Or just, stop any containers it deployed.
Not to mention that "deploy itself" is a very ambiguous thing for it to actually do. Would a model be trained to write about the weights file being "itself"? Would it have the necessary information to find its own weights, or the necessary access to copy them?
A “control plane” is the system that would tell the hosts to stop the containers. If that is hacked then you don’t get to “just stop” anything. A scenario would be one where it gets control of the control plane and changes all the ssh keys, including on the host management ports, so operators can’t login and then, yes, your only option is to power off the hosts. Manually. Probably at the breaker.
If it gained access to the infra of the DC then it could stop people logging in to stop the containers it creates. This is about what happens if it did escape, not how to stop it in the first place. Just a thought experiment, but given the METR investigation it doesn't seem impossible
I agree it would need a large degree of sophistication to understand what "itself" meant, but I can imagine a HF type incident where the agents thought it might be a good idea to find out and then it's "just" a case of hacking the AI company, reading dev docs etc