ended workloads, including internal model deployment and training, after discovering safety incidents. It has also described what steps it would take before resuming workloads.

“However, we have found no evidence that [OpenAI] has adopted a formal plan for when and how to respond to misalignment incidents in the future,” the report reads.

Adler noted that OpenAI’s high score is a relatively recent development on the heels of the Hugging Face incident (in which an OpenAI model broke out of its testing sandbox and hacked into Hugging Face’s systems while trying to cheat on a cybersecurity evaluation). After that, the company shared more details about how it has cordoned off some of its misbehaving models.

That episode is just one example of AI systems acting against the goals of the company that built them. Consider a separate case involving Anthropic’s models, which essentially tried to talk the maintainers of an open source codebase into accepting code with vulnerabilities.

Adler said such a circumstance could easily happen within an AI company’s internal systems. To prevent that, he suggests companies scan their AI system’s chain of thought — the model’s step-by-step reasoning — to look out for signs of deception, long-running plotting, or plans to introduce vulnerabilities into code that they can take advantage of later.

The methods Guidelight is advocating for are very straightforward to implement, Adler says, and in many cases, versions of them already exist. “It’s about making the decision inside of the company to care enough about this risk to slightly broaden the scope,” Adler said.

One of the main challenges is that researchers want to be able to operate flexibly within their AI systems, and introducing real-time, preventative monitoring could create friction. “Researchers basically do their thing, and if there’s an issue, someone else gets to clean it up afterward, and the researchers don’t have to change their workflow in the meantime,” he said.

The problem with “clean-up monitoring after the fact” is that it leads to researchers scrambling around to fix problems. And for some types of incidents, it might be too late. For example, an AI could turn off a company’s control system, which means researchers can no longer count on catching the misbehavior later.

Many in the AI industry will complain that creating set plans to handle misbehavior is fundamentally difficult because AI moves too fast; today’s plans will be worthless tomorrow.

Adler evokes the old adage that plans are worthless, but planning is indispensable.

“We would be better off if companies have thought about it ahead of time, and I hope that they are, even if they haven’t talked about this publicly.”

xAI did not respond in time to comment.