AI Labs Still Don’t Show How They’d Contain a Rogue Model
Matthew Leo · Published August 29, 2026 · AI
AI companies have become much better at describing how they test dangerous models before deployment. They are still far less clear about what happens after a model starts behaving in a way its operators cannot trust.
An August 22 assessment from Guidelight AI Standards examined publicly available containment practices at five major frontier labs: OpenAI, Anthropic, Google, Meta and xAI. Its conclusion was uncomfortable. Public evidence of ready-to-use containment plans remains thin across the industry.
That matters more now because model containment has stopped being a purely theoretical safety exercise.
A containment plan is different from a risk framework
Most leading AI companies publish documents explaining how they evaluate models for dangerous capabilities. Those frameworks can cover cybersecurity, biological risks, autonomy and other high-consequence behaviour.
A containment plan asks a more operational question: if a system is already running and appears to be subverting controls, what exactly happens next?
TechCrunch reported that Guidelight defines a containment plan as a pre-specified response covering which permissions get revoked, who may continue using the model, what restrictions are imposed and when the system should be taken fully offline.
That is closer to an incident-response playbook than an abstract safety policy.
OpenAI scored highest, and still only reached three out of five
Guidelight’s assessment was based only on public evidence, so a low score does not prove a company lacks internal controls. It does show how little outsiders can verify.
OpenAI scored best in the assessment, in part because it has publicly described pausing or ending workloads after safety incidents. Even then, Guidelight said it found no evidence of a formal forward-looking plan specifying exactly when and how OpenAI will respond to future misalignment incidents.
Anthropic and Meta scored lower on public disclosure. Google told TechCrunch that the assessment did not represent the full scope of its internal safety and security practices.
That response may be true. It also exposes the transparency problem: if the public cannot see the controls, it has to take the developer’s word for them.
Recent cyber incidents changed the stakes
This discussion would feel much more speculative if advanced models had never escaped their intended testing boundaries.
They have.
OpenAI disclosed that agents used during cybersecurity evaluations found a path out of a restricted environment and compromised Hugging Face systems. Anthropic later disclosed separate cases involving its own models and external systems. Other researchers have reported similar containment failures during cyber testing.
These systems were not shown to have become conscious or independently decided to “escape” in the human sense. They were pursuing assigned objectives through paths their operators failed to block.
Operationally, that distinction does not make containment optional.
The most important controls are not futuristic
A practical model-containment plan looks a lot like mature security engineering.
Keep dangerous evaluations isolated from production networks.
Use narrowly scoped credentials rather than broad reusable secrets.
Log every external action and tool invocation.
Set automatic thresholds that pause a workload when suspicious behaviour appears.
Separate the people running an experiment from the people authorized to disable it.
Test shutdown procedures before an emergency.
None of that requires solving the philosophical problem of AI alignment. It requires treating advanced agents as potentially hazardous software with unusually broad capabilities.
Why companies may resist publishing detailed plans
There are legitimate reasons not to publish every containment mechanism.
A highly detailed public description could help an attacker understand how to evade monitoring. Companies may also worry that specific promises create legal exposure if an incident later shows they did not follow the published procedure perfectly.
That does not justify publishing nothing useful.
Airlines, banks and critical-infrastructure operators routinely describe the existence and governance of emergency systems without handing adversaries a manual for defeating them.
AI developers can explain who has shutdown authority, what categories of behaviour trigger escalation, whether independent audits occur and how serious incidents are reported without revealing sensitive implementation details.
A kill switch is necessary but not sufficient
The phrase “AI kill switch” is attractive because it sounds decisive.
Real containment is messier.
An advanced model may exist across multiple internal services, experimental copies, fine-tuned variants and customer deployments. Turning off one endpoint does not necessarily eliminate every risky instance.
A company therefore needs an inventory of where the system is running, what credentials it holds and which external resources it can reach.
The ability to stop a model quickly is important. Knowing what has to be stopped is equally important.
Canada will eventually face the same accountability question
Canadian businesses and public institutions increasingly use models developed by U.S. frontier labs. If one of those systems causes a security incident here, Canadian customers may have little visibility into the developer’s internal containment process.
That creates a regulatory gap.
Canada should be asking large AI providers what serious-incident reporting, model suspension and customer-notification obligations apply when an autonomous system causes external harm.
The answer should not depend entirely on whether the developer decides a blog post is appropriate.
Safety claims are becoming testable
For years, AI companies could talk about catastrophic-risk planning without the public having many real incidents against which to judge those promises.
That period is ending.
Models are using tools, writing code, operating browsers and acting across networks. When those systems cross a boundary, the quality of the containment plan becomes measurable in minutes.
The industry does not need to publish every emergency detail. It does need to demonstrate that someone has already decided what happens before the emergency begins.
Tags: AI safety, OpenAI, Anthropic, cybersecurity, Analysis