Can AI companies contain their agents? Five frontier labs top out at C+ as researchers build three locks

The bottom line

The alarming part is not that an agent occasionally makes a mistake. It is that researchers reviewed five AI companies and found that the public evidence for controlling agents remains incomplete at best.

Reuters reported on August 20 that the non-profit organization Guidelight AI Standards evaluated six categories of control measures for Anthropic, OpenAI, Google, Meta and xAI based on public information. The highest result is only C+: Anthropic and OpenAI are tied for the best; Google gets D+, xAI gets D−, and Meta is directly F.

In the same week, the USC research team released a set of security tools that are very similar to "installing three locks on the Agent": checking permissions before going online, intercepting dangerous tool calls at runtime, and reconstructing what it did after an incident.

Put the two developments together and the picture is clear: major AI labs are still building fences, while university teams are already designing the equivalent of inspections, brakes and black boxes.

This is not "all AI is out of control", but it is not a minor problem either.

Start by separating the emotion from the facts in the title.

Guidelight is not a government regulator, nor does it run full red team testing within every company. It scores against its own Control criteria based only on publicly available system cards, security frameworks, risk reports, blogs and third-party disclosures, with information as of August 18.

But its results are still dazzling: among the six basic measures, no company has exceeded the "substantial partial implementation" level.

The six items evaluated are: log records, monitoring effectiveness, high-risk action approval, emergency circuit breaker, third-party review, and containment plan for out-of-control models.

Both Anthropic and OpenAI have an overall score of 2.50, corresponding to a C+. Google is 1.50, xAI is 0.83, and Meta is only 0.67.

This is not to say that Meta’s model is necessarily more dangerous than OpenAI’s, or that an alphabet can predict the next accident. It is more like a medical examination sheet of "how far is the company's public commitment and the evidence it has implemented?"

The weakest link: prevention and containment

Guidelight believes that what companies are relatively better at is detection and third-party evaluation: some companies log at least some internal AI activities and try to scan for abnormal behavior.

The weakest point is prevention and containment, which are two very simple things:

Does a person or system have to approve high-risk operations before the Agent takes action?

After discovering that it continues to do dangerous actions, can you press the pause button immediately?

This corresponds to a recent string of spine-chilling cases: Agents misread instructions to delete files, send resignation letters to users, and find loopholes outside the test environment. They don't necessarily all come from the same company, but they all illustrate a common problem - it is much easier to make the model "do things" than to make the model "only do things within the allowed range."

USC’s three locks are like a seat belt for an agent

Yue Zhao's team at USC Viterbi split the Agent life cycle into three stages.

First lock: pre-deployment TSA screening

The tool Agent-Audit examines code and configuration before an Agent is launched, looking for exposed passwords, insecure settings, and excessive permissions.

The team also conducted a FORTIS benchmark test to study the "over-authorization" tendency of 10 different models: some agents will proactively request access to tools, files, or databases that are far beyond what is needed for the task.

It's like an employee who just needs to open the conference room door but first wants the key to the entire building. It may not do evil right away, but the permission design has already planted accident conditions.

Second lock: a runtime firewall for tool calls

AEGIS will intercept the tool calls issued by the Agent, determine whether to allow execution based on the security policy, prevent dangerous actions if necessary, and leave tamper-proof records.

It solves the problem of "it seems fine when starting, but encounters new situations while running". Because once an agent can read web pages, emails, terminals, and enterprise systems, dangerous input may not appear until it is running.

Third lock: a post-incident black box

GRADE uses a graph structure to record the actions, dependencies and decisions in multi-Agent execution to help researchers locate which step, which Agent or which state caused the error.

The team also studied how to reconstruct execution traces when traditional logs are incomplete, and open-sourced the auditable tool, which allows people to play back the information the Agent saw and the decisions it made at that time.

This step sounds less exciting than "real-time interception", but it is the basis for accident investigation and undoing wrong actions. Without a black box, you can only get the most useless sentence in the end: the model did not know why it did what it did at the time.

Reversal: The most dangerous thing may not be "malicious hackers", but normal users

The USC page specifically mentions an easily overlooked risk: cross-user contamination of agents that share state.

Without an attacker deliberately injecting malicious instructions, the information left by one user can affect the results of another user. For enterprise agents, this is more difficult to troubleshoot than "someone hacked in" because every step of the system appears to be operating normally.

This is why simply adding a layer of "don't do bad things" prompts to the model is not enough. True security boundaries must fall into permissions, tools, state isolation, approvals, and traceability records.

So, are AI companies ready?

My judgment is: the industry has started taking remedial work seriously, but it is nowhere near ready to declare graduation.

OpenAI and Anthropic's temporary lead in public control measures does not mean that they will not have accidents; the low scores of Meta and xAI do not mean that the models will inevitably go out of control. The biggest limitation of public evaluation is that "failure to disclose" may mean that it has not been done, or it may mean that it has been done but not disclosed.

But for ordinary users and enterprises, the conclusion is practical enough: any Agent that can operate files, codes, emails, browsers or payment systems should not be treated as an ordinary chat window.

What you need to ask is not "is it smart?" but:

• What permissions does it have?
• Are there any approvals for high-risk actions?
• Can tool calls be intercepted in real time?
• Can it be reviewed and undone after making a mistake?

The next agent competition may not be about who resembles a clever colleague, but who can prove it deserves the keys.

What to watch

• Whether Guidelight subsequently obtains more internal evidence rather than relying solely on public disclosures.
• Whether each company has changed "logging, approval, and circuit breakers" from security blogs to default product mechanisms.
• Whether USC's Agent-Audit, AEGIS and auditable enter the real production environment.
• Which company can provide a complete and verifiable execution trace the next time an Agent incident occurs?