Anthropic, OpenAI Sought Safety Report Control, Reuters Says

Anthropic and OpenAI sought significant control over what embedded AI safety evaluators could publish, despite publicly supporting editorial independence for outside reviews, according to a Reuters investigation.

Citing two people familiar with the private discussions, Reuters says both companies were concerned that evaluators working inside their labs could expose trade secrets. Proposed safeguards reportedly included lab employees observing evaluation teams and restrictions on evaluators working simultaneously at competing labs.

The companies’ responses draw different boundaries. Anthropic says evaluators it has previously worked with control their methods and publication decisions in current discussions, but it reserves report-approval rights for new evaluator firms. OpenAI says it is not seeking approval over entire reports, while maintaining a practice of redacting confidential information.

An evaluator can conduct technically rigorous tests yet still be unable to publish information needed to explain the findings. The central question is how labs can protect legitimate secrets without gaining control over the public account of their systems’ risks.

The Reported Negotiating Positions Were Still Changing

Reuters describes negotiations in progress, not a single settled agreement applying uniformly to both companies.

According to its two sources, Anthropic and OpenAI were seeking strict editorial control as recently as October 5. By October 8, discussions between Anthropic and some evaluators appeared to have evolved, one person familiar with the matter said.

The reported private positions should therefore not be presented as finalized terms. Nor should the companies’ subsequent statements be treated as a complete account of everything previously discussed. Reuters did not publish complete negotiating texts or final agreements.

The tension with public commitments is specific. Reuters reported that Anthropic CEO Dario Amodei had said in September that external evaluators should be able to publish key findings “without editorial control.” OpenAI subsequently endorsed “editorial independence” for assessors.

The proposals described by Reuters concern both publication and working conditions. Observing embedded teams and preventing simultaneous work at rival labs could help protect proprietary information. Their effect on an evaluation would depend on how broadly the restrictions were written and enforced.

Reuters also reported seeing an existing evaluation contract containing language that can prevent publication of confidential information without a lab’s consent. That establishes a concrete contractual mechanism for limiting disclosure, but does not establish that either company finalized every restriction described in the negotiations.

Anthropic Reserves Approval Rights for New Evaluators

Anthropic told Reuters that describing it as seeking significant publication control did not accurately characterize all its discussions and work with independent evaluators.

For organizations it has previously worked with, Anthropic said its current conversations make clear that reviewers control their methods, evaluation criteria, conclusions and decisions about publication. For new evaluator firms, however, the company said it reserves the right to comment on and approve reports while reviewers learn how its models operate and establish a working relationship.

A promise of independence for familiar evaluators does not provide the same assurance for a new organization whose report remains subject to approval. Anthropic ties that approval to establishing the relationship, but its response to Reuters does not specify a fixed duration or a public threshold for ending it.

OpenAI’s stated position is narrower: it says it is not seeking approval rights over the full text of evaluators’ reports. Its standard practice is to redact confidential information, while allowing evaluators to disclose whether major redactions occurred.

The two positions should not be collapsed into a claim that both companies currently demand identical approval powers. Anthropic explicitly reserves approval rights for new firms. OpenAI distinguishes confidentiality review from approval of an entire report.

Redactions can still affect how readers assess a report. A conclusion may remain untouched while the evidence needed to assess it disappears. Allowing an evaluator to flag major redactions provides useful transparency, though it cannot by itself tell readers whether the missing material changes how a finding should be interpreted.

Embedded Access Makes Confidentiality More Consequential

Embedded evaluation promises substantially more access than testing a released model through a public interface.

In its September 18 Accenture partnership announcement, Anthropic said embedded evaluators would work inside AI companies with access comparable to an employee’s. They could observe models during training, follow development and deployment decisions, and speak directly with staff.

The partnership, led by Faculty, Accenture’s specialist AI business, is intended to cover model evaluation, red-teaming, alignment assessments and safeguard testing. Anthropic said this access could help evaluators verify safety commitments, identify blind spots and report incidents.

With that access, reviewers may encounter proprietary development information alongside evidence relevant to safety. Reuters cited a separate person familiar with earlier dealings with labs who said those categories can overlap, producing disputes and redactions.

Technical context can also determine what a result means. Anthropic’s own guide to agent evaluations explains that evaluating an agent involves the model and its surrounding harness, including the system that manages tools and interactions. A transcript records intermediate steps and tool calls, while the final outcome records what actually happened in the environment.

Disclosing a result without enough information about the tested setup may leave outsiders unable to judge its scope. Public safety reporting does not require publishing every proprietary detail. It does require a defensible boundary between commercially sensitive implementation information and evidence necessary to understand a risk.

Anthropic also said it would directly fund Accenture’s work because pooled or government funding arrangements did not yet exist. It described the partnership as non-exclusive, with both organizations free to work with others.

Organizational non-exclusivity does not settle whether particular embedded personnel can work simultaneously at rival labs. Those are separate questions, and the Reuters report does not establish the final personnel restrictions.

An Earlier OpenAI Review Illustrates the Tradeoff

Reuters points to an earlier investigation by Model Evaluation and Threat Research, or METR, and Redwood Research into an incident involving OpenAI-powered agents and Hugging Face’s infrastructure.

An investigation initially planned as two days at OpenAI expanded to six days across three visits, according to Reuters. A more complete set of transcripts arrived only during the final visit, after researchers identified gaps in the data.

The evaluators said they changed the report’s structure, emphasis, clarity and tone following OpenAI’s feedback. OpenAI also redacted nonpublic information. METR and Redwood said nothing else important to their conclusions was removed, stood by their findings and praised the access OpenAI ultimately provided.

Those qualifications prevent the example from being used as straightforward evidence that OpenAI suppressed an unfavorable conclusion. It does show that independence involves more than retaining the final verdict: access to records, the timing of their delivery, feedback on presentation and decisions about disclosure can all shape the report readers receive.

The evaluators also said concern about discouraging developers from inviting outside investigators after serious incidents influenced their drafting, editing and redaction decisions. Reviewers may weigh immediate disclosure against preserving access for future investigations, a subtler constraint than a contractual veto.

Publication Rights Need a Boundary Labs Cannot Set Alone

The strongest unresolved issue is who decides when confidentiality and safety disclosure conflict.

Anthropic acknowledged in its September announcement that standards for embedded evaluators’ access and reporting were not yet established. Reuters’ account shows those boundaries being negotiated while the companies publicly promote independent scrutiny.

Rumman Chowdhury, CEO of Humane Intelligence, told Reuters that labs’ control over access gives them leverage over evaluators. Selecting an outside organization does not remove that dependency if the lab also controls the information it receives and the conditions under which it can publish.

A credible arrangement needs more detail than a general promise of independence. Readers should be able to understand who chooses the testing scope, what categories of information may be withheld, whether evaluators can publish disagreements, and how contested redactions are resolved. These are standards by which to assess the arrangements, not provisions Reuters has established are present in the negotiations.

Neither company’s response, as reported, fully explains who would adjudicate a disagreement over whether a crucial safety detail qualifies as a trade secret.

The evidence does not support declaring embedded evaluation a sham, nor does it establish that the reported proposals became final contracts. It supports a narrower concern: the public commitments leave substantial authority to be allocated in private negotiations.

For Anthropic, the immediate question is how new evaluators move beyond report-approval requirements. For OpenAI, it is whether confidentiality redactions can remove essential evidence and what recourse evaluators have when they disagree. Until those boundaries are clear, the label “independent” tells the public less than the underlying publication terms.