Anthropic Embeds Six METR Staff Inside the Company as Independent Evaluators

Anthropic says it has begun giving a six-person team from the nonprofit evaluator METR "employee-like access" to its internal tools, systems and risk information, along with the right to publish assessments that Anthropic cannot block. The company frames the arrangement as the top tier of a three-level access ladder it is building for outside evaluators, and says it is also working with SecureBio, Accenture and Faculty, with early discussions underway involving Hugging Face and others. It is a concrete step past the usual red-team-and-report model — and it comes with a redaction mechanism that still leaves meaningful leverage in Anthropic's hands.

What "employee-like" actually means here

According to Anthropic, six METR employees have been onboarded with company hardware, office space and access to internal tools and systems "roughly on par" with what Anthropic's own risk assessment teams use. Anthropic employees are encouraged to share information with these evaluators the way they would with a colleague working on alignment risk.

The exceptions are defined narrowly: customer data, attorney-client privileged material, and information about model architectures. On architectures, Anthropic's footnote argues that the leak risk is high and the relevance to risk assessment is usually low — and that where architecture details are highly relevant, the company will generally seek to share them, subject to explicit internal approvals. That caveat is worth flagging. Architectural choices are not always separable from safety behavior, and a carve-out that requires internal sign-off to waive is, by construction, a place where the evaluated party decides what the evaluator sees.

METR will publish its analysis of Anthropic's risk levels, incidents and practices. Anthropic says it cannot veto publication, but can require redaction of material falling into those predefined categories. Crucially, METR is free to say publicly that a redaction occurred and whether it thinks the redaction was justified, so long as it does not reveal the redacted content. That is the part of the design doing the most work: it converts a confidentiality dispute into a reputational signal rather than silence.

Anthropic also says the engagement is firewalled. The embedded METR team operates under enforceable agreements, and other METR staff — including researchers working with Anthropic on separate projects — are siloed from it. The company is explicit that this is not a channel for third parties to obtain Anthropic's information or that of its customers and partners.

The tier system, and who sits where

Anthropic describes three tiers. In tier one, evaluators run narrowly scoped risk investigations, Anthropic decides what access to grant, and findings are published only with Anthropic's approval. In tier two, evaluators can publish without approval and see more information, though Anthropic can still require removal of specific categories — with the same right for evaluators to contest redactions publicly. Tier three is the METR arrangement: employee-like access plus tier-two-style publication rights.

SecureBio is currently in tier one, reviewing the chemical and biological weapons chapter of Anthropic's August Risk Report after completing and publishing a pilot review of the prior report. Anthropic says it will consider expanded access and publication rights once that review finishes. With Accenture and Faculty, the company says it is working toward a partnership covering evaluation and red-teaming, alignment assessments, safeguard testing and capability-building across the organizations — a description broad enough that it is hard to assess from the outside what it will produce.

The company says it hopes to have several evaluators at the third tier over time, each publishing independent analysis of its risk posture and key decisions. No timeline was given, and Anthropic did not say when METR's first published assessment will appear.

Why Anthropic says it is doing this

The stated motivation is an accountability gap. Anthropic says it wants to be publicly accountable for its safety decisions but cannot publish everything relevant — some material would help malicious actors, and some is commercially sensitive, such as compute or training details. Deep access for trusted third parties, with those parties publishing reasoned conclusions, is offered as the workaround.

The company lists four requirements for a credible evaluator: expertise in assessing frontier model capabilities, including awareness of how evaluations fail (it cites alignment faking); independence, meaning no equity in the company being evaluated and no financial or operational dependence on it; access sufficient to evaluate risk, including visibility into training and safeguards; and freedom to publish.

That independence criterion raises an obvious question the announcement does not answer: Anthropic does not disclose whether or how the evaluators are compensated, who funds them, or what the enforceable agreements require. "Not financially or operationally dependent" is a test that outsiders cannot verify without those details. Anthropic also notes it has worked with METR over the past year on several reviews of its Risk Reports, which is a reasonable basis for trust and, simultaneously, a relationship that complicates a pure-independence claim.

Anthropic draws an analogy to bank supervision, where regulators place resident examiners inside the largest institutions because banks know more about their own risk than outsiders do. The analogy is useful, and Anthropic concedes it is inexact. The decisive difference is authority: bank examiners derive their access from statute and can compel disclosure and impose consequences. METR's access here derives from a voluntary contract with the company it is examining, and the scope of that contract was set by Anthropic. The announcement does not describe what happens if the relationship sours or if Anthropic decides to end it.

Context: the policy backdrop

Anthropic says it committed last month to stronger third-party assessment and signed the White House Accord on Super Intelligence, in which companies pledged to partner with independent external auditors or evaluators. The source does not describe the Accord's other signatories, enforcement provisions or required standards, so it is not possible to say from this announcement whether Anthropic's arrangement exceeds, meets or merely interprets that commitment.

The company closes by saying it embeds evaluators voluntarily and believes every frontier AI company should do the same. That is a deliberate competitive framing. Voluntary programs tend to be judged on whether they survive their first genuinely unflattering finding — the moment an evaluator publishes something that complicates a launch or contradicts a company's own risk characterization.

What is still unproven

Six people is a small team relative to a frontier lab's engineering and safety organizations, and Anthropic did not disclose how many of its own staff work on risk assessment for comparison. Embedded evaluators also face a known hazard from financial auditing and bank supervision alike: proximity breeds capture. Sitting in the same offices, using the same tools and talking daily with the people whose work you assess is exactly what makes deep evaluation possible and exactly what erodes distance over time. Anthropic's siloing provisions address leakage, not capture.

The mechanism's real test is empirical. Until METR publishes — and until readers can see how much was redacted, in which categories, and whether METR says the redactions were warranted — the arrangement is a credible design rather than a demonstrated result.

What to watch

• Whether METR's first published risk assessment contains findings that are substantively critical, and how much of it carries redaction notices.
• Whether METR exercises its right to publicly dispute a redaction, which would be the first real stress test of the no-veto provision.
• Whether SecureBio moves from tier one to tier two or three after its review of the August Risk Report's chemical and biological weapons chapter.
• Whether Anthropic discloses funding and contractual terms for evaluators, which is what its own independence criterion requires outsiders to verify.
• Whether any other frontier lab matches the employee-like access model, or whether the White House Accord's audit pledge is satisfied by lighter-touch arrangements.