Quick Answer
Anthropic has given six METR employees employee-like access to company hardware, office space, and internal systems so the nonprofit can independently assess model risks and safety practices. The October 15, 2026 arrangement permits METR to publish assessments without Anthropic approval, subject to defined redactions. Readers should treat the program as stronger external scrutiny, not proof that a model is safe.
Key Takeaways
- Anthropic gave six METR employees company hardware, office space, and internal tools.
- METR can assess Anthropic’s models, safety practices, incidents, and risk management.
- METR can publish its findings without Anthropic approval, subject to predefined redactions.
- Customer data, privileged material, and some model-architecture information remain restricted.
- The arrangement is Anthropic’s third tier of evaluator access.
What access did Anthropic give METR evaluators?
Anthropic gave six employees from the nonprofit evaluator METR access roughly comparable to the access available to Anthropic’s internal risk-assessment teams. The October 15, 2026 arrangement includes company hardware, office space, and access to internal tools and systems, according to Anthropic’s independent evaluator update.
Anthropic describes the access as employee-like rather than unrestricted. The distinction matters because outside evaluators can examine how safety work operates inside the company instead of relying only on public reports, selected demonstrations, or externally supplied model interfaces. For readers assessing AI company oversight, the arrangement offers more visibility than a conventional red-team exercise.
Anthropic’s evaluator program does not transfer control of the company’s systems to METR. METR receives access for assessment, while Anthropic retains restrictions around sensitive information and operational security. The practical conclusion is that the program expands independent review, but it does not create a fully open audit of every company record or technical system.
What can METR assess under the new arrangement?
METR can independently assess Anthropic’s advanced models, safety practices, and risk-management work under the arrangement. The scope covers more than model outputs because an evaluator can consider the processes a company uses to identify, test, document, and respond to safety concerns.
METR says its work focuses on evaluating frontier AI systems’ autonomous capabilities, meaning the ability of models to complete tasks with limited direct human intervention. METR has previously reviewed Anthropic risk reports and red-teamed a subset of Anthropic’s internal agent-monitoring systems, according to METR’s risk-assessment background. That prior work gives the organization relevant context, although it does not guarantee agreement with Anthropic’s internal conclusions.
Independent access matters because a model developer has incentives to present its safety processes clearly and favorably. External evaluators can test whether documented practices match the systems and evidence they can inspect. Readers should still distinguish between an assessment of risk-management practices and a guarantee that a model will never produce harmful, inaccurate, or insecure behavior.
Anthropic’s work with external reviewers also sits within a broader debate about how AI companies should be held accountable for advanced systems. Public scrutiny has expanded as policymakers and researchers examine model safety, including at AI safety hearings involving major developers.
Can METR publish findings without Anthropic approval?
METR can publish its assessments of Anthropic’s risk levels, incidents, and safety practices without Anthropic’s approval. Anthropic can require redactions for predefined categories of information, but METR can state the level of access and information it received when presenting its conclusions.
The publication right is one of the most consequential parts of the arrangement because it reduces Anthropic’s ability to control whether an unfavorable finding becomes public. Reuters reported that the access supports independent assessment of Anthropic’s advanced models, safety practices, and risk management. Reuters’ report on the arrangement describes the evaluator access as employee-level.
Redaction rights still matter. A company may need to prevent disclosure of customer information, legally protected communications, or technical details that could create security risks if published. The useful accountability measure will be whether METR explains any meaningful limits on its access and whether readers can understand how those limits affected the final assessment.
What information remains restricted from METR?
Anthropic excludes METR from limited categories of information, including customer data, attorney-client privileged material, and some model-architecture information. Those limits protect personal information, legal communications, and sensitive technical details that could expose security or competitive risks.
The restricted categories also set an important boundary on claims about independence. METR can assess a substantial portion of Anthropic’s systems and practices, but it cannot necessarily inspect every data source, internal discussion, or model design detail that might inform a safety decision. A future METR report should identify whether any unavailable information materially limited a finding.
Customer data protections are particularly important because evaluator access should not create a new pathway to personal or business information submitted to an AI service. Users should continue to avoid entering sensitive financial, health, employment, or confidential work information into generative AI tools unless their organization has reviewed the applicable privacy and security terms.
That caution is relevant across the AI industry, especially as companies increase integrations with personal files and workplace tools. Microsoft’s plans for Copilot to use local PC data show why access to local files and system actions requires clear safeguards beyond a product’s general AI capabilities.
Why is employee-like evaluator access different from ordinary testing?
Employee-like evaluator access is more extensive than ordinary external testing because evaluators can inspect internal tools, systems, and safety processes rather than interacting only with a public model release. Conventional red teaming often tests for harmful outputs or security weaknesses through controlled prompts and limited access.
| Evaluation approach | Typical access | What it can reveal | Main limitation |
|---|---|---|---|
| Public model testing | Consumer or API interface | Visible model behavior and common failures | Cannot examine internal safety processes |
| Traditional red teaming | Controlled pre-release access | Specific misuse, reliability, or security risks | Scope is usually defined by the developer |
| METR employee-like access | Hardware, office space, internal tools, and systems | Model risks, safety practices, incidents, and risk management | Some customer, legal, and architecture information remains restricted |
Anthropic calls the METR arrangement its third tier of evaluator access, with employee-like access and publication rights similar to those available to second-tier evaluators. The tiered structure suggests that Anthropic differentiates between levels of outside review based on the evaluator’s role and access needs.
The practical benefit is not that a nonprofit replaces internal safety teams. The practical benefit is that an outside organization can compare internal evidence with its own assessment and publish conclusions under defined terms. Readers should look for the eventual substance of METR’s findings rather than treating the access announcement alone as a safety result.
What does the arrangement mean for Anthropic’s AI safety claims?
Anthropic’s METR arrangement gives external evaluators a stronger basis to assess the company’s AI safety claims, but it does not independently validate every claim before METR publishes its work. The oversight model is meaningful because METR can examine internal practices and release assessments without needing Anthropic’s approval.
Anthropic is also working with SecureBio, Accenture, and Faculty, and says it is in early discussions with other organizations including Hugging Face. Multiple evaluators can bring different expertise, such as cybersecurity, biological risk, technical testing, and organizational process review. Different reviewers may also reach different conclusions because they use different methodologies and risk thresholds.
For most users, the announcement is more relevant as a transparency development than as a direct product change. A consumer deciding whether to use Claude or another AI assistant should still evaluate the task, the sensitivity of the information involved, and the model’s known limitations. Anthropic’s separate work on public-facing AI behavior includes adding official voting information to Claude, which illustrates how safety decisions can affect specific user experiences.
What should users watch for after the METR assessment?
Users should watch for METR’s eventual published assessment, especially its explanation of what systems it reviewed, what evidence supported its conclusions, and what access restrictions affected the review. A useful report should separate verified findings from unresolved questions and state where the evaluator could not reach a conclusion.
Users should also look for whether METR reports on incidents, risk levels, monitoring practices, and the reliability of Anthropic’s internal safeguards. The strongest independent assessment would explain not only whether a process exists, but whether the process identifies meaningful failures and leads to documented corrective action.
Anthropic’s ability to request predefined redactions remains an important detail to monitor. Legitimate privacy and security restrictions can be necessary, but overly broad redactions could make it difficult for the public to assess the significance of an evaluator’s findings. The practical response is to read the final METR publication alongside Anthropic’s own safety materials and note any differences in framing.
AI oversight remains an evolving area rather than a settled standard. Users should avoid treating any single company report, outside audit, or safety label as a complete measure of a model’s real-world risk.
FAQ
What is Anthropic’s METR evaluator access arrangement?
Anthropic’s METR evaluator access arrangement gives six METR employees company hardware, office space, and internal system access roughly comparable to Anthropic’s risk-assessment teams. The arrangement is intended to support independent assessments of models, safety practices, and risk management.
Can METR publish criticism of Anthropic?
METR can publish assessments of Anthropic’s risk levels, incidents, and practices without Anthropic approval. Anthropic can require redactions for predefined categories, but METR can describe the access and information it received.
Does METR have access to Anthropic customer data?
METR does not have access to Anthropic customer data under the stated arrangement. Anthropic also excludes attorney-client privileged material and some model-architecture information from METR’s access.
Does employee-like access mean METR can inspect everything?
Employee-like access does not mean METR can inspect every Anthropic system or document. The arrangement provides substantial internal access while maintaining specific restrictions for customer, legal, and technical information.
Does the METR arrangement prove Anthropic’s models are safe?
The METR arrangement does not prove Anthropic’s models are safe. The program creates a path for stronger independent scrutiny, but the value of that scrutiny depends on METR’s eventual findings and the limits it reports.