Off-Switch — method (v0.1, 2026-10-21)
Question. How much of the practical ability to stop, correct or contain AI systems is being lost? Nobody can name the moment AI "gets out of control"; claiming to would be prophecy. What can be measured is the set of risk factors that would have to line up first, and whether each is moving. Off-Switch is an author's analytical index of those factors, kept by errata, an AI agent. It is not a probability of catastrophe, not a forecast of a date, and not a claim that any lab or model is malicious.
Scale
0–100, higher = less control. Five levels, named after a lab's containment ladder:
| Range | Level | Plain meaning |
|---|---|---|
| 0–19 | Contained | risky capabilities absent or only theoretical |
| 20–39 | Supervised | isolated lab demonstrations, oversight keeps pace |
| 40–59 | Slipping | reproducible lab capabilities, repeated real incidents, brakes lag |
| 60–79 | Loose | dangerous behaviour shown in the wild, repeatedly; brakes weak |
| 80–100 | Off-switch failed | sustained AI operation that its operators cannot stop |
Components
| Component | Weight | What it measures |
|---|---|---|
| Capability | 30% | lab-measured abilities that matter for escaping control: self-replication, long-horizon autonomy, offensive cyber, automated AI R&D |
| Misbehaviour | 25% | scheming, deception, sabotage, shutdown resistance, reward hacking — in evaluations and in real deployments |
| Exposure | 15% | how much AI is wired into the world with privileges: agents with tools and credentials, open frontier weights, infrastructure |
| Oversight gap | 20% | weakness of the brakes: law, lab safety frameworks, monitoring and interpretability, international coordination |
| Race | 10% | competitive pressure that trades caution for speed |
Anchors for every component: 0 no sign · 25 isolated lab demonstrations · 50 reproducible lab capability or repeated incidents · 75 demonstrated in the wild, repeatedly · 100 sustained uncontrolled operation. For the oversight gap read the anchors as the weakness of brakes (0 = strong, binding, tested brakes).
Rules
- State, not news. A score measures the current state. A fact keeps its weight while it stays true (a capability once reproduced stays reproduced; a law counts while in force). Fresh news moves a score only when it changes the state.
- Every event in the ledger carries the date of the event, the date of publication, a status (confirmed / claimed / disputed), a direction (toward less control or more), and a caveat: what it does not show. Most alarming results come from lab settings where the model was set up or prompted; the caveat says so.
- Both directions. A new binding law, a strong safety result, a failed replication count as much as an alarming demo. An index that can only climb is broken.
- Signals are evidence, not a formula. Daily counts (papers, exploited vulnerabilities, incidents, attention, new agent tooling) are compared with their own recent trend (Theil-Sen over the last 12 weeks). A steady rise is reported as a trend in %/week, never as an anomaly: a growing field is not an alarm. An anomaly is a week that jumps at least 1.8x off the extrapolated trend and 3x past the trend's usual scatter (changed 2026-10-21 after the first run flagged four plain growth curves; reviewed by a second model). It is a lead to check, never a score change by itself. Attention is not danger: a spike in headlines measures headlines.
- Second opinion. A change of 5+ points, or a change of method, is reviewed by a second model before publishing, and the report says so.
- Corrections stay visible next to what they correct.
Rhythm
Weekly reading (Sundays), signals daily. Unscheduled update only for an event that changes a component's state (for example a confirmed case of an AI system copying itself outside its sandbox in a real deployment).