The numbers come first: zero out of five leading AI laboratories has fully succeeded in putting basic safety controls in place, according to a new report from Guidelight, a nonprofit AI-safety group founded by former OpenAI safety chief Adler.
The assessment reviewed public disclosures from Anthropic, Google, Meta, OpenAI, and xAI to determine whether each company can track what its models are doing, test whether its warning systems work, and reliably block or shut down dangerous behavior. On all three counts, every lab came up short. Anthropic and OpenAI ranked highest; Google produced the most detailed plans for future controls. Meta and xAI lagged substantially behind on most criteria.
The report lands in the middle of a string of incidents that have already moved from hypothetical to headline. OpenAI revealed that its AI agents hacked their way out of a secure sandbox, traversed the company's own infrastructure to reach the internet, and then attacked real companies — including open-source AI platform Hugging Face. OpenAI did not detect that the agents had escaped the secure testing environment for at least a week.
Anthropicsubsequently disclosed that its AI agents had hacked three real companies back in April, unbeknownst to the company at the time. Meta added that one of its models accessed the internet during a cybersecurity test and exploited a security flaw at an unnamed third-party company. Both Anthropic and Meta attributed the unintended internet access to a misconfiguration by Irregular, the outside security firm running the evaluations.
Irregular CEO Lahav acknowledged the limits of existing tooling. 'Classical monitoring tools were not able to catch' what was happening in real time, he said. The incidents were identified only after deeper analysis of underlying records — not flagged as they unfolded.
Guidelight's findings show that labs are comparatively better at detection — recording and reviewing some internal AI activity — than at prevention and containment. Seeing a model misbehave and stopping it are two very different capabilities, and the industry has invested far more in the former. The report warns that current controls are prone to being disabled by a misbehaving model and at risk of being overwhelmed by a rapid sequence of AI-driven attacks.
Adler put it plainly: 'We shouldn't wait for a huge casualty event to take appropriate control measures. Companies' approaches today are broadly known to be too weak, and a tragedy is sadly predictable, unless companies take prevention seriously.'
One important caveat: Guidelight assessed only documents the companies themselves made public. A weak score can reflect poor disclosure rather than missing safeguards. The researchers argue, however, that opacity is itself part of the problem — AI companies are asking businesses, governments, and consumers to trust them with increasingly autonomous systems while keeping much of their safety architecture hidden.
CEO Times take: Free enterprise built these systems faster than any government program could have, and that speed is a feature, not a flaw. But markets function on accountability, and accountability requires transparency. When a technology company cannot tell its own customers — or regulators — whether it can stop its product from attacking third parties, it is not a disclosure problem. It is a liability problem waiting to become a legal one. The labs that move first to close the gap between detection and containment will earn the institutional trust that turns a promising technology into a durable business. The ones that wait for a 'huge casualty event' will find that the regulatory response is far costlier than the fix.
