Anthropic gives six METR evaluators employee-like access — here are the limits

Anthropic says it has onboarded six employees from the nonprofit evaluator METR with company hardware, office space and access to internal tools and systems roughly comparable to its own risk‑assessment teams. The arrangement, announced in Anthropic's [October 15 update](https://www.anthropic.com/news/an‑update‑on‑independent‑evaluators), is unusually concrete: it describes who is embedded, what operational access they receive and what they can publish. The access is still bounded. Anthropic excludes customer data, attorney‑client privileged material and information about model architectures from ordinary sharing. It says architecture information may be provided when highly relevant, but only through explicit internal approval. The METR team also operates under enforceable agreements, and other METR employees are siloed from its work. “Employee‑like” therefore means a small external team can work close to Anthropic's safety operations. It does not mean unrestricted access to every system, customer record or model secret, and it does not turn METR into an employee or regulator.

The most consequential term is publication control. Anthropic says METR can publish analyses of the company's risk levels, incidents and practices, and that Anthropic cannot veto publication. Anthropic can require redaction when information falls within predefined sensitive categories. METR may publicly characterize those redactions and say whether it believes they were justified, provided it does not reveal the protected material. That is stronger than a conventional company‑approved audit summary because the evaluator keeps the decision to publish. It is weaker than unconstrained public disclosure because Anthropic still defines protected categories and controls the systems it grants access to. METR's own [statement of approach](https://metr.org/blog/2026‑10‑14‑our‑approach‑to‑risk‑assessment/) makes that dependency explicit. It says voluntary engagements can leave evaluators reliant on companies for access and publication, and that withheld access or redactions can shape the evidence the public receives. Readers should therefore inspect future reports for a scope statement, access limits and a redaction record, rather than treating the independent‑evaluator label as sufficient on its own.

Anthropic's model has three levels. Tier one covers a narrowly scoped investigation: the company chooses the access and approves publication. Tier two expands access and permits independent publication, while preserving narrow redaction rights. Tier three adds the employee‑like operational access now assigned to METR while keeping publication rights similar to tier two. SecureBio is currently in tier one for a review of Anthropic's chemical and biological weapons risk work. Anthropic also names Accenture and Faculty as partners for model evaluation, red‑teaming, alignment assessment and safeguard testing, but does not say they have METR's tier‑three access. Early discussions with Hugging Face are also mentioned. The tiers make future announcements comparable. A partnership label alone reveals little; the material questions are whether evaluators can select evidence, speak to staff, access internal systems and publish conclusions without company approval. Anthropic says it hopes to move several evaluators to tier three over time, but no schedule or acceptance test is public.

METR's [October 14 proposal](https://metr.org/blog/2026‑10‑14‑better‑informing‑the‑public‑about‑loss‑of‑control‑risks/) describes the work it wants to perform: investigate internal alignment, control and AI research‑and‑development acceleration using interviews, internal datasets and company systems. It also says the science is not mature enough to provide confident assurance that development is safe, and that these assessments do not replace security audits or compliance review. That limits what the new arrangement proves today. Anthropic has announced a mechanism for deeper evaluation, but it has not published a new METR assessment under the embedded model. The arrangement does not establish that safeguards work, that incidents are absent or that Anthropic meets a binding safety standard. When reports arrive, the useful evidence will include what period was examined, which teams and systems were in scope, which requests were denied, what was redacted, and whether METR could verify company‑provided information. METR's [risk‑assessment index](https://metr.org/risk‑assessment/) provides prior partnership reports, offering a baseline for judging whether the embedded access produces materially deeper public evidence.

The arrangement addresses a real information problem: frontier‑model developers hold private evidence about training, safeguards and internal incidents that outside researchers cannot reconstruct from public model access. Giving an evaluator secure access can narrow that gap while protecting customer and security‑sensitive data. Its credibility will depend on repeated behavior. METR needs enough access to challenge company explanations, enough time to investigate, and enough publication freedom to disclose adverse findings and meaningful limitations. Anthropic will need to document redactions narrowly and avoid using the partnership as a substitute for statutory reporting, regulator access or independent security work. For companies comparing evaluator programs, the practical checklist is straightforward: name the people or organization with access, publish the access tier, define exclusions, preserve evaluator‑controlled publication, disclose redactions and release enough evidence for outsiders to assess the conclusion. Anthropic's new terms are measurable against that checklist. The findings produced under them will show whether the structure works in practice. Follow related releases and analysis on the [Anthropic organization page](https://opentools.ai/organizations/anthropic). *Image: Anthropic's original hero image for its October 15 independent‑evaluators announcement. OpenTools reproduced the source‑published JPEG without generative alteration or artificial upscaling.*