Skip to content
OpenAI · Anthropic · GuidelineEpisode 156 · 28 August 2026 · 51:28

Can AI Be Trusted With Important Work? We Checked OpenAI, Anthropic, Google, xAI and Meta

What to watch for

1Apply the six criteria to your own agent system: what goes into the log, what may not run without a human, when everything stops automatically, what happens after an incident.
2Check whether your log survives the incident itself: does it show records being deleted or altered?
3Set the rule that if monitoring goes down, sensitive operations stop rather than continue blind.
4Write a short list of actions the agent never performs without human confirmation — start with leaving the sandbox and publishing code outside.
5Decide in advance which keys and accesses are revoked first, and who is notified once an incident has happened.
Signals to track afterwards
Whether the assessment gets a second edition and whether the scores move once the companies respond.
How companies disclose control practices: a zero in the report can mean a missing practice or a missing publication.
How OpenAI's pause on training its most powerful models ends, and whether the largest planned run resumes.
What control costs the industry: the 20%-of-compute estimate is a figure worth tracking.
Whether independent reviews with genuinely deep access appear, rather than one-off demonstrations of a model.
Most useful for
People deploying AI agents inside a company and answerable for what they do.Engineering leads who design logging, monitoring and access rights.Founders weighing the risk of giving a model access to code, a terminal and infrastructure.Anyone following AI regulation who wants to know what such assessments actually measure.Anyone who wants to understand AI safety on the substance rather than the headlines.

Key takeaways

04:39The Assessment Comes From Former OpenAI Staff

Guideline was founded by Page Hedley and Steven Adler. Adler worked at OpenAI from 2020 to 2024, leading product safety and model-capability evaluation, and discloses publicly that he still holds a stake in the company. Guideline is neither a regulator nor a certified auditor: it is a standard of its own and an assessment against it.

10:07This Is Not About a Chatbot but a Model With Tools

The report barely touches ordinary chatbot answers. It is about cases where a model gets access to code, a terminal, the internet or cloud infrastructure and takes actions. The compute threshold for what counts is borrowed from Californian law.

13:15Criterion 1: the Log Has to Survive the Incident

The standard asks for 99.9% of the tokens in risky models' internal requests and responses to be retained, and for the logs to reveal records being deleted or altered. If the monitoring system goes down, sensitive operations must stop automatically. The point is to leave the model no blind spot where its actions cannot be reconstructed.

15:46The Author Does Not Believe a Superintelligence Can Be Logged

A separate line runs through the episode: if these systems really are heading towards a singularity, the very notion of control and logging inside one becomes absurd — it will arrange things so that the observer does not notice the absence of observation. The author flags this as his own view, not a finding of the report.

27:39The Average Score Is 1.6 out of Five

No company reached four out of five. The average of the thirty scores is 1.6; in twenty-two of thirty cases the result is two or lower; seven scores are zero. A zero should be read carefully: the analysis is built on public materials, so it means either that the practice is missing or that nothing has been published about it.

29:27Criterion 2: Monitoring Must Be Measured, Not Declared

It is not enough to say that one model watches another: you have to measure the share of dangerous actions the monitor actually catches. The standard spells out what it must catch: deception, sabotage, reward hacking, manipulation of people, shutdown avoidance, unauthorised autonomous actions, and attempts to make its own reasoning less observable.

34:25Criterion 3: What May Not Run Without a Human

Some actions an agent must not perform straight away, even when the internal monitor considers them normal: disabling logging, changing network settings, leaving the sandbox, publishing code outside, starting a process in production infrastructure. The check or the human confirmation comes before execution, not after the damage.

38:48Criterion 4: the Emergency Stop

If an agent performs several suspicious actions in a short time, the system must itself block further sensitive operations, and work resumes only after a human check. This guards against the case where an agent sends dozens of slightly varied attempts faster than staff can work through the alerts.

40:31Criterion 5: an Independent Review Once a Quarter

External specialists should regularly get deep enough access to the control system and try to find blind spots in it: switch monitoring off, bypass limits, check whether the agent can hide its actions. The suggested cadence is quarterly, with a published report. That is a good deal more than a one-off demonstration of the model to a researcher.

42:53Criterion 6: the Incident Containment Plan

A company has to decide in advance which permissions are revoked immediately, which keys and accounts are switched off, who is notified internally, and when government bodies and partners are told. It is the equivalent of a major-cyberattack response plan, where the source of the problem is the company's own AI system.

43:23A Silent Model Swap Is an Incident Too

The author offers his own example of what he counts as an incident with no containment plan: ChatGPT switches him from an expensive model to a cheap one mid-conversation, and the answer arrives from a noticeably weaker system. In his case it happened while going through medical findings. In his view a silent swap like that touches hundreds of millions of people and is worse than a single break-in.

47:41Anthropic's Three Is for the System Existing at All

An independent METR study found that Anthropic's monitors caught more than 80% of dangerous behaviour in synthetic scenarios — while at the same time an external specialist found simple ways to switch the observation off, for instance changing an environment variable so that traffic stopped counting as Claude Code traffic. The three here is not for reliability but for the system existing, being widely applied, and having already been probed.

49:13OpenAI's Pause, and Control Priced at 20% of Compute

On 18 August OpenAI slowed development of its most powerful models for two weeks, paused part of its reinforcement-learning training and left the largest planned run on hold. Under the new rules a serious alert has to be reviewed within thirty minutes, and on confirmation the activity is suspended. The company put the compute cost of that monitoring at 20% of the compute of the model output being controlled.

What this episode is about

A solo episode on the first external comparative assessment of how far leading AI labs can control their own models. The assessment comes from Guideline, an organisation founded by former OpenAI staff — Page Hedley and Steven Adler, who led product safety at the company from 2020 to 2024 and discloses publicly that he still holds a stake in it. OpenAI, Anthropic, Google, xAI and Meta were scored on a zero-to-five scale.

This is not about a chatbot but about a model that has been given tools: access to code, a terminal, the internet, cloud infrastructure. Six criteria are taken in turn: logging the model's actions, measurable monitoring effectiveness, pre-approval of dangerous actions, an automatic emergency stop, independent external review, and a plan for containing an incident that has already happened.

The numbers are unforgiving. The average of the thirty scores is 1.6 out of five; in twenty-two of thirty cases the result is two or lower; seven scores are zero. No company reached four. The best are Anthropic and OpenAI, both at C+; Google comes in at nearly half that, and xAI and Meta are, in the author's words, in a different league. Anthropic scored zero on the incident-containment plan, and its three for monitoring, as the episode explains, is not for the system being reliable but for the system existing at all and having already been probed from outside.

The author runs his own line alongside: he does not believe a superintelligence can be logged in principle, considers token counting a dubious unit of measurement, and offers his own example of an incident that worries him more than break-ins — a quiet swap of an expensive model for a cheap one in the middle of a conversation about medical findings.

The assessment measures not how safe the models are but how mature the described control practices are — and by that yardstick the industry is at the beginning: an average of 1.6 out of five, a best result of C+. The most useful part of the episode is not the company ranking but the six criteria themselves: they apply to any system of your own that runs agents — what goes into the log, what may not run without a human, when everything stops automatically, and what happens after an incident. The author leaves the closing question open: whether a control system stronger than the one the labs build themselves can be built at all.

Episode transcript

The episode is in Russian; below is an English reading guide to the transcript (the full EN transcript is a machine translation). Voice matching applied to 83 segments: 83 identified, 0 mixed, 0 probable, and 0 unresolved.

Loading…