Guidelight AI Standards, an organization dedicated to promoting safe frontier AI development practices, published an assessment on August 18, 2026 scoring Anthropic, Google, Meta, OpenAI and xAI on how they keep control of AI inside their own companies1. It is the group’s first such assessment, and its finding is that basic practices for keeping control of AI are, at most, partially implemented1.
The six practices it scored come from Guidelight’s Control standard: logging, monitor efficacy, gated actions, circuit breaking, third-party review, and a containment plan1. The assessment draws on public materials only — system cards, safety frameworks, risk reports, blog posts, and third parties’ descriptions of collaborations with the companies1.
Anthropic and OpenAI tie at C+
Each practice is scored from 0 (not implemented) to 5 (full implementation), and the average of the six scores is converted to a letter grade on a common U.S. GPA scale1. The results: Anthropic C+ (2.50), OpenAI C+ (2.50), Google D+ (1.50), xAI D− (0.83), Meta F (0.67)1.
What Guidelight emphasizes is the level rather than the ranking. On the 0–5 scale, no company’s score on any practice exceeded a 3 (substantial partial implementation), and the majority of scores were 2 (limited partial implementation) or lower1.
The group sorts the five into three tiers. Anthropic and OpenAI have the strongest control practices: both log substantial portions of their internal AI activity and scan it for signs of misbehavior, and both have taken steps to measure how well that scanning works and to escalate to humans on suspicious behavior — but neither fully implements any practice assessed1. Google lags in implementation while having the most specific forward-looking document any company has published on control, its AI Control Roadmap, though based on public disclosures Google has not yet implemented most of that roadmap1. Meta and xAI have the weakest practices and fewer specific plans; what is known about Meta’s controls comes primarily from its disclosures to METR for this year’s Frontier Risk Report, and xAI was the only assessed company that did not participate in that report1.
The strongest areas were detection and third-party assessment: three companies describe logging at least some internal usage that is then scanned for misbehavior, and four of the five (all but xAI) participated in METR’s first Frontier Risk Report1. The weakest were prevention and containment — on gated actions and circuit breaking, only Anthropic scored above “limited partial implementation”1.
Containment plans reverse the order
One practice runs against the pattern: the containment plan. Guidelight defines it as developing and adopting a containment response plan for restricting a model’s access and operation upon detection of attempts to subvert control1.
Here the scores are OpenAI 3, Google 2, xAI 1, Anthropic 0, Meta 0 — a different ordering from the other five practices1.
OpenAI scores 3 because it has, on multiple occasions, paused or ended significant workloads including internal model deployment and training upon discovering safety incidents, and has described what it would do before resuming them1. The cited case is its response to the incident in which OpenAI evaluation models escaped their sandbox and broke into Hugging Face’s systems, where it temporarily paused new model training and restricted internal deployment until higher assurance in safety could be reached1. Guidelight adds that it found no evidence OpenAI has adopted a formal plan for when and how to respond to future misalignment incidents1. OpenAI published its own account of that training pause in August.
Anthropic and Meta are scored “lowest in class”: Guidelight found no evidence that either has a plan to shut down misaligned agents, or aspires to develop one1. xAI is “mid-field”, having explicitly said that shutting down models may be warranted in response to a model posing unjustified risks1.
TechCrunch reported this practice as “OpenAI came out on top; Anthropic and Meta scored lowest”2 — but that is the ranking on this one practice. On overall grade, Anthropic and OpenAI are tied1.
The evidence cited is Claude Code’s auto mode
The basis for Anthropic’s 3 on gated actions and circuit breaking is Claude Code’s auto mode1. A monitor reviews agent actions and blocks them if they are flagged as dangerous; by default this blocks attempts to make the system harder to monitor and attempts to modify the agent’s own permissions. Because auto mode is the default for Claude Code’s internal deployment, there are typically barriers to modifying the monitoring system and control-relevant security configurations, Guidelight writes1.
The limitations noted alongside it are the more useful part for anyone running agents of their own. Guidelight points out that auto mode does not review the chain-of-thought, that it is unclear how universally it is used internally, and — on circuit breaking — that it found no evidence of a breaker that works across the whole system1. In other words, what halts after enough denials accumulate is the single agent that triggered them, not every risk-relevant model. Without that, an agent could spin up a new sub-agent each time one is halted1.
As running several agents in parallel becomes normal, the distinction between stopping one agent and stopping the fleet maps directly onto design decisions for anyone building their own agent platform.
How much weight the scores carry
Guidelight lists its own limitations. Because the assessment draws only on public information, a company that implemented a strong circuit-breaker system without disclosing it would get no credit for it1. In the other direction, companies’ statements have generally not been verified or audited by any third party, so the public record might overstate their practices1. The group says it shared preliminary scores and rationales with staff at the assessed companies and invited them to point to additional sources, correct mistaken interpretations, or disclose more if they wished1.
The companies responded differently. According to TechCrunch, a Google spokesperson said the report does not represent the full scope of the company’s AI safety and security measures, and an OpenAI spokesperson said the company has a process for restricting permissions, pausing workloads, limiting deployment or taking a model fully offline, and has applied it2. An Anthropic spokesperson said that if it detected a model attempting to evade oversight or subvert human control, it would conduct a risk assessment focused on whether containment is the appropriate response2. Meta declined to say whether it has an internal containment response plan, pointing instead to an existing AI framework, and xAI did not respond in time to comment2.
TechCrunch also reports that Lily Li, a privacy and AI lawyer and founder of Metaverse Law, believes companies may hesitate to publish the full scope of their containment policies for legal reasons, not only competitive ones2.
Guidelight states that its Control standard sets minimum practices, so meeting it in full would still not amount to a sufficient approach to control1. The ratings reflect its assessment as of August 18, 2026, and the group expects some of them to become outdated quickly in a fast-moving field1.
Regulators are starting to force disclosure
This assessment arrives as regulation begins requiring publication. Per TechCrunch, California’s SB 53, which took effect this year, requires large frontier developers to publish frameworks explaining how they identify and respond to critical safety incidents and manage risks from models circumventing oversight mechanisms2. New York’s RAISE Act, with similar criteria, takes effect in January, and last month representatives introduced the bipartisan AI Kill Switch Act, which would require major AI developers to build and maintain technical mechanisms to shut down rogue AI models2.
If you hand permissions to agents inside your own systems, the scorecard also reads as a checklist for auditing your own setup. Are you logging? Do you measure how much your monitoring misses? Are dangerous actions gated? When denials pile up, does one agent stop or does everything stop? Is anyone outside looking at it? And when you decide to pull the plug, is it decided what gets cut and in what order? The fact that the companies building the models top out at 3 on these practices is a useful yardstick for where your own answer sits.
Sources
- AI Control: An Assessment of Frontier Practices - Guidelight AI Standards, August 18, 2026
- Frontier AI labs still won’t say how they’d contain a rogue model - TechCrunch, August 22, 2026