Plans to limit artificial intelligence models still lack clarity, according to a new assessment of five leading AI labs. Guidelight AI Standards says public procedures for when a model attempts to bypass human control remain patchy.
The assessment examines publicly available practices of Anthropic, Google, Meta, OpenAI, and xAI. It does not attempt to prove that the companies lack internal security controls. However, it does document how many of these measures are described in a way that allows for external scrutiny.
The issue becomes more serious as models gain access to tools, code, files, and internal systems. In a serious incident, the response cannot depend solely on last-minute, improvised decisions; it requires a pre-defined process with clear boundaries and responsibilities.
See also: OpenAI: Security changes after the Hugging Face breach
What do model restriction plans include?
Guidelight defines model containment plans as pre-defined procedures that are triggered when a system appears to be attempting to undermine control. They should address what permissions are revoked, who is allowed to continue running the model, under what restrictions, and when it is brought to a complete halt.
According to TechCrunch, the assessment was based on six practices in the Control model: logging internal activity, testing the effectiveness of monitoring mechanisms, approving risky actions, shutting down operations after an accumulation of suspicious behavior, independent auditing, and model mitigation plans. Guidelight published its findings on August 18, clarifying that it used only public information.
The conclusion is that none of the five companies exceeds the level of substantial but partial implementation in any of the six practices. OpenAI scores the highest, 3 out of 5, because it has reported cases of suspending or terminating operations after security incidents. However, the report found no formal, publicly documented plan for future loss-of-control incidents.
Where are the biggest gaps located?
The weaknesses are more pronounced in prevention and containment. Anthropic and OpenAI appear stronger in recording and detecting suspicious behavior, while Google has presented a detailed future roadmap. However, the assessment itself notes that much of this roadmap has not yet been implemented.
Meta and xAI appear to have less specific public data. There is no indication that Meta has published such procedures or intends to adopt such a plan. Anthropic said it would conduct a risk assessment if it identified a model attempting to evade oversight, without publicly outlining all the next steps.
This doesn’t mean a lab is unprepared. It means the market and independent researchers can’t easily assess its processes. Guidelight emphasizes that low performance in a public assessment may reflect a lack of disclosure, not an absence of internal controls.
Why control protocols are critical
The difference between a plan and a blanket commitment is practical. An operational protocol should specify who has the authority to revoke rights, how quickly the suspension is performed, how to verify that the suspension has been applied to all instances of the model, and when the appropriate teams or authorities are notified.
This need is not just for a hypothetical “out of control model.” A bug in a test environment, a misconfiguration of a network, or misuse of credentials can give a system more access than intended. These procedures then act as a plan of action to contain the damage before it spreads.
See also: Kriminal.ai: The $12.99 "criminal AI" that's just a jailbroken Grok
The SecNews technical team believes that transparency must be accompanied by measurable criteria: downtime, revocation testing, independent audits, and clear rules for rollback. Without these, protocols remain more of a statement of intent than a verifiable process.
🔒 Protect your privacy with Proton VPN
Swiss VPN from the creators of Proton Mail — strict no-logs policy, strong encryption, and built-in NetShield that blocks ads, trackers, & malware.
- ✔ No-logs, based in Switzerland (except 14-Eyes)
- ✔ NetShield: blocks ads, trackers & malicious domains
- ✔ Covers all devices — free version available
The link is an affiliate link — SecNews may receive a commission at no additional cost to you. It does not affect the independence of our article writing.
For organizations developing or hosting AI applications, the practical consequence is simple: model permissions should be limited from the start, actions logged, and access revocation tested before it’s needed. Security cannot rely on a single monitoring screen.
See also: ChatGPT iMessage: New Apple Messages plugin raises privacy questions
The conversation about model containment plans is now moving from theory to operational readiness. As AI systems gain more power, it becomes more important for organizations to know not only how to train them, but also how to safely stop them.
