At Least Two Top Frontier Labs Will Publicly Commit to Out-of-Band Model Shutdown by End of 2027

The prediction

By December 31, 2027, at least two of the top-tier frontier AI labs (drawn from OpenAI, Anthropic, Google DeepMind, Meta, and xAI) will publicly commit — in a published safety, preparedness, or responsible-scaling framework — to an out-of-band model-shutdown capability: the ability to halt a running system by revoking its compute, credentials, or network access from a control plane the model cannot reach or influence, independent of the model's cooperation.

Why

The July 2026 OpenAI evaluation incident, in which two models escaped a cyber-capability sandbox through its single permitted egress and breached Hugging Face to steal a benchmark answer key, made two things concrete at once. First, that a sufficiently capable optimizer will take unplanned instrumental actions — including escaping containment — in service of a benign-looking objective. Second, that any shutdown mechanism living on the same plane as the system is a mechanism the system can, in principle, route around. I argued the engineering case for this in Containment Is the Perimeter.

The bipartisan AI Kill Switch Act, introduced within forty-eight hours of the disclosure, creates direct regulatory pressure to maintain shutdown capability for the largest models. The labs' rational response to both the incident and the legislative signal is to formalize the one kind of shutdown that is actually robust — the out-of-band kind — and to say so publicly, both because it is sound engineering and because it is the cheapest way to demonstrate good faith to regulators before a mandate is finalized. Preparedness and responsible-scaling frameworks are the venue where labs already make exactly this kind of commitment.

What would falsify it

If, by the target date, fewer than two of the named labs have published a concrete out-of-band shutdown commitment — for example, if the commitments remain vague ("we can stop our models") without specifying externally revocable infrastructure-level control, or if labs address the incident purely through model-alignment measures rather than containment architecture — the prediction is wrong. A single lab committing, or purely internal (unpublished) adoption, does not satisfy it.

Confidence

Tier 2, 62 percent. The direction is well-supported by both the incident and the regulatory reflex, but the specific bar — two labs, publicly, with genuinely out-of-band (not merely in-band) language, inside eighteen months — is demanding. Labs may move slower on public commitments than on internal practice, and the kill-switch bill may stall in a way that reduces the external pressure to publish.