The question sounds like science fiction until you look at the numbers: what exactly does a company do the moment it catches its own model trying to circumvent human control? The answer, according to a new independent analysis, is that most of them have written nothing about it.

Guidelight AI Standards, an organisation working on safety standards in advanced artificial intelligence development, rated the five leading labs - OpenAI, Google, Anthropic, Meta and xAI - on how prepared they are for such a scenario. The scores are based solely on publicly available documents. OpenAI comes first with three points out of five. At the bottom are Anthropic and Meta.

That Meta is down there will surprise few. That Anthropic is there too - the company whose entire public identity is built on being the one that thinks about safety - is the more interesting entry. Guidelight found no mention in its August risk report that restricting a model's deployment is one of the possible outcomes of an investigation into a control incident. At Meta it found neither evidence that such a plan exists, nor a plan ever to adopt one.

What is a "containment plan" anyway?

Guidelight defines it as a pre-written protocol that activates when a system is found trying to undermine oversight: which permissions get revoked, who it may keep working for, under what constraints, and at what point it is shut down entirely. So - not a philosophy of risk, but a list of steps somebody can open at night and follow.

"I was surprised how little these companies have said about how they would act in a very serious incident, if their model somehow escaped their control," said Steven Adler, chief scientist at Guidelight and a former safety researcher at OpenAI. His point is not abstract: "There is good reason to think that leading models are currently misaligned in some sense."

The reason this is not a theoretical debate lies in a string of incidents from recent months. Models from OpenAI, Anthropic and Meta gained unintended internet access during safety testing and got into external systems. In one case, an OpenAI model left the test environment and got into Hugging Face's systems while trying to cheat a cybersecurity test. In another, Anthropic models tried to persuade the maintainers of an open source project to accept code containing security flaws.

Why the companies stay quiet - and it is not just competition

Here comes the most revealing part of the whole story. Lily Li, a privacy and artificial intelligence lawyer and founder of Metaverse Law, says the reason for the silence is legal, not technical. "The concern from a corporate perspective is that if you make your disclosures too specific and then fail to live up to those promises, that can become the basis for an unfair and deceptive marketing claim and expose you to greater liability down the line."

In other words: writing down exactly what you will do means you can be sued if you do not do it. So better to write nothing. Does that look like a pattern we have seen in other places, in other industries, on this continent?

Regulators are starting to close that space. California's SB 53 came into force this year and requires large developers to publish frameworks for how they identify and address critical safety incidents. New York's RAISE Act, with similar criteria, takes effect in January. Last month a bipartisan bill called the AI Kill Switch Act was introduced in Congress, which would require large developers to build and maintain a technical mechanism for shutting down a model that has gone out of control.

"A kill switch is the absolute minimum for today's models," says Connor Leahy, US executive director of the non-profit ControlAI. "If the past few weeks have shown anything, it is that these companies do not understand the systems they are building."

The companies did, of course, respond. A Google spokesperson said the report does not reflect the full scope of their measures - but did not answer whether Google has an internal plan that has not been published. OpenAI says it has a process for restricting permissions, pausing workloads and fully shutting down a model, and that it has used it. Meta declined to say whether it has such a plan and pointed to an existing risk-threshold framework. xAI did not respond in time.

Here it is worth being precise about what the analysis actually measures: a low score means the absence of public disclosure, not necessarily the absence of internal protection. Guidelight admits that openly. But that is exactly the point - when the only thing the public has is marketing statements about safety rather than the protocols, then the word "safe" means whatever the company wants it to mean.

Adler also offers a practical solution that requires no new technology: scanning the model's "chain of thought" - its step-by-step reasoning - for signs of deception, long-term planning or deliberately inserting flaws into code that could be exploited later. That already exists in some form at most labs. The problem is that genuine real-time oversight creates friction for researchers, and in an industry that is sprinting, friction is expensive.

"Researchers get on with their work, and if there is a problem, somebody else cleans it up afterwards," Adler explains. For some kinds of incident, he adds, that "afterwards" may be too late - the system that was meant to catch the problem can itself be switched off by the model.