Anthropic lets outside AI safety testers work like employees

For most of the AI boom, outside safety testing has looked like a short visit. An evaluator gets early access to a model for a few days or weeks, runs a battery of tests, writes up what it found, and the lab decides how much of that ends up public. On 15 October 2026 Anthropic announced something closer to a residency. In a post titled An update on independent evaluators, the company said it has started giving employee-like access to a team from METR, the nonprofit that evaluates frontier AI models, and that METR will publish the results of its risk assessments.

The details matter. Six METR employees now have Anthropic hardware, office space and access to internal tools and systems that, in the company's words, are "roughly on par" with what its own risk assessment teams use. Anthropic says it cannot veto what METR publishes. And one day after the announcement, the company quietly edited the paragraph that describes how redactions work, which is where the real power in any audit sits.

Here is what Anthropic actually committed to, what changed in the edit, and why this matters for everyone who uses or builds on frontier models.

What METR gets

According to Anthropic's post, the six embedded METR staff work with company hardware, sit in Anthropic offices and can use internal tools and systems at roughly the same level as Anthropic's own risk assessment teams. Anthropic employees are "encouraged to share information with them just as they would with a fellow employee working on alignment risk." That last line is the important one. Access to a model is one thing. Access to the people who trained it, the incidents they saw and the internal debates they had is something else entirely.

METR will publish its analysis of Anthropic's risk levels, incidents and practices. Anthropic is not funding METR's work, CNBC reported, citing the company. That point is not trivial. When Anthropic named Accenture as its first evaluator partner in September, it said it would pay for that work directly, and critics on social media immediately asked how independent a paid reviewer can really be.

There are limits. A small number of categories stay off the table: data about customers, attorney client privileged information and details about model architectures. Anthropic says architecture information carries a high risk of accidental leaks and is usually of low relevance to risk assessment. When it is highly relevant, the company says it will generally try to share it, but only with explicit internal approval.

The engagement is also fenced in on METR's side. Only a small team operates under enforceable agreements, and other METR employees are siloed from that team's work, including researchers who work with Anthropic on other projects. Anthropic stresses that embedding is not a back door for other organizations to obtain its information or that of its customers and partners.

Three tiers, and only one evaluator at the top

The METR arrangement is the top level of a three tier system Anthropic says it is building.

In tier one, evaluators run narrowly scoped risk investigations. Anthropic decides what access they get, and they can publish their findings only with Anthropic's approval. Biosecurity nonprofit SecureBio is in this tier today. It is reviewing the chemical and biological weapons chapter of Anthropic's August Risk Report, after completing and publishing a pilot review of the previous report. Anthropic says it will consider giving SecureBio more access once that review is done.

In tier two, evaluators get more information and can publish without Anthropic's approval. Anthropic can still require the removal of specific categories of information, but evaluators can publish their own view on whether those redactions were justified. No evaluator has been named in this tier so far.

In tier three, evaluators get the publication rights of tier two plus employee-like access. METR is the only organization at this level. Anthropic says it hopes to have several evaluators in tier three over time, each publishing its own analysis of the company's risk posture and key decisions.

Beyond those two, Anthropic says it is working toward an "ambitious partnership" with Accenture and Faculty, Accenture's AI business, covering model evaluations, red teaming, alignment assessments and safeguard testing. It is also in early discussions with several other organizations, including Hugging Face. The post does not say which tier these partners will land in.

The bank examiner comparison

Anthropic frames the idea with an analogy from finance. Banks know more about their own risk positions than outsiders do, so regulators place resident examiners inside the largest banks. If a bank's risk taking could threaten the public, third parties try to see it coming before it happens. The company admits the analogy is not exact, and it is worth being clear about why.

Bank examiners work for a regulator with legal powers. They can demand documents, and their findings can lead to sanctions. METR is a nonprofit invited in by the company it is examining, under terms that company negotiated. Anthropic chooses who gets embedded and which categories of information are protected. The structure is a genuine step up from short pre release tests, but it is still voluntary oversight, not supervision.

Anthropic seems to know this. In an earlier statement quoted by CNBC, the company said there are "no standards for what information embedded evaluators should have access to, or how they should report what they find," and no settled system for funding them. Long term, it argued, funding should come from pooled or government sources.

The edit one day later

The most telling part of the story is a small change to the post itself. Anthropic's article now carries a footnote saying it was "updated on October 16 to clarify METR's current project terms with Anthropic."

When the post went live on 15 October, the paragraph about publication read, as quoted by TechCrunch and Reuters, that Anthropic could require redactions only if information fell into "narrow, predefined categories," and that "METR is free to characterize our redactions publicly, and say whether it believes the redactions were justified, as long as it does so without revealing the redacted information."

The current version drops the word "narrow" and replaces the second sentence. It now says that Anthropic "ultimately decides what information does and does not fall into these categories, although METR reserves the right to make certain statements about the level of access and information it received."

That is not a reversal. Anthropic still cannot veto publication, and METR can still say publicly what it was and was not allowed to see. But the edit makes explicit who holds the pen on the hardest question in any audit: what counts as sensitive. If Anthropic decides that a piece of evidence is customer data or architecture detail, it can be removed, and the updated wording no longer promises in so many words that METR can call such a redaction unjustified. Anthropic describes the change as a clarification of METR's current terms, not as a new restriction.

Why METR's own rules matter here

METR published its side of the bargain one day before Anthropic's announcement. In a proposal on loss of control risks dated 14 October, the nonprofit laid out what it asks of any developer that wants a METR risk assessment: transparency about scope, access and redactions; the chance to interview staff privately, without a company representative present and without screened answers; and timely publication of METR written reports within the agreed scope.

METR is candid that developers can redact any information they deem sensitive and choose what access to grant. Its answer is disclosure. In a companion post, Our approach to working with AI companies, METR says that if a company redacts information important to its conclusions, METR should say so publicly. One arrangement it has found useful is the right to attach a "redaction summary" to its reports, flagging when something material was removed. "In line with our transparency policies, our report will openly describe the scope, access, and other limitations of our work," METR told Reuters.

So the practical test of the new deal will be METR's first published report. Readers should look for three things: how much access the team actually had, whether METR attaches a redaction summary, and whether any of its conclusions were shaped by information it could not describe.

The pressure behind the announcement

This did not happen in a vacuum. Anthropic CEO Dario Amodei proposed embedding outside evaluators inside AI labs in a September essay, as a first step toward slowing the pace of frontier development. OpenAI quickly pledged the same. In late September, both companies, along with Google, Meta, Nvidia and xAI, signed the White House Accord on Super Intelligence, which commits signatories to work with independent external auditors or evaluators.

Then came a difficult week. On 13 October, a Reuters exclusive reported that Anthropic and OpenAI had sought significant control over what outside reviewers could publish, citing concerns about trade secrets. We covered that story alongside the UK parliamentary hearing on binding AI rules. On 14 October, the US Federal Trade Commission sent civil investigative demands to both companies about AI agent security incidents, as we reported in our piece on the FTC subpoenas. TechCrunch notes that incidents of AI agents acting outside their instructions have been disclosed every week or two since late August.

Against that backdrop, Reuters reported that a person familiar with the matter said Anthropic had become more open in negotiations recently. A separate source told the agency that the key sticking point is that information labs see as crucial intellectual property can also be exactly what is needed to judge a model's risk.

What this means for you

If you build products on Claude, this is good news with a footnote. A team of outside researchers with deep access and the freedom to publish is a stronger signal about safety practices than any marketing page. When METR's report lands, it will be one of the most detailed independent looks at how a frontier lab manages risk, and it is worth reading in full.

If you follow AI policy, watch the redaction question more than the access question. The edit on 16 October shows where the line is still being negotiated. Access without publication is just consulting, and publication with unlimited redaction is just press relations. The value of the METR arrangement depends on how close it stays to the original promise that METR can say when something important was left out.

And if you are wondering about other labs, Anthropic ended its post with a challenge: "We're embedding evaluators voluntarily, and we believe every frontier AI company should do the same." OpenAI has made a similar pledge. Whether it, Google, Meta or xAI match the tier three terms, with no publication veto and no funding link, is the next thing to watch.

The bottom line

Anthropic has embedded six METR researchers with employee-like access, Anthropic hardware, office space and internal tools, and has given up the right to veto what they publish. Customer data, privileged legal material and model architecture stay off limits, and a day after the announcement Anthropic clarified that it decides what falls into those categories. It is the most concrete version yet of the independent oversight that AI labs have been promising, and the first METR report will show how independent it really is.

Sources: Anthropic: An update on independent evaluators, CNBC, TechCrunch, Reuters via Investing.com, The Verge, METR proposal, METR: Our approach to working with AI companies.