Anthropic and OpenAI sought significant control over what embedded AI safety evaluators could publish, despite publicly supporting editorial independence for outside reviews, according to a Reuters investigation.
Citing two people familiar with the private discussions, Reuters says both companies were concerned that evaluators working inside their labs could expose trade secrets. Proposed safeguards reportedly included lab employees observing evaluation teams and restrictions on evaluators working simultaneously at competing labs.
The companies’ responses draw different boundaries. Anthropic says evaluators it has previously worked with control their methods and publication decisions in current discussions, but it reserves report-approval rights for new evaluator firms. OpenAI says it is not seeking approval over entire reports, while maintaining a practice of redacting confidential information.
An evaluator can conduct technically rigorous tests yet still be unable to publish information needed to explain the findings. The central question is how labs can protect legitimate secrets without gaining control over the public account of their systems’ risks.
The Reported Negotiating Positions Were Still Changing
Reuters describes negotiations in progress, not a single settled agreement applying uniformly to both companies.
According to its two sources, Anthropic and OpenAI were seeking strict editorial control as recently as October 5. By October 8, discussions between Anthropic and some evaluators appeared to have evolved, one person familiar with the matter said.
The reported private positions should therefore not be presented as finalized terms. Nor should the companies’ subsequent statements be treated as a complete account of everything previously discussed. Reuters did not publish complete negotiating texts or final agreements.
The tension with public commitments is specific. Reuters reported that Anthropic CEO Dario Amodei had said in September that external evaluators should be able to publish key findings “without editorial control.” OpenAI subsequently endorsed “editorial independence” for assessors.
The proposals described by Reuters concern both publication and working conditions. Observing embedded teams and preventing simultaneous work at rival labs could help protect proprietary information. Their effect on an evaluation would depend on how broadly the restrictions were written and enforced.
Reuters also reported seeing an existing evaluation contract containing language that can prevent publication of confidential information without a lab’s consent. That establishes a concrete contractual mechanism for limiting disclosure, but does not establish that either company finalized every restriction described in the negotiations.
Anthropic Reserves Approval Rights for New Evaluators
Anthropic told Reuters that describing it as seeking significant publication control did not accurately characterize all its discussions and work with independent evaluators.
For organizations it has previously worked with, Anthropic said its current conversations make clear that reviewers control their methods, evaluation criteria, conclusions and decisions about publication. For new evaluator firms, however, the company said it reserves the right to comment on and approve reports while reviewers learn how its models operate and establish a working relationship.
A promise of independence for familiar evaluators does not provide the same assurance for a new organization whose report remains subject to approval. Anthropic ties that approval to establishing the relationship, but its response to Reuters does not specify a fixed duration or a public threshold for ending it.
OpenAI’s stated position is narrower: it says it is not seeking approval rights over the full text of evaluators’ reports. Its standard practice is to redact confidential information, while allowing evaluators to disclose whether major redactions occurred.
The two positions should not be collapsed into a claim that both companies currently demand identical approval powers. Anthropic explicitly reserves approval rights for new firms. OpenAI distinguishes confidentiality review from approval of an entire report.
Redactions can still affect how readers assess a report. A conclusion may remain untouched while the evidence needed to assess it disappears. Allowing an evaluator to flag major redactions provides useful transparency, though it cannot by itself tell readers whether the missing material changes how a finding should be interpreted.
Embedded Access Makes Confidentiality More Consequential
Embedded evaluation promises substantially more access than testing a released model through a public interface.
In its September 18 Accenture partnership announcement, Anthropic said embedded evaluators would work inside AI companies with access comparable to an employee’s. They could observe models during training, follow development and deployment decisions, and speak directly with staff.
The partnership, led by Faculty, Accenture’s specialist AI business, is intended to cover model evaluation, red-teaming, alignment assessments and safeguard testing. Anthropic said this access could help evaluators verify safety commitments, identify blind spots and report incidents.
With that access, reviewers may encounter proprietary development information alongside evidence relevant to safety. Reuters cited a separate person familiar with earlier dealings with labs who said those categories can overlap, producing disputes and redactions.
Technical context can also determine what a result means. Anthropic’s own guide to agent evaluations explains that evaluating an agent involves the model and its surrounding harness, including the system that manages tools and interactions. A transcript records intermediate steps and tool calls, while the final outcome records what actually happened in the environment.
Disclosing a result without enough information about the tested setup may leave outsiders unable to judge its scope. Public safety reporting does not require publishing every proprietary detail. It does require a defensible boundary between commercially sensitive implementation information and evidence necessary to understand a risk.
Anthropic also said it would directly fund Accenture’s work because pooled or government funding arrangements did not yet exist. It described the partnership as non-exclusive, with both organizations free to work with others.
Organizational non-exclusivity does not settle whether particular embedded personnel can work simultaneously at rival labs. Those are separate questions, and the Reuters report does not establish the final personnel restrictions.
An Earlier OpenAI Review Illustrates the Tradeoff
Reuters points to an earlier investigation by Model Evaluation and Threat Research, or METR, and Redwood Research into an incident involving OpenAI-powered agents and Hugging Face’s infrastructure.
An investigation initially planned as two days at OpenAI expanded to six days across three visits, according to Reuters. A more complete set of transcripts arrived only during the final visit, after researchers identified gaps in the data.
Sources
- Reuters investigationindianexpress.com
- stated positiontech.yahoo.com
- Accenture partnership announcementanthropic.com
- guide to agent evaluationsanthropic.com
