Anthropic gives six METR evaluators employee-like access for AI safety reviews

Anthropic’s promise to let outsiders inspect its safety work now has a concrete form: six METR employees with access roughly matching its internal risk teams. In an October 15 update, the company said it had begun embedding the nonprofit’s evaluators. They can publish findings without Anthropic’s approval, though information access and disclosure still have limits.

Anthropic says outside scrutiny can help bridge a disclosure problem: some evidence relevant to safety could aid malicious actors or reveal commercially sensitive training and computing information. Rather than publish all of it, the company wants evaluators to inspect that evidence and give the public reasoned conclusions about the risks of its models.

Inside access, with defined exclusions

The six METR staff have company hardware, office space, and access to internal tools and systems roughly comparable to Anthropic’s risk-assessment teams, according to the company. Anthropic employees are encouraged to share information with them as they would with a colleague working on alignment risk—whether AI systems behave as intended.

That invitation excludes several categories, including customer data, attorney-client-privileged material and model architecture information. Anthropic argues that architecture details carry a high risk of accidental leaks and usually have low relevance to risk assessment. When those details are highly relevant, it says it will generally seek to share them, subject to explicit internal approval.

The arrangement is also confined to the embedded team, which operates under enforceable agreements and Anthropic’s security standards. Other METR employees are separated from that work, including researchers collaborating with Anthropic on other projects. Access does not extend across the nonprofit.

Publication without a company veto

METR will publish assessments of Anthropic’s risk levels, incidents or practices. Anthropic says it cannot veto publication, but can require redactions within narrow, predefined categories such as the exclusions above. METR can publicly describe those redactions and say whether it considers them justified, provided it does not reveal the protected information. That gives the evaluator a way to challenge withheld material publicly.

METR’s October 14 proposal explains what it hopes such assessments can deliver: public evidence about whether developers could lose control of AI systems used internally. Its proposed reports would draw on staff interviews and internal datasets and systems. The questions span unwanted agent behavior, whether monitoring can catch and stop it, and whether AI-assisted research could outpace safeguards.

This proposal will not provide confident assurance about whether development is safe, since the science is not mature enough to reach consensus conclusions, and there are no standards for safe development to audit compliance with.

METR, in its October 14 proposal for independent risk assessments

METR also says its general proposal neither requires true employee-level access nor fully protects assessors from retaliation over adverse findings. It excludes security audits and should not replace other transparency efforts or enforcement of safety standards. Its stated goal is to help company staff, boards, scientists and policymakers reach their own conclusions.

Three tiers, different freedoms

Anthropic’s wider evaluator framework makes clear that not every partner receives METR’s terms. It is developing three access tiers, with progression intended to depend on expertise, resources and protection of confidential information:

• First tier: narrowly scoped investigations, access chosen by Anthropic, and publication requiring company approval. SecureBio currently sits here.
• Second tier: more information and publication without company approval, subject to redactions that evaluators can publicly contest.
• Third tier: the employee-like access given to METR, with publication rights similar to the second tier. Anthropic hopes eventually to embed several evaluator teams at this level.

SecureBio is reviewing the chemical and biological weapons chapter of Anthropic’s August Risk Report after publishing a pilot review of an earlier report. Anthropic says it will consider projects with greater access and publication rights after that review. Work toward an Accenture and Faculty partnership covers model evaluation, adversarial testing, alignment assessments and safeguard testing.