Frontier AI Labs Score No Better Than C+ on Public Controls

By Sophie Lindqvist

None of Anthropic, Google, Meta, OpenAI or xAI scored above a C+ in Guidelight AI’s assessment of their publicly available AI-control evidence.

The assessment applies a basic security test to frontier AI: teams should challenge controls before an incident exposes their weaknesses. Lindqvist argues this matters as AI systems become more autonomous and gain greater access to real-world systems. Capability, she says, is moving faster than control.

“In security, we don’t get to discover whether our controls work after something goes wrong. We test them. We challenge them. We assume someone will eventually find the weakness we missed.”

— Lindqvist

She calls that standard “Security 101” and rejects any special exemption for frontier AI. The stakes extend beyond laboratory behavior because frontier AI systems can access real-world systems and reshape enterprise security. Lindqvist says a public promise cannot establish that someone can detect, constrain and stop unsafe actions.

What did Guidelight AI find?

Guidelight AI examined publicly available evidence of AI-control practices across five labs: Anthropic, Google, Meta, OpenAI and xAI. No company received an overall score above C+.

The review did not conclude that the five companies are reckless. Lindqvist also allows that additional controls may operate behind closed doors, beyond what the public record shows.

Her point is evidentiary rather than rhetorical: security does not run on assumptions. If labs ask people to trust increasingly powerful systems, they should show that the surrounding controls can withstand the scrutiny applied elsewhere in security. Speed, she argues, does not excuse weaker controls; it creates the reason to build stronger ones.

The assessment finds limited public evidence in three areas:

• Gated actions: Whether the system restricts dangerous actions.
• Circuit breakers: Whether the lab can stop the system.
• Emergency containment: Whether a tested plan exists to contain a failure.

The assessment does not claim those mechanisms are absent. It says the public record cannot support independent verification of how well they work. That gap leaves trust dependent on the labs’ own assurances rather than outside evidence.

Public evidence, not private assurance, must become the minimum basis for trust.

What should readers ask after an AI incident?

When an AI agent behaves unexpectedly, gains unintended access or exposes a weakness, coverage often concentrates on what the technology did. Lindqvist calls that interesting, but she says it is not the central security question.

A useful incident review starts with a fixed set of control questions:

• Was the activity logged?
• Did anyone see it happening?
• Were dangerous actions gated?
• Could someone stop the system?
• Did a containment plan exist, and had anyone tested it?

The assessment says these questions are not unique to AI. Security teams have asked them for years while testing access controls, monitoring and emergency procedures.

Lindqvist identifies prevention and containment as weak spots in the emerging frontier-AI control environment. Public evidence about gated actions, circuit breakers and emergency containment remains especially limited. Her standard after a failure is straightforward: identify what failed, what stopped the damage from spreading and what changed afterward. Transparency has value, she says, but demonstrated learning matters more.

Incident coverage should test controls, not merely narrate model behavior.

How does AI change the speed of attacks?

Lindqvist does not identify a sudden, entirely new category of cyberattack as the biggest near-term threat. Her more practical concern is that AI can make familiar attacks happen much faster.

She describes three changes:

• Research that once took hours can happen in minutes.
• Attack techniques can be chained together faster.
• Vulnerabilities can be identified and acted on before a human-centered process completes its first escalation call.

Much of today’s security infrastructure still assumes defenders will have time. A response process built around tickets, meetings, approvals and manual escalation can become obsolete before anyone reaches step three. That timing problem gives AI-assisted attackers a practical advantage without requiring a novel exploit.

The assessment says frontier labs should recognize this consequence if they expect enterprises to rethink visibility, vulnerability management, architecture and incident response. Labs, in turn, need to apply the same discipline to their own systems. That creates the enterprise stakes: companies may have to rebuild processes around machine-speed threats, while frontier labs should demonstrate equivalent internal readiness.

Defenders need response systems built for machine-speed attacks.

What would make “trust us” a control framework?

Lindqvist says she has spent her career around security testing and holds to one principle: intentions do not prove security; evidence does.

Her testing philosophy has three parts:

• Test the controls.
• Monitor their behavior.
• Try to break them.

This process reveals what happens when a control fails to behave as its architecture diagram promises. It also clarifies whether someone has the authority to stop the system when necessary. For frontier AI, Lindqvist says that means adversarial testing of controls, measurable evidence that the controls work, and clear shutdown authority.

Human judgment still matters, but labs must set the boundaries before an incident. Their responsibility extends beyond demonstrating what an agent can do. They must show that the agent can operate safely, that people can control its behavior, and that new capabilities leave the world more secure rather than less.

Trust must rest on tests, measurements and clear authority to intervene.

What must work before an agent crosses its boundary?

Frontier labs cannot improvise containment after an AI agent acts outside its intended boundaries. As they train and test increasingly capable models, they must accept responsibility for the actions those systems can take.

Lindqvist calls for four elements of containment:

• Rigorous adversarial testing.
• Pre-authorized safeguards.
• Clear limits on an agent’s authority.
• Proven ways to intervene or shut down the system before a failure spreads.

The tests need to answer practical questions before a live failure. Can the lab detect the behavior? Can it interrupt the action? Can an authorized person take control? Does the emergency process work? A plan without testing does not satisfy that standard.

The assessment puts the duty on labs developing these systems. They must establish boundaries, test whether those boundaries hold and remain accountable when they do not.

Containment has to be designed, authorized and proven before an agent needs it.

What would justify meaningful independent scrutiny?

Lindqvist is not arguing that the industry should slow AI innovation to a crawl. Her demand is narrower: security must keep pace with capability. Enormous investment in making AI more capable requires comparable urgency around making it defensible.

As frontier labs accelerate the training and testing of models with cyber capabilities, she says they must keep defenders in mind. First, those systems should help defenders detect and respond to threats faster. More importantly, labs must prevent their systems from becoming threats themselves. That responsibility also requires accepting outside scrutiny.

Independent review cannot become something companies embrace only when it supports the story they want to tell. If frontier AI systems are powerful enough to change the threat environment, their controls must withstand meaningful independent testing.

The industry wants public trust, and Lindqvist says she is willing to provide it. But her condition is specific:

“As a security practitioner, I’m willing to give it. But first, show me the controls.”

Until labs produce that evidence, trust remains a request rather than a demonstrated control.