Watching the Agent Is Not the Same as Stopping It
A new independent nonprofit graded five frontier AI developers on whether they can actually control what their systems do, not just observe it. The best score was a C+. What I keep returning to is not the grade. It is the distinction the test is built around: an action you can see happening is not the same as an action you can still prevent.
Guidelight AI Standards, an independent nonprofit founded by former OpenAI safety staff Page Hedley and Steven Adler, published its Control standard on May 19, 2026 and its first assessment of frontier AI developers against that standard in August 2026. Guidelight defines control as technical and operational measures that constrain what an AI system can do regardless of whether it is aligned. Its assessment, based only on public material such as system cards, safety frameworks and company blog posts, scored Anthropic, OpenAI, Google, xAI and Meta on six practices, including logging internal AI activity, measuring how well that monitoring works, gating risky actions behind a check before they take effect, and being able to halt a system once misbehavior is detected. Anthropic and OpenAI led with an overall C plus, Google scored a D plus, xAI a D minus, and Meta an F. Guidelight reports that no company's score on any single practice exceeded a 3 out of 5, meaning none reached more than partial implementation of any practice it checked, and that only Anthropic scored above the lowest tier on gating and halting actions specifically. The standard's central distinction is between monitoring that happens after an action has already executed, which cannot undo it, and monitoring that evaluates a proposed action before it runs and can block it. Guidelight calls the second kind necessary for what it terms critical action boundaries, categories of action where an AI system can affect something outside a constrained environment, and it separately defines absolute action boundaries as actions that should never proceed without a human's explicit signoff, even when nothing looked wrong to the monitor. Guidelight also documents real limits in its own proposed design: an agent blocked once can retry immediately with a different action, and a monitoring system built to catch isolated misbehavior can be overwhelmed by many attempts arriving at once. Moona Intelligence's reading, distinct from Guidelight's own framing, is that the assessment's low scores are best understood not as a ranking of which company is safest, but as evidence of how early the industry still is at building the second kind of monitoring, the kind that can actually stop something, rather than the kind that can only describe it afterward.
Guidelight AI Standards published the first assessment of its kind in August 2026: a grading of five frontier AI developers, Anthropic, OpenAI, Google, xAI and Meta, against a standard the nonprofit calls Control. Anthropic and OpenAI led with a C plus. Google scored a D plus. xAI scored a D minus. Meta scored an F.
That is the number everyone will repeat. I want to spend most of this piece on a different one. Guidelight reports that no company's score on any of the six practices it checked went above a 3 on its 0 to 5 scale, meaning no developer reached more than partial implementation of any single practice, and most scores were lower than that. The letter grades measure an average. The more revealing number is that nobody cleared the bar on any individual item.
Reuters covered the same assessment independently on August 19, 2026, in a piece by Deepa Seetharaman headlined "AI firms can't yet contain what they've built, study finds." This piece draws its account of the assessment from Guidelight's own published materials rather than from that report.
The best grade was a C plus
Guidelight is a new independent nonprofit, founded by Page Hedley, previously a policy and ethics adviser at OpenAI, and Steven Adler, who worked at OpenAI from 2020 to 2024 leading teams including product safety and dangerous capability evaluations. Guidelight says it accepts no funding from AI companies or their staff. Its assessment states that it drew only on information the companies themselves have made public: system cards, safety frameworks, risk reports and blog posts, along with third parties' published descriptions of work they have done with these companies. That is a real constraint worth holding onto through the rest of this piece. A company that has built strong controls but not written about them would score the same as a company that has not built them at all.
Guidelight's own account of the results is not primarily about the ranking. Anthropic and OpenAI, it says, log substantial portions of their internal AI activity, scan that activity for signs of misbehavior, and have taken steps to measure how well that scanning actually works. Neither company fully implements any of the six practices Guidelight checked. Google lags behind both in what it has actually built, but Guidelight singles out Google's published AI Control Roadmap as the most detailed forward looking document on control that any company has released. Meta and xAI, in Guidelight's account, have the weakest practices in place and the fewest specific plans to close the gap.
What Guidelight actually tested
Guidelight's Control standard, version 1.0, was published on May 19, 2026, months before this assessment. It defines control as technical and operational measures that constrain what an AI system can do, regardless of whether the system is aligned. That is Guidelight's own framing, and it is worth keeping distinct from Moona's language: this is a proposed standard from one nonprofit, not an industry consensus and not a regulatory requirement.
The assessment checks companies against practices including logging what an AI system is doing internally so it can be reviewed, measuring how effective that monitoring actually is, gating certain risky actions behind a check before they take effect, and being able to halt a system, what Guidelight calls circuit breaking, once a pattern of flagged misbehavior accumulates. It also checks whether companies commission independent third party review of their controls, and whether they have a plan for what happens if control is actually breached.
On the practice closest to actually stopping an action, gating and circuit breaking, Guidelight found that only Anthropic scored above the lowest partial tier. Everyone else scored at or below what Guidelight calls limited partial implementation.
Watching is not blocking
This is the part of Guidelight's standard I think matters more than any single letter grade. Guidelight separates two kinds of monitoring by what they are structurally able to do.
Guidelight's standard requires semi synchronous monitoring, or something stronger, for what it calls critical action boundaries: categories of action where an AI system can affect something outside a constrained sandbox environment. An action inside that boundary has to be scanned and cleared by a monitor before it is allowed to take effect. An action outside it can be logged and reviewed later, which is useful for learning what happened, but does nothing to stop it from happening.
Guidelight is honest in its own standard about the limits of the stronger option. Blocking one flagged action does not stop an agent from immediately trying a different one, and a monitor built to catch an isolated bad attempt can be overwhelmed if many attempts arrive close together. Semi synchronous monitoring is not presented as a solved problem. It is presented as the minimum shape a control has to take before it can plausibly be called blocking rather than watching.
Some actions stay human regardless
Guidelight's standard goes a step further than critical action boundaries. It defines a separate category, absolute action boundaries, for actions an AI agent should never be permitted to take without a human's explicit signoff, even when a monitor has reviewed the request and found nothing wrong with it.
The distinction is precise and worth sitting with. A critical action boundary asks a monitor to check the action and decide. An absolute action boundary removes that decision from the monitor entirely for a defined set of actions, on the reasoning that some consequences are severe enough that a clean automated review is not sufficient grounds to let the action proceed unattended.
A control system can fail too
Guidelight does not treat its own recommended controls as infallible, and that is one of the more useful parts of the standard. It recommends that companies decide in advance which outages of their monitoring, failing to log activity, being unable to scan it, being unable to check an action against a critical boundary before it runs, are serious enough that internal inference itself should fail closed rather than continue operating unmonitored until the outage is fixed. It also recommends recurring independent third party review of whether these controls are actually adequate, and a defined notification process for what happens if control is breached: what triggers it, who is told, and on what timeline.
None of that is a claim that any of this is easy, or that Guidelight has solved it. It is a description of what a serious attempt at the problem has to plan for, including the possibility of its own failure.
This is a standard, not one company's architecture
Moona Intelligence has covered several instances of individual companies building specific controls at the point an agent is about to act. Google's Agent Development Kit reference architecture put a hard check outside the model rather than trust a system prompt. OpenAI's Daybreak expansion pushed Codex customers toward reviewing elevated actions before they run rather than trusting the model to refuse. Fortinet's acquisition of Virtue AI bought a product built around blocking a tool call before it fires. Those are all vendor and product level decisions, made by companies choosing how to build one system.
Guidelight's assessment is a different kind of thing. It is an outside, nonprofit standards body applying one consistent yardstick across five companies at once, at the level of the developer rather than any single product. It is also considerably broader in scope than any of Moona's own coverage. Guidelight's Control standard reaches into territory Moona does not cover at all: internal model monitoring, visibility into a model's reasoning, containment of the model itself, and third party audits of a frontier lab's own infrastructure. Nothing in this piece should be read as claiming otherwise.
What the grades do not prove
A few limits are worth stating plainly. Guidelight's assessment is built on public disclosures. A company that has real controls in place but has not written publicly about them would score the same as a company with no controls at all, so a low score is evidence about disclosed practice, not proof that nothing more exists behind it. A C plus, in the same direction, does not establish that a control actually works in every situation it might face, only that the company has published enough for Guidelight to credit partial implementation.
A letter grade is also not a probability. A D minus does not mean there is a known chance an AI system will act uncontrolled a given percentage of the time. It is Guidelight's summary of how far a company's disclosed practices sit from Guidelight's own proposed standard, nothing more precise than that. And Guidelight itself is not a regulator. Nothing in its standard is a legal requirement, and no company is obligated to meet it.
End at execution
Set the letter grades aside for a moment. The more useful question Guidelight's standard leaves behind is one you can ask of any AI agent deployment, including ones nowhere near frontier model scale: when this system's action shows up in a log, is that a record of something that was controlled, or is it a record of something that already happened and someone is now finding out about it.
Those are different situations, and a log by itself cannot tell you which one you are in.
Sources
This analysis interprets third-party reporting, research and announcements. Moona is not the original reporter of the underlying events.