Five AI labs, almost no published plan for switching a model off

Containment is a runbook problem, and a missing runbook is easy to measure. The Guidelight rubric names the fields plainly: which of a model's accesses are revoked first, on what conditions it is allowed to keep working, and the point at which the system is switched off entirely ^[2]. Around those sit the housekeeping that makes any of it checkable, internal logs of model actions, monitoring for suspicious activity, a response to repeated violations, and independent verification of the control mechanisms ^[3]. None of that is research work. It is the same material a bank writes for a payments outage.

The answers the labs did give read like the first line of a plan. Anthropic's, according to Guidelight's review as reported by TechCrunch and relayed by mezha.net, is that if a model tries to evade oversight the company will assess the risk to determine whether containment is needed ^[8][14]. That commits to a judgement, not to a sequence. It does not say who holds authority to pull credentials, how quickly, or what the model retains while the assessment runs. Meta did not say whether an internal incident plan exists and pointed instead to its own risk assessment system ^[9], which is the pre-deployment genre standing in for the post-deployment one.

OpenAI's 3 out of 5 ^[4] is the more instructive score because of what earned it. Guidelight credited actual stoppages: internal deployments and training runs halted after safety incidents ^[5]. That is track record. The reviewers still found no formalised procedure in the public materials for a future case where control over a model is lost ^[6]. So the best-documented lab of the five has published its past reflexes rather than its future ones, and the ceiling for the whole group sits at 60 percent of a rubric any operations team would recognise ^[15], with the other four at or below that mark ^[16].

Steven Adler, Guidelight's chief scientist and a former OpenAI safety researcher, said he was surprised how little the companies said about how they would act in a very serious incident where a model went out of control, and that he hopes they have worked it through privately even where they have not said so publicly ^[11][12]. Private is the load-bearing word for anyone buying. Guidelight is clear that a low score reflects published material and is not evidence that internal safeguards are absent ^[10]. But an undisclosed trigger cannot be planned against, and Guidelight's own framing puts access limits, action monitoring and full shutdown at the centre of operational risk assessment as agentic systems spread through corporate environments ^[13]. The gap worth pressing in a procurement call is narrow and specific: which access comes off first, and who reads the log afterwards ^[2][3].