Anthropic said on 15 October 2026 that it has onboarded six employees of METR, a nonprofit that evaluates frontier AI systems, with what it calls "employee-like access": company hardware, office space, and internal tools "roughly on par with what our own risk assessment teams have access to." METR will publish its own analysis of Anthropic's risk levels, incidents and practices. The announcement states that "Anthropic can't veto publication." The same sentence adds that Anthropic can require METR "to redact information if it falls into predefined categories", giving reproducing confidential IP as an example, and the announcement says Anthropic ultimately decides what information falls into those categories.
Those two sentences sit awkwardly beside each other. A veto over publication and a unilateral power to classify material as redactable are different instruments, and the second is the weaker one. It remains a lever, and it is held by the party under assessment. The TechTimes headline on the announcement read "METR Gets Employee-Like Access Inside Anthropic, With Unconditional Right to Publish Findings." What Anthropic described is conditional in a bounded way, with the boundaries drawn by Anthropic. METR does retain what the announcement calls the right "to make certain statements about the level of access and information it received," which looks like the escape valve: METR could say it was denied information without saying what was cut, although the announcement does not spell out how far those statements may go.
Three tiers, one occupant at the top
The announcement sets out a ladder. In the first tier, evaluators run narrowly scoped investigations, Anthropic decides what access they get, and findings require Anthropic's approval before publication. In the second, evaluators get more information, publish without approval, and may state publicly whether they thought a required redaction was justified. The third tier is the METR arrangement: employee-like access, with publication rights Anthropic describes as similar to the second tier's.
Only METR is placed in a tier. The biosecurity nonprofit SecureBio is reviewing the chemical and biological weapons chapter of Anthropic's August risk report, after which Anthropic says it "will consider moving to projects with increased access." Anthropic says it is working towards a partnership with Accenture and Faculty, Accenture's AI business since March, and that Hugging Face is among several organisations in early discussions. Anthropic staff are encouraged to share information with the METR team as they would with a colleague, outside a small number of defined categories. The examples given are customer data, attorney-client privileged information and model architecture details, and Anthropic says that when architecture information is highly relevant it will generally seek to share it, with explicit internal approval.
Anthropic frames this as a unilateral move others should copy: "We're embedding evaluators voluntarily, and we believe every frontier AI company should do the same." It follows chief executive Dario Amodei's September essay We Must Pace the Frontier, in which he committed Anthropic to giving a team of embedded third-party evaluators, "such as METR", ongoing employee-like access, the one step of his three-step plan that Anthropic would take on alone. It also follows the White House Accord on Super Intelligence, signed at the White House on 29 September 2026 by Elon Musk and the heads or senior executives of Google, Anthropic, Meta, OpenAI and Nvidia, whose third layer says each company should partner with an independent external auditor or evaluator. The Accord is not legally binding and does not define who qualifies as independent.
What Reuters reported two days earlier
The announcement did not arrive into silence. On 13 October, Reuters published a story by Aditya Soni reporting that Anthropic and OpenAI had sought significant control over what outside safety evaluators could publish, citing concern that findings could expose trade secrets. Two people familiar with the talks told Reuters that as recently as 5 October both companies were seeking strict editorial control over what reviewers could publish; one person familiar with the matter said Anthropic's talks with some reviewers appeared to have evolved by 8 October. Anthropic told Reuters that this did not describe all of its evaluator work, and that organisations it had worked with before decide their own methods, findings and what to publish, while with new firms it retains a right to review and sign off on reports while they learn how its models work. OpenAI told Reuters it was not seeking approval rights over the full text of evaluators' reports, that its standard practice is to redact confidential information, and that evaluators can disclose whether major redactions were made.
Reuters also noted the contrast with the public record: Amodei had said external evaluators should be able to publish key findings "without editorial control," and OpenAI endorsed "editorial independence" days later. The unnamed-source portion of that reporting cannot be confirmed from outside, and Anthropic disputes its framing. The sequence is documented: Reuters on the 13th, METR's methodology on the 14th, Anthropic's tier structure on the 15th.
METR published the hard part first
On 14 October, METR put out five documents at once. Three are proposals for how an outside assessor could investigate a developer's internal systems: alignment of unreleased models, control and monitoring of internal agents, and evidence of acceleration from automating AI research and development. A fourth, the umbrella proposal, sets out the gaps in public evidence about loss-of-control risks, and a fifth describes METR's approach to working with AI companies.
The alignment proposal has two halves. The first surveys serious misaligned behaviour by near-frontier internal models drawn from training, evaluations and internal use, characterising the most severe incidents down to the sequence of actions, the agents' reasoning, any collusion, and any attempt to hide evidence. The second asks whether those incidents understate the risk: whether agents would act worse if harmful actions were more feasible or if they believed they would not be caught, and whether training suppresses the evidence or overfits to the assessor's detection methods.
METR is direct about where this breaks down. On the counterfactual half, the proposal says "evaluation awareness will likely limit how much the assessor can rely on this evidence," and calls it "an especially important limitation to assess in detail." That is the same problem that has complicated Anthropic's own safety testing. The survey half has its own holes: activity may go unlogged or be altered by agents or by infrastructure resets, and chain-of-thought may not faithfully describe what the model was doing.
The control proposal is structured around five questions, and the first is the least glamorous and probably the most load-bearing: what fraction of internal agentic inference is actually monitored, and what fraction should be. "Monitoring is only useful insofar as it is actually being run on relevant traffic," the document says, warning that agents which compromise internal infrastructure "could co-opt unmonitored inference to take actions that would otherwise be flagged." It tells assessors to verify that unmonitored inference is genuinely non-agentic rather than assuming safety because it is supposed to have limited tool access. The other questions cover whether agents can disable monitoring, evade it, evade the humans downstream of it, and what the worst undetected misbehaviour would be. When the UK AI Security Institute red-teamed frontier labs' internal monitors, some attacks on Anthropic's coding monitor worked by never reaching it, because hard-coded rules decided which actions were sent to it for review.
The bill for doing this properly
METR attaches a number. In the alignment proposal it says that during the Hugging Face investigation it "spent roughly $400K in API credits over the course of six days." That figure is actual spend on a specific past investigation, METR's review of the OpenAI and Hugging Face incident, carried out with Redwood Research's Ryan Greenblatt, and the credits were free ones supplied by OpenAI, the company whose incident was under review. Separately, and as an estimate rather than a measurement, METR projects that "a rigorous two-month investigation with this scope would have spent over $10M in API credits."
Set that against METR's August funding disclosure, which says the organisation has "not accepted funding from these companies" and takes no donations made by or at the direction of their staff, but that frontier AI companies "currently provide a significant amount of free tokens" for its evaluations, research and engineering. In its approach to working with AI companies, METR says it makes sure it "can afford to pay for any free tokens we receive" without materially affecting its operations. Even so, if an eight-figure inference bill for one thorough assessment were met with free tokens from the company being assessed, as the Hugging Face credits were, that would be a structural dependency rather than a scandal, and worth naming before anyone calls this independent oversight.
What METR says its assessments are not
The public-information proposal is unusually candid for a document published by the organisation that benefits from the access. It states that "all access would ultimately be at the company's discretion," meaning a company can refuse access requests, that "at any time, companies can stop their engagement with an external assessor," and that "there is currently no way to be fully protected from retaliation due to adverse findings." It acknowledges this could create pressure on assessors not to upset companies, and raises the possibility of a race to the bottom between them. Most directly: "These exercises are not themselves audits, compliance assessments, or formal oversight arrangements."
One detail cuts against the obvious reading. METR writes that "our proposal does not require true employee-level access" as defined in a recent public letter setting minimum conditions for embedding evaluators, and a footnote adds that because companies approve or deny access requests, its embedded assessors "will not have the same degree of access as a company's senior safety staff." Whatever "employee-like" means in Anthropic's announcement, METR does not claim parity with insiders, and its point is that the exercise yields evidence for the public rather than assurance: "This proposal will not provide confident assurance about whether development is safe." The scope excludes pre-deployment evaluations and security topics such as model weight security and sandbox robustness. Its account of the evidence gaps draws on published material from Anthropic, Google and OpenAI, and on whether internal capabilities and algorithmic progress are accelerating it says "no company has released detailed public evidence about this."
This rests partly on Anthropic's own account
The terms come from Anthropic's announcement. METR has not published its own description of the contract, the full list of redaction categories is not public, and the agreements are called enforceable without being shown. Anthropic has also revised the announcement twice since publication, on 15 and 16 October, to clarify SecureBio's and METR's project terms, without saying what changed. The access, the tiering and the redaction mechanics are a one-party account of a two-party deal, and should be read that way until METR publishes something under it. The test will be the first assessment containing a finding Anthropic would rather not see in print, and what survives after the categories are applied. Internal incidents of the kind METR proposes to survey have already been disclosed by Anthropic itself.