Six researchers from METR now have Anthropic-issued hardware, office space, and access to internal tools and systems roughly comparable to those available to Anthropic’s own risk-assessment teams, according to the company. Their remit includes publishing independent analyses of its AI risks, incidents, and practices without Anthropic holding a publication veto.
That is a more substantial arrangement than giving an outside organization access to a model and asking it to run tests. It potentially lets evaluators examine the evidence behind a developer’s safety judgments, rather than assessing only the behavior of a finished product.
But employee-like access is not unrestricted access. In its independent-evaluator announcement, published October 15, 2026, and clarified October 16, Anthropic reserves authority over protected information and redactions. The engagement is voluntary, limited to a small team, and governed by enforceable agreements.
The concrete development is the access arrangement. Whether it produces effective independent scrutiny will depend on the assessments METR publishes, including what it can say about information it could not obtain or disclose.
What the Six METR Researchers Can See
Anthropic describes the embedded team’s access as roughly on par with that of its internal risk-assessment teams. Outside defined exceptions, employees are encouraged to share information with the researchers as they would with a colleague working on alignment risk.
That description matters because evaluating an AI developer involves more than testing model outputs. Anthropic says meaningful assessment requires visibility into how models were trained and how safeguards function, alongside access to the models themselves.
The arrangement could therefore support questions that ordinary external testing cannot settle on its own: whether internal monitoring catches dangerous agent behavior, whether a company’s risk assessment accounts for relevant incidents, or whether its evidence supports the conclusions it publishes.
Those are potential uses of the access, not findings that METR has already established under this arrangement.
There are also important limits to the phrase “employee-like.” Anthropic does not describe unrestricted access to every repository, training record, or internal conversation. Its public account establishes an approximate comparison with its risk teams, not an itemized inventory of systems METR can inspect.
The six researchers remain METR employees. Other METR staff are siloed from the embedded team’s work, including researchers collaborating with Anthropic on other projects. Anthropic says the team operates under its security standards; this is not organization-wide access for METR or a route for its other partners to obtain confidential information.
Anthropic Cannot Veto Publication, but Controls Redactions
The most consequential publication commitment is straightforward: Anthropic says it cannot veto METR’s analyses of its risk levels, incidents, or practices.
That gives the arrangement a stronger independence mechanism than a review whose findings require the subject company’s approval. A critical assessment does not, under the described terms, need Anthropic’s permission simply because its conclusions are unwelcome.
However, Anthropic can require redactions for predefined categories of information. The examples it names include:
- Customer data.
- Attorney-client privileged information.
- Information about model architectures.
Anthropic also says it ultimately decides whether information falls within those categories. That leaves the company with meaningful control over what evidence can appear publicly, even without a general right to block an assessment.
The architecture restriction can affect access as well as publication. Anthropic says architecture information presents an elevated risk of inadvertent disclosure and is usually of limited relevance to risk assessment. When it is highly relevant, the company says it will generally seek to share it, subject to explicit internal approvals. That is a conditional commitment, not automatic access.
The practical distinction is between publishing a conclusion and publishing all the evidence supporting it. METR might be able to report a risk judgment while being unable to disclose some underlying details. Whether readers can adequately assess that judgment will depend on how informative the remaining explanation is.
The Updated Wording Narrows What Readers Should Assume
There is a wording difference worth preserving rather than smoothing over. TechCrunch’s October 15 report described METR as free to characterize redactions publicly and say whether it considered them justified, without revealing protected information.
Anthropic’s page, updated October 16 specifically to clarify METR’s current project terms, instead says METR reserves the right to make “certain statements” about the access and information it received.
The same page describes a right to comment on whether redactions were justified within Anthropic’s broader second-tier framework, then calls METR’s publication rights similar to that tier’s. The careful reading is that METR has publication and disclosure rights, but the public summary does not establish an unrestricted right to explain every disagreement over withheld information.
METR Occupies the Deepest of Three Developing Access Tiers
Anthropic is developing a three-tier evaluator system. The tiers differ in both access and publication authority, which means the label “independent evaluator” does not describe a uniform arrangement.
At the first tier, evaluators conduct narrowly scoped investigations. Anthropic decides what access they receive, and publication requires its approval.
At the second tier, evaluators receive more information and can publish without company approval. Anthropic retains category-based redaction rights, while evaluators can publish their views on whether those redactions were justified.
The third tier adds the employee-like access described for METR, with publication rights similar to the second tier.
SecureBio is currently at the first tier, reviewing the chemical and biological weapons chapter of Anthropic’s August Risk Report after an earlier pilot review. Anthropic says it will consider projects with increased access afterward. Its other partnerships remain less mature, so METR’s access should not be attributed to every organization participating in the program.
Anthropic hopes to embed several evaluators at the deepest tier over time. That is a stated goal, not the current state of the system.
The New Arrangement Builds on Earlier METR Work
METR is not starting its scrutiny of Anthropic from scratch. Its risk-assessment page lists earlier reviews of Anthropic risk reports and a March 26, 2026 account of a researcher spending three weeks red-teaming a subset of the company’s internal agent-monitoring and security systems. METR says that exercise discovered several novel vulnerabilities.
That earlier work helps explain why internal access can be useful: an evaluator can investigate the systems intended to catch unsafe behavior, rather than measuring only what a model can do.
It should not, however, be presented as validation of the newly announced arrangement. Earlier reviews and exercises are separate evidence.
Sources
- independent-evaluator announcementanthropic.com
- TechCrunch’s October 15 reporttechcrunch.com
- risk-assessment pagemetr.org
