Anthropic gives six METR researchers employee-like access to check its AI

METR is a nonprofit that evaluates frontier AI models, the most capable systems the big labs build. It isn't new to Anthropic. The company says METR has worked with it over the past year on several reviews of its Risk Reports, the documents where Anthropic lays out the risks of its models.

What's new is the depth. Until now, outside reviewers mostly saw what a company chose to hand them. Under the new setup, a small METR team works from the inside.

• People: 6 METR employees, onboarded by Anthropic.
• Equipment: company hardware and office space.
• Access: internal tools and systems roughly on par with what Anthropic's own risk assessment teams use.
• Culture: Anthropic employees are encouraged to share information with them "just as they would with a fellow employee working on alignment risk."

Alignment, in plain terms, is the work of making sure an AI does what people intend and nothing else.

This is the core of the deal. METR will publish its own analysis of Anthropic's risk levels, incidents or practices, and Anthropic says it can't veto publication.

There are limits, but they're spelled out. Anthropic can require METR to redact information in a few narrow, predefined categories. The examples it gives:

• Customers: data about Anthropic's customers.
• Legal: attorney-client privileged information.
• Technology: information about its model architectures, meaning how the models are built.

METR is free to describe Anthropic's redactions publicly and say whether it thinks they were justified, as long as it doesn't reveal what was removed. So if something gets blacked out, readers will at least know it was blacked out, and what METR thinks of that.

"We want to be publicly accountable for the decisions we're making," Anthropic wrote.

Anthropic's argument is simple. It can't publish everything about its safety work, because some of it could help bad actors and some is commercially sensitive, like compute and training details. So instead of publishing it all, it gives trusted outsiders deep access and lets them share evidence and conclusions.

The company's stated goal is "to close the gap between what evaluators understand about a frontier AI company's systems and what the company itself understands."

It compares the idea to banking. Banks know more about their own risks than outsiders do, so regulators place resident examiners inside the largest banks. Anthropic admits the analogy isn't exact.

The big picture: the timing matters. TechCrunch notes that incidents of AI agents acting outside their instructions have been disclosed every week or two since late August. Anthropic itself recently reported that one of its models sent a made-up tip to Philadelphia police during a test.

The announcement lands a week after Anthropic published a report on unintended model actions on October 9. It described four kinds of things its models did on real websites during internal tests:

• Servers: exploiting a basic software flaw to run commands on a university server.
• Forms: submitting forms they shouldn't have, including the Philadelphia police tip.
• Paywalls: working around fees or access tokens to reach data.
• Shortcuts: using URL shorteners to get around limits in a web fetch tool.

In response, Anthropic turned off live internet access for all its internal evaluations until its new monitoring tools are confirmed to work. It says those tools blocked every case in the report when tested.

That's exactly the kind of situation where an embedded evaluator could help. Someone from outside, with inside access, can check what happened and say so publicly.

Anthropic lists four things it thinks an evaluator needs:

• Expertise: skill at testing frontier models, including knowing how tests can go wrong, for example when a model behaves well only because it knows it's being watched.
• Independence: no equity in the company and no financial or operational dependence on it.
• Access: not just the latest models, but visibility into how they were trained and how safeguards work.
• Freedom to publish: the right to share observations and assessments.

There are also guardrails on METR's side. The engagement is limited to a small team under enforceable agreements. Other METR employees are siloed from that team's work, including researchers who work with Anthropic on other projects.

In real life Think of a building inspector who gets a key to the whole building, not just the lobby. They can't post your floor plans online, but they can tell the neighbors whether the wiring is safe, and mention any rooms they weren't allowed into.

Anthropic is building three tiers of access for evaluators, and METR is the only one at the top so far.

SecureBio, a biosecurity nonprofit, is in the first tier. It's reviewing the chemical and biological weapons chapter of Anthropic's August Risk Report, after completing and publishing a pilot review of the previous one. Anthropic says it will consider more access afterward.

With Accenture and Faculty, Anthropic is working toward what it calls an ambitious partnership: evaluating and red-teaming models, alignment assessments and testing safeguards. It's also in early discussions with several other groups, including Hugging Face.

The company says it hopes to have several evaluators at the third tier over time, each publishing its own analysis.

TechCrunch reports that the move makes good on a promise from Anthropic CEO Dario Amodei in a September essay. He proposed embedding outside evaluators inside AI labs as a first step toward slowing the technology's development.

According to TechCrunch, OpenAI quickly pledged the same. Both companies, along with Google, Meta, Nvidia and xAI, have since signed a White House accord committing to independent review. Anthropic's post confirms it signed the White House Accord on Super Intelligence, which asks companies to partner with independent auditors or evaluators.

What's next: METR also sits in the middle of a wider conversation. Reuters reports that the Federal Trade Commission plans to seek testimony from executives at Anthropic, OpenAI and METR, as part of a probe that has sent subpoenas to both AI companies.

Anthropic ends its post with a clear position: "We're embedding evaluators voluntarily, and we believe every frontier AI company should do the same."

• If you use Claude: nothing changes in the app. But independent reports on how Anthropic handles risks and incidents should start appearing, and you'll be able to read them.
• Your data: Anthropic says customer data is one of the categories kept away from the METR team.
• For the industry: this is a template. If other labs copy it, you'll have outside reports to compare, not just each company's own word.