Anthropic expands METR access for risk assessments

Anthropic says six METR employees now have company hardware, office space and internal access comparable to its risk assessment teams. Its October 15 announcement sets out publication rights and exclusions.

The move follows Anthropic’s September 18 partnership announcement, when it described embedded evaluation as a developing practice. That earlier plan envisaged evaluators observing training, following development and deployment decisions, and speaking directly with employees. Anthropic said it would pay Accenture for its work while exploring pilots with METR and other nonprofits using their own funding.

That history helps explain the practical value of this kind of access. An assessment can ask how a system was built and which safeguards surround it, alongside testing what a model produces. Evidence about those decisions can help readers understand where a test result applies and where further investigation is needed.

What the access permits

Excluded categories include customer data, privileged legal information and model architecture details. Highly relevant architecture information may be shared following internal approval. Other METR staff remain separated from this team’s work.

METR may publish assessments of risk, incidents and practices. Anthropic cannot veto publication. It can require redactions within narrowly predefined categories. METR can publicly dispute those redactions without revealing protected information.

Anthropic describes three tiers.

• Tier one covers scoped investigations with publication approval required.
• Tier two adds information access and publication without approval, subject to defined redactions and public commentary.
• Tier three gives METR the broader internal access described above, with similar publication rights.

SecureBio occupies tier one. Accenture and Faculty arrangements are developing, while Hugging Face discussions are early.

What METR wants to investigate

METR’s separate October 14 proposal confirms an ongoing alignment assessment with Anthropic. It sets out a wider research agenda around three questions. Would internal agents attempt harmful actions? Would monitoring and controls catch them? Could AI assisted research accelerate development beyond the pace at which safeguards improve?

The proposal calls for reports informed by internal records, systems and private staff interviews. Its preferred scope includes investigating whether observed behaviour is representative, how reliably monitoring works and what actually drives faster research. Those are proposed lines of inquiry, rather than findings about the present engagement.

METR says this general proposal does not require access equivalent to that of senior employees. Developers retain discretion over access, and the arrangement cannot fully protect assessors from retaliation. The proposal also excludes important security and organisational questions. Its purpose is to give others evidence for decisions, without making deployment decisions itself or supplying a compliance audit.

Independence depends on more than funding

In a second October 14 statement, METR says it has declined payments and donations from frontier AI companies. It accepts free model access but says it could pay for those tokens without materially affecting its operations. Its policies also address staff conflicts and recusal.

METR nevertheless identifies dependence on voluntary cooperation as a continuing limit. A developer can restrict access, and assessors may rely on information they cannot verify. METR’s transparency policy therefore calls for explaining the scope and duration of work, material access restrictions, redactions, conflicts and informal pressures that could affect conclusions.

For a reader, those disclosures are part of the evidence. A report based on a limited sample should be interpreted within that sample. A statement that important material was withheld could change how confidently its conclusions apply. METR says it aims to explain methods and evidence well enough for outside experts to form their own judgments. The resulting report should be read together with its account of how the work was conducted.

A broader test for embedded evaluation

The AI Evaluator Forum’s September letter offers a broader set of proposed conditions. It calls for independent governance, control over editorial judgments, disclosure of conflicts and protection from retaliation. It also argues for several evaluators with different expertise, direct communication with oversight bodies and access comparable to highly privileged internal staff. These are the letter’s proposed conditions, rather than a finding that any particular engagement meets them.

The distinction is useful when comparing announcements. A company can name several outside organisations while their roles, resources and authority differ. Readers should look for the question each organisation is investigating, the perspective it brings and whether disagreements can be communicated. Counting partnerships alone leaves those differences unresolved.

The letter also treats embedded evaluation as one part of wider oversight. Its argument leaves room for public research, other external access and more transparent company reporting. An evaluator working inside a company can contribute evidence while other researchers continue to question the methods and conclusions.

What to look for in the reports

The voluntary AEF-1 operating conditions, updated in December 2025, provide a practical reading checklist. They cover access and resources, conflicts, control over methods, transparent reporting and protection of sensitive information. The document separates these operating conditions from the scientific question of whether an evaluation method is valid.

• Identify the systems and versions examined, the time available and the resources used.
• Check whether evaluators chose their methods and had access sufficient for the specific question.
• Read the redaction disclosure, including whether the available powers were used and how withheld material affects interpretation.
• Look for enough methodological detail to let other experts review the result.

These details let readers distinguish an observation from a conclusion that travels beyond the tested setting. A finding gains practical meaning when its scope and uncertainty are visible. The useful next step is to examine the published evidence and its limitations before drawing broader conclusions about risk.

Related coverage examines AISI’s separate October 12 agenda for voluntary safety controls throughout AI development.

Illustrative software engineering photograph, published in 2020. The image does not depict the METR assessment of Anthropic. Photo © This is Engineering on Unsplash under the Unsplash License.