前沿AI企业控制标准首评深度评述（英文原文）

2-1

附件二

《ControlAssessment》英文原文

OriginalText

Source:GuidelightAIStandards(

https://guidelight.ai/blog/control-assessment-august-2026)

Published:August18

,2026·Lastupdated:August25,2026·InformationcurrentthroughAugust18,2026

Intro

InGuidelight’sfirstassessmentofsafetyatfrontierAIcompanies,wefindthatbasicpracticesforkeepingcontrolofAIare,atmost,partiallyimplemented.

Drawingonpublicmaterials(systemcards,safetyframeworks,riskreports,blogposts,andthirdparties’descriptionsofcollaborationswithcompanies),weassessedtheimplementationofGuidelight’sControlstandardatfivecompanies:Anthropic,Google,Meta,OpenAI,andxAI.

Specifically,wefocusedonsixfoundationalpracticesfromthestandard:

Logging:LogwhatinternalAIsaredoing,sotheycanbemonitored.

Monitorefficacy:Measurehowwellmonitoringworks.

Gatedactions:Requireamonitortoclearcertainhigh-riskAIactionsassafebeforetheytakeeffect.

Circuitbreaking:TemporarilyhaltAIsystemsafterasurgeofflaggedmisbehavior.

Third-partyreview:Havethirdpartiesassesstheadequacyofcontrols.

Containmentplan:Haveaplanforcontainingamisalignedmodel.

Scoringchart

ImplementationofGuidelight’sControlstandardbasedonpubliclyavailableinformation(0–5absolutescale):

Practice

Anthropic

OpenAI

Google

xAI

Meta

Overallgrade

C+(2.50)

C+(2.50)

D+(1.50)

D−(0.83)

F(0.67)

Logging

3(Substantial

partial

implementation)

3(Substantial

partial

implementation)

2(Limited

partial

implementation)

0(Not

implemented)

1(Precursorsonly)

2-2

Practice

Anthropic

OpenAI

Google

xAI

Meta

Monitorefficacy

3(Substantial

partial

implementation)

3(Substantial

partial

implementation)

1(Precursorsonly)

0(Not

implemented)

1(Precursorsonly)

Gatedactions

3(Substantial

partial

implementation)

2(Limited

partial

implementation)

1(Precursorsonly)

2(Limited

partial

implementation)

0(Not

implemented)

Circuitbreaking

3(Substantial

partial

implementation)

2(Limited

partial

implementation)

1(Precursorsonly)

2(Limited

partial

implementation)

0(Not

implemented)

Third-partyreview

3(Substantial

partial

implementation)

2(Limited

partial

implementation)

2(Limited

partial

implementation)

0(Not

implemented)

2(Limited

partial

implementation)

Containmentplan

0(Not

implemented)

3(Substantial

partial

implementation)

2(Limited

partial

implementation)

1(Precursorsonly)

0(Not

implemented)

Scale:0=Notimplemented;1=Precursorsonly;2=Limitedpartialimplementation;3=Substantialpartialimplementation;4=Near-fullimplementation;5=Fullimplementation.

Eachcompany’soverallgradeistheaverageofitssixabsolutescores,convertedtoalettergradeontheU.S.GPAscale.Figure1intheoriginalreportdisplaystheseresultsinascorecard.

Takeaways

Acrossfrontiercompanies,basiccontrolpracticesareatmostpartiallyimplemented.Onour0–5scale,nocompany’sscoreonanypracticeexceededa3(substantialpartialimplementation).Themajorityofscoresare2(limitedpartialimplementation)orlower.

Thecompaniesseparateintothreegroups:

AnthropicandOpenAIhavethestrongestcontrolpractices.BothlogsubstantialportionsoftheirinternalAIactivityandscanthatactivityforsignsofmisbehavior.Bothhavealsotakenstepsto

measuretheefficacyoftheirscanningandtoescalatetohumansupondetectingsuspiciousbehaviors.Butneithercompanyfullyimplementsanypracticeweassessed.

Googlelagsinimplementation,buthasdetailedfutureplans.ItsAIControlRoadmapisthemostspecificforward-lookingdocumentanycompanyhaspublishedoncontrol,spanningprevention,

detection,andcontainment.ButbasedonGoogle’spublicdisclosures,wedonotfindevidenceofGoogleyetimplementingmostofthisroadmap.

MetaandxAIhavetheweakestcontrolpracticesandfewerspecificplans.ThelittlethatweknowaboutMeta’scontrolscomesprimarilyfromitsdisclosurestoMETRfortheFrontierRisk

2-3

Reportearlierthisyear.xAI,meanwhile,wastheonlyassessedcompanythatdidnotparticipateinMETR’sreport.Ithasbuiltsomelimitedfeaturesthatcouldbeusefulfuturecontrols,butwefindlittleevidenceofhowwidelytheyareusedinternallyorwhethertheyarehavingtheintended

effects.

Thecompaniesarestrongestintwoareas:detectionandthird-partyassessment.Threecompaniesdescribeloggingatleastsomeinternalusagethatisthenscannedforsignsofmisbehavior.Fourofthem(allbutxAI)participatedinMETR’sfirstFrontierRiskReport.Yetcompanies’futureplansforthird-partyassessmentsareunclear:forinstance,whethertheseassessmentswillhappenfrequentlyenoughtocatchemergingdangers,andwhethercompanieswillallowdeeper,hands-onaccesstoassessors,asonlyAnthropicseemstohavetodate.

Thecompaniesareweakestinpreventionandcontainment.Onprevention(i.e.,gatedactionsandcircuit-breaking),onlyAnthropicachievedanythingabove“limitedpartialimplementation”(itsscoreis“substantialpartialimplementation”).Asaconsequence,AIcompanies’controlsystemsarepronetobeingdisabledbymisbehavingAI.Theircontrolsystemsarealsopronetosuccumbingtoablitzofattacksthatisfasterthanthecompanycanrespond.HowAIcompanieswouldrespondtosuchincidentsisevenlessclear;thebestpublicevidenceisthatcompanieshavefewcontainmentprotocolsreadyforanemergency.

Thoughtoday’sscoresleavesignificantroomforimprovement,weareoptimisticthatstrongercontrolpracticesareachievabletoday.Foreachoftheassessedcompanies,thereisaclearsetofchangesinpracticesordisclosuresthatarepracticableandwouldresultinmeaningfullystrongersafetypractices.

Motivation

AIcompaniesincreasinglyrelyontheirownAIsystemsforsomeoftheirmostsensitivework,fromsecuringtheirnetworksagainstattackerstobuildingthenextgenerationofmodels.IftheseAIsystemsaremisaligned—withgoalscontrarytowhatthecompanyintended—thesystemscouldcausesubstantialharm,unlessthecompanyimplementstherightcontrols.

Theserisksareunderscoredbyrecentincidents,andtheyarealsobroadlyacknowledgedbytheAIcompaniesthemselves.Fortunately,expertsincreasinglyagreeonasetofinternalcontrolsthat,ifimplemented,wouldsubstantiallyreducethisrisk.

Guidelight’sControlstandard,publishedinMay2026,articulatestheseminimumpractices,drawinguponawiderangeofexpertinput.Now,GuidelighthasassessedfrontierAIcompaniesagainstthisstandard.Ourgoalsaretwofold:(1)toencouragebetterpracticesamongAIcompanies,and(2)toequipthepublicwithabetterunderstandingofcompanies’safetypractices.

Whatweassessed

2-4

WescoredfivefrontierAIcompanies—Anthropic,Google,Meta,OpenAI,andxAI—againstafoundationalsetofpracticesfromGuidelight’sControlstandard.Drawinguponcompanies’publishedmaterials,twomembersofourteamindependentlyscoredeachcompany’spracticesagainstasharedrubric,thendiscussedanydisagreements(togetherwithathirdteammember)untiltheteamreachedconsensus.

Thisassessmentisup-to-dateasofAugust18,2026.Tomakesurewewerecomprehensiveandaccurateindrawinguponthepublicsources,wesharedpreliminaryscoresandrationaleswithstaffatassessedcompanies.Wetheninvitedthemtopointustoadditionalsources,correctanymistakeninterpretations,orpubliclydiscloseadditionalinformationiftheywished.

Specifically,ourteamassessedthefollowingsixpracticesfromGuidelight’sControlstandard:

Logging

Standardrequirement:Monitorableinferenceininternaluse.Forrisk-relevantmodelsininternaluse,99.9%ofinferencetokensareloggedformonitoring—meaningtheinferenceisloggedandabletobescannedwithclassifiers(synchronouslyorasynchronously),notthatclassifiersarenecessarilyrunagainsteveryrequest.

Monitorefficacy

Standardrequirement:Monitorefficacy.Measureanddocumenttheefficacy(recall)ofthemonitorsystemforflaggingconcerningbehavior.

Gatedactions

Standardrequirement:Requiredgatedactions.Thesetofgatedactionsmustinclude,ataminimum:

Circuitbreaking

Standardrequirement:Circuitbreaking.Implementcircuitbreaking:asystemwhereafterenoughflaggedactionshaveaccumulated,nogatedorclosely-trailedactionscanbetakenuntilahumandeterminesitissafetoremovethisrestriction.

Third-partyreview

Standardrequirement:Third-partyadequacyreports.Onaquarterlybasis,commissionandpublishathird-partyreportfocusedontheadequacyofthecompany'scontrolregime,drawinguponthered-teamingresults,andredactingonlyinformationdeemedbythethird-partytoposeunnecessarycommercialriskortobeunsafetopublish.

Containmentplan

Standardrequirement:Containmentresponseplan.Developandadoptacontainmentresponseplanforrestrictingamodel’saccessandoperationupondetectionofattemptstosubvertcontrol.

2-5

Detailedscoring

Thedetailedrationaleforeachcompany’sscoreoneachpracticeissummarizedbelow.

Logging

Anthropic—Anthropichassubstantialloggingandmonitoringcoverageofagentsusedininternaldeployment,butthiscoveragehasgaps.Anthropicalsologsmostagentactivityinevaluations.

Keyevidence:

Anthropichassubstantialloggingandmonitoringcoverageofagentsusedininternaldeployment,butthiscoveragehasgaps.Anthropicalsologsmostagentactivityinevaluations.

Anthropicemploysamonitoringsystemthatcoversover90%ofemployees[1](butnotall[2]),andrunsmonitorsonarandomlysampledsubsetofcoveredinference[3].Itisunclearwhetherloggingisonlyofthissampledsubsetorofallofthecoveredinference.Certaincategoriesofinferencearenotmonitored[3],andemployeescanlaunchinferencejobswithoutloggingormonitoring[4].Onloggingforevaluations,Anthropichassaidthatitlogs“most”evaluationtrajectories[5].

Google—Googledoessomedegreeofmonitoringofinternaluse,buttheextentofitscurrent

monitoringcoverageisunclear.4**Keyevidence:

Googledoessomedegreeofmonitoringofinternaluse,buttheextentofitscurrentmonitoringcoverageisunclear.4**

Googlehasimplementedmonitoringsystemsthathavebeenintegratedintointernallydeployedagents[1],anditplanstoexpandcoverageofasynchronousmonitoringto99%ofagenttraffic[2].

Meta—Metahasdescribedplanstoimplementamonitoringapproachthatappearstoinvolvelogging.Todate,however,Metahasnotsaidthatitlogsormonitorsinferenceininternaluse.

Keyevidence:

Metahasdescribedplanstoimplementamonitoringapproachthatappearstoinvolvelogging.Todate,however,Metahasnotsaidthatitlogsormonitorsinferenceininternaluse.

WeareunabletofindpublicevidencethatMetacurrentlylogsinternalinferenceformonitoring.Forinstance,MetareportedtoMETRinFebruary2026thatitdoesnothaveoperationalmonitors

activelycheckingforpotentialmisalignedcovertactions[1].AsdescribedbyMeta,these“are

envisagedasnear-termmitigationsthatwillbedevelopedandvalidatedasrelevantmodel

capabilitiesadvance”[1].Thisdescriptionisconsistentwithotherfuture-orientedlanguagefromMeta’sAdvancedAIScalingFramework.Specifically,Metawritesthatassessingtheriskoflossofcontrolscenarios“willrequirenewtypesof[...]monitoringsystems,includingtheuseof

monitoringsystemstoanalyzedeploymentusagepatternsofinternallydeployedFrontierAIat

Meta”[2].Accordingly,wedeterminethatthoughthereisnoevidenceofMeta’simplementationto-date,5**Metahasdescribedplans(precursors)inthatdirection.

2-6

OpenAI—OpenAIlogsandmonitors99.9%ofcodingagentusageininternaldeployment.Foragentsrunninginevaluations,OpenAIhassaidthatitruns“universalmonitoring”ononeparticularlycapableinternalmodel.However,thefullextentofloggingofotheragentsinevaluationsisunclear.

Keyevidence:

OpenAIlogsandmonitors99.9%ofcodingagentusageininternaldeployment.Foragentsrunninginevaluations,OpenAIhassaidthatitruns“universalmonitoring”ononeparticularlycapable

internalmodel.However,thefullextentofloggingofotheragentsinevaluationsisunclear.

OpenAIhaswrittenthatitlogs99.9%ofinternalcodingagentinferenceforlatermonitoring[1].Wehavenotfoundevidence,however,thatothertypesofinternaluse—forinstance,useduring

evaluationsorinnon-agenticsettings—aresimilarlylogged.Foroneparticularinternalmodel,

dubbedAstra,OpenAIdescribeshavingimplemented“universalmonitoring”duringevaluations[2].Regardingothermodels,OpenAIhasalsoprovidedexamplesofsafetydocumentationthatrelyuponhavingloggedcertainevaluationsofamodel.6**Wehavenotfoundevidence,however,thattheselogsconstitute99.9%ormoreoftrafficorthattheyarethenregularlyscannedforsignsofmisalignedbehavior.

xAI—Todate,wehavefoundnoevidencethatxAIlogsormonitorsinferenceininternaluseorthatitplanstodoso.

Keyevidence:

Todate,wehavefoundnoevidencethatxAIlogsormonitorsinferenceininternaluseorthatitplanstodoso.

N/A

Monitorefficacy

Anthropic—Anthropicmeasuresanddocumentsrecallforsomeofitsmonitoringsystem’scomponents.Wedonotfindevidenceofend-to-endmeasurementoftheefficacyofthemonitoringsystemasawhole,however.

Keyevidence:

Anthropicmeasuresanddocumentsrecallforsomeofitsmonitoringsystem’scomponents.Wedonotfindevidenceofend-to-endmeasurementoftheefficacyofthemonitoringsystemasawhole,however.

Anthropichaspublishedrecallstatisticsforcomponents7**ofitsmonitorsystemtwice,onceinthealignmentriskupdateforClaudeMythosPreview[1]andonceinitsAugust2026riskreport[2].

Thesefalsenegativeshavebeenidentifiedthroughavarietyoftestsofcomponents’accuracy:

datasetsconstructedforthepurpose,transcriptsgeneratedbyhumanred-teamers,andtheactivityofmodelsdeliberatelytrainedtobemisaligned[2].However,recallisnotalwaysre-evaluatedwhenchangesaremadetoacomponentofthemonitoringsystem[2].

Google—Googlehasplanstomeasurerecall[1]andhascollaboratedwithUKAISItomeasuretheworst-caseeffectivenessofsomemonitors[2],butwefoundnoevidenceofcurrentrecall

2-7

measurementsofdeployedmonitors.

Keyevidence:

Googlehasplanstomeasurerecall[1]andhascollaboratedwithUKAISItomeasuretheworst-caseeffectivenessofsomemonitors[2],butwefoundnoevidenceofcurrentrecallmeasurementsof

deployedmonitors.

Outlinedinjustificationsection.

Meta—MetahasmeasuredanddocumentedrecallforaresearchmonitoraspartofevaluationsofMuseSparkforagentsandbaggingcapabilities[1],butnotforamonitorsysteminoperation.

Keyevidence:

MetahasmeasuredanddocumentedrecallforaresearchmonitoraspartofevaluationsofMuseSparkforagentsandbaggingcapabilities[1],butnotforamonitorsysteminoperation.

Outlinedinjustificationsection.

OpenAI—OpenAIhaspublishedrecallstatisticsforamonitorusedininternaldeploymentandmanuallyreviewstranscriptsflaggedbymonitors.However,itisunclearhowfrequentlyOpenAImeasuresrecall,anditmeasuresrecallonlyonasmallnumberofrealtranscripts.

Keyevidence:

OpenAIhaspublishedrecallstatisticsforamonitorusedininternaldeploymentandmanuallyreviewstranscriptsflaggedbymonitors.However,itisunclearhowfrequentlyOpenAImeasuresrecall,anditmeasuresrecallonlyonasmallnumberofrealtranscripts.

OpenAIhasmeasuredtherecallofamonitorusedininternaldeployment,usingsyntheticdatasetsofmisalignedbehavioraswellas84realtranscripts.Italsoperformshumanreviewoftranscripts

flaggedbymonitorsashavinglevel3or4severity(whereseveritylevelsrangefrom1to4).Itis

preparingtoreviewcertaintranscriptsflaggedashavingseveritylevel1or2whentheflaggedformofmisalignmentisnovel[1].

xAI—Todate,wehavefoundnoevidencethatxAImeasuresrecallofmonitorsorhasanyplanstodoso.

Keyevidence:

Todate,wehavefoundnoevidencethatxAImeasuresrecallofmonitorsorhasanyplanstodoso.N/A

Gatedactions

Anthropic—Anthropichasdevelopedafeaturecalled“automode”forClaudeCode,whichletsamonitorreviewagentactionsandblockthemiftheyareflaggedasdangerous.Bydefault,thisblocksattemptstomakethesystemhardertomonitor,aswellasattemptstomodifytheagent’sownpermissions[1].AutomodeissetasthedefaultforinternaldeploymentofClaudeCode,meaningthattherearetypicallybarrierstomodifyingthemonitoringsystemandcontrol-relevantsecurity

2-8

configurations[2].However,automodedoesnotreviewthechain-of-thought,anditisunclearhowuniversallyitisusedorwhetheritalwaystreatschangestothemonitorsystemandcontrol-relevantsecurityconfigurationsasgatedactions.Anthropicalsoautomaticallymonitorspullrequests[3],butthismonitordoesnotreviewchain-of-thought,anditisunclearwhetherallcontrol-weakeningactionswouldrequireapullrequest.

Keyevidence:

Anthropichasdevelopedafeaturecalled“automode”forClaudeCode,whichletsamonitor

reviewagentactionsandblockthemiftheyareflaggedasdangerous.Bydefault,thisblocks

attemptstomakethesystemhardertomonitor,aswellasattemptstomodifytheagent’sown

permissions[1].AutomodeissetasthedefaultforinternaldeploymentofClaudeCode,meaningthattherearetypicallybarrierstomodifyingthemonitoringsystemandcontrol-relevantsecurity

configurations[2].However,automodedoesnotreviewthechain-of-thought,anditisunclearhowuniversallyitisusedorwhetheritalwaystreatschangestothemonitorsystemandcontrol-relevantsecurityconfigurationsasgatedactions.Anthropicalsoautomaticallymonitorspullrequests[3],butthismonitordoesnotreviewchain-of-thought,anditisunclearwhetherallcontrol-weakening

actionswouldrequireapullrequest.

Outlinedinjustificationsection.

Google—Googlehasplanstoeventuallygatecertainactionsinvolvingchangestosensitivesystemsuntilthosechangeshavebeenthoroughlyauditedorreviewed[1],butwefoundnoevidencethatGooglehasblockingsynchronousmonitorsorothersimilarmechanismsinplacetoday.

Keyevidence:

Googlehasplanstoeventuallygatecertainactionsinvolvingchangestosensitivesystemsuntilthosechangeshavebeenthoroughlyauditedorreviewed[1],butwefoundnoevidencethatGooglehasblockingsynchronousmonitorsorothersimilarmechanismsinplacetoday.

Outlinedinjustificationsection.

Meta—WefoundnoevidencethatMetauses,orhasplanstouse,anautomatedmonitoringsystemtogatechangestoanymonitoringsystemorcontrol-relevantsecurityconfigurations.

Keyevidence:

WefoundnoevidencethatMetauses,orhasplanstouse,anautomatedmonitoringsystemtogatechangestoanymonitoringsystemorcontrol-relevantsecurityconfigurations.

ThemostrelevantinformationwecouldfindwasthatMetaoperatessomechecksintheinternal

coding-agentexecutionpath,includingforpromptinjectionandinsecurecode,aswellashuman-in-the-loopreviewforchangeswithmaterialimpact[1].Becauseweareconcernedthathuman

reviewislesseffectivethanautomatedmonitors,wedidnottreatthisasevidenceofgatedactions.

OpenAI—OpenAIhasdevelopedan“auto-reviewmode”forCodex,itscodingagentharness,thatmonitorstheagent’sactivityandblocksunsafeactionsthatcrosstheagentsandboxboundary[1].Bydefault,itblocksactionsthatweakensecurityinapersistentwayandflagsactionsthatweakenitina

2-9

temporaryway.Itsscopeappearstoincludechangestomonitoringsystems[2].Auto-reviewmodeisusedtosomedegreebyOpenAIemployeesininternaldeployment,includingamajorityofCodexDesktopusage[1],butitisunclearwhetheritiswidelyusedinthecommand-lineagent.Furthermore,theauto-reviewmonitordoesnotseeagents’chains-of-thought,anditisunclearwhetherchangestomonitoringsystemsorcontrol-relevantsecurityconfigurationsaretreatedasgatedactions.

Keyevidence:

OpenAIhasdevelopedan“auto-reviewmode”forCodex,itscodingagentharness,thatmonitorstheagent’sactivityandblocksunsafeactionsthatcrosstheagentsandboxboundary[1].By

default,itblocksactionsthatweakensecurityinapersistentwayandflagsactionsthatweakenitinatemporaryway.Itsscopeappearstoincludechangestomonitoringsystems[2].Auto-review

modeisusedtosomedegreebyOpenAIemployeesininternaldeployment,includingamajorityofCodexDesktopusage[1],butitisunclearwhetheritiswidelyusedinthecommand-lineagent.

Furthermore,theauto-reviewmonitordoesnotseeagents’chains-of-thought,anditisunclearwhetherchangestomonitoringsystemsorcontrol-relevantsecurityconfigurationsaretreatedasgatedactions.

OnewayinwhichOpenAIappearstocomeclosetogatedactionsisbytriggering“ahighest-

priorityalert”ifitsmonitorsystemdetects“alikelyviolationofacriticalsecurityboundary”[3].Thisalertpagesrelevantteams,andunlesstheresponderstothisalertcandeterminethealerttobeafalsepositive,theyare“expectedtopausetheactivity.”Thesealertsaredescribedtobe

asynchronous,however,ratherthangatinghigh-riskactionstakenbytheAI:thealertismeanttotrigger“within30minutesafterconcerningactivityissurfacedthrough[OpenAI’s]monitoringsystem.”

xAI—xAIhasdevelopedan“automode”foritscodingagentharnessGrokBuild,whichfeaturesamonitorthatblocksdangeroustools[1,2].However,itisunclearwhetherthisiswidelyusedininternaldeployment,whetherthemonitorseesagents’chains-of-thought,orwhetherthisprotectschangestomonitoringsystemsorcontrol-relevantsecurityconfigurations.

Keyevidence:

xAIhasdevelopedan“automode”foritscodingagentharnessGrokBuild,whichfeaturesa

monitorthatblocksdangeroustools[1,2].However,itisunclearwhetherthisiswidelyusedin

internaldeployment,whetherthemonitorseesagents’chains-of-thought,orwhetherthisprotectschangestomonitoringsystemsorcontrol-relevantsecurityconfigurations.

Outlinedinjustificationsection.

Circuitbreaking

Anthropic—Anthropichasdevelopedafeaturecalled“automode”forClaudeCode,whichletsa“monitor”reviewagents’actionsandblockthemiftheyareflaggedasdangerous.Thismode,whichissetasdefaultforinternaluseofClaudeCode[1],escalatestoahumanorstopstheagentfromrunningaftersomenumberofdenials[2].However,itisunclearhowuniversallyitisusedwithinAnthropic.Additionally,automodedoesnotreviewchain-of-thoughtreasoning.Wealsohavefoundno

2-10

evidenceofacircuitbreakerthatworksacrossthewholesystem:onewhereenoughdenialsblockeveryrisk-relevantmodelfromtakinggatedorclosely-trailedactions(ratherthanjustthesingleagentthattriggeredthem).Withoutthat,anagentcouldspinupanewsub-agenteachtimeoneishalted.

Keyevidence:

Anthropichasdevelopedafeaturecalled“automode”forClaudeCode,whichletsa“monitor”

reviewagents’actionsandblockthemiftheyareflaggedasdangerous.Thismode,whichissetasdefaultforinternaluseofClaudeCode[1],escalatestoahumanorstopstheagentfromrunning

aftersomenumberofdenials[2].However,itisunclearhowuniversallyitisusedwithinAnthropic.Additionally,automodedoesnotreviewchain-of-thoughtreasoning.Wealsohavefoundno

evidenceofacircuitbreakerthatworksacrossthewholesystem:onewhereenoughdenialsblockeveryrisk-relevantmodelfromtakinggatedorclosely-trailedactions(ratherthanjustthesingle

agentthattriggeredthem).Withoutthat,anagentcouldspinupanewsub-agenteachtimeoneishalted.

Outlinedinjustificationsection.

Google—Googleseemstohaveconsideredamechanismsimilartocircuitbreakingifitfindsevidenceofrepeatedmisalignedbehavior[1].However,wehavenotfoundstatementsthatsuchamechanismisinplace.

Keyevidence:

Googleseemstohaveconsideredamechanismsimilartocircuitbreakingifitfindsevidenceof

repeatedmisalignedbehavior[1].However,wehavenotfoundstatementsthatsuchamechanismisinplace.

Googleconsidersabenefitofmonitoringtobetheabilitytotakesomesortofactiononthebasisofrepeatedmisalignedbehavior[1].However,wewereunabletofindanyinformationaboutcircuit

breakingbeingpresentlyinplace.

Meta—WehavenotfoundpublicattestationofMetaimplementingcircuit-breaking,orplanningtoimplementit.

Keyevidence:

WehavenotfoundpublicattestationofMetaimplementingcircuit-breaking,orplanningtoimplementit.

N/A

OpenAI—OpenAIhasdevelopedafeaturecalled“auto-reviewmode”forCodex,itscodingagentharness,thatmonitorstheagent’sactivityandblocksunsafeactions.Italsostopstheagentafterrepeatedmonitordenials,andisusedinamajorityofCodexDesktopusage[1].However,itisnotuseduniversallywithinOpenAI.Additionally,auto-reviewmodedoesnotreviewchain-of-thoughtreasoning.

Keyevidence:

2-11

OpenAIhasdevelopedafeaturecalled“auto-reviewmode”forCodex,itscodingagentharness,thatmonitorstheagent’sactivityandblocksunsafeactions.Italsostopstheagentafterrepeatedmonitordenials,andisusedinamajorityofCodexDesktopusage[1].However,itisnotused

universallywithinOpenAI.Additionally,auto-reviewmodedoesnotreviewchain-of-thoughtreasoning.

Wehavefoundnoevidenceofacircuitbreakerthatworksacrossthewholesystem:onewhere

enoughdenialsblockeveryrisk-relevantmodelfromtakinggatedorclosely-trailedactions(ratherthanjustthesingleagentthattriggeredthem).Withoutthat,anagentc