Anthropic Puts Six METR Researchers Inside the Company With Employee-Level Access and No Veto Over Publication

Since late August, incidents of AI agents acting outside their instructions have been disclosed every week or two, and the FTC's subpoenas to OpenAI and Anthropic over those incidents were reported earlier today. Now Anthropic has announced a different kind of outside scrutiny: a team of independent evaluators working inside its own walls.

In a blog post today, Oct. 15, Anthropic said it has onboarded six researchers from METR, a nonprofit that tests frontier AI models. They have Anthropic-issued laptops, office space and access to internal tools that Anthropic describes as roughly on par with what its own risk assessment teams use.

What METR gets

Anthropic said employees are encouraged to share information with the METR team "just as they would with a fellow employee working on alignment risk," outside a few defined categories.

METR will publish its own assessments of Anthropic's risks, incidents and practices. Anthropic said it cannot veto publication.

METR is not entirely free of editing, though. Anthropic can require redactions, but only for narrow, pre-defined categories: customer data, attorney-client-privileged material and information about its model architectures. METR may characterize the redactions publicly and say whether it thinks they were justified, as long as it does not reveal what was removed.

Anthropic said it has worked with METR over the past year on several reviews of its Risk Reports. The embedded team operates under enforceable agreements. Other METR staff, including researchers who work with Anthropic on other projects, are siloed from its work.

The architecture carve-out

A footnote in the announcement explains why model architecture is off the default list. Evaluators, like bank examiners, may also work with other companies. Anthropic said architecture information carries a high risk of inadvertent leaks and is typically of low relevance to risk assessment.

When architecture information is highly relevant, Anthropic said it will generally try to share it, but doing so requires explicit internal approvals. That means the company, not METR, decides when the relevance threshold is met.

Anthropic also acknowledged limits to its own analogy. It compared the setup to bank regulators placing resident examiners inside the largest banks, then noted the comparison "isn't exact." One difference is that bank examiners have legal authority. METR does not.

Three tiers of evaluators

METR is the only evaluator so far at the top of a three-tier system Anthropic is building. Bottom-tier evaluators, such as the biosecurity nonprofit SecureBio, run narrow reviews and need Anthropic's approval to publish. The middle tier gets more information and can publish without approval. The top tier adds employee-level access.

Anthropic also named Accenture and Faculty as other evaluators, and said it is in early talks with Hugging Face.

The company listed four things it says an evaluator needs: expertise, independence, enough access to see training and safeguards, and freedom to publish. On independence it specified no equity in the company and no financial or operational dependence.

Voluntary, and tied to earlier pledges

No law requires any of this. Anthropic calls the arrangement voluntary and says every frontier AI company should do the same.

The announcement follows an essay by CEO Dario Amodei in September proposing that outside evaluators be embedded inside AI labs. OpenAI quickly pledged the same. Anthropic, OpenAI, Google, Meta, Nvidia and xAI have also signed the White House Accord on Super Intelligence, which commits them to independent external review.

METR itself published an embedded assessments framework a day earlier, on Oct. 14. Anthropic's arrangement is the first concrete version of it.

Anthropic's stated reason for opening up is that it cannot publish everything relevant to safety. Some information could help malicious actors, and some, such as compute or training details, is commercially sensitive. Its answer is to give evaluators deep access and have them share evidence and reasoned conclusions. The stated aim is to "close the gap between what evaluators understand about a frontier AI company's systems and what the company itself understands."

What comes next

The arrangement is a private agreement between a company and a nonprofit, not a government mandate. Its value depends on what METR publishes and how it describes any redactions. No date has been given for METR's first assessment.

The redaction categories were defined by Anthropic. Whether METR finds them used sparingly or broadly will be visible only if the group chooses to say so in public, which the terms allow.