Anthropic says it has embedded six researchers from nonprofit AI evaluator METR with company hardware, office space and internal access roughly comparable to its own risk-assessment teams. Announced on October 15, 2026, the arrangement allows publication of assessments without a company veto, subject to specified redactions. (anthropic.com)
The Financial Times report by Cristina Criddle, republished by Ars Technica on October 18, describes an outside watchdog working inside the company rather than evaluating only what it can see from outside. Its account covers access to hardware and internal systems, alongside the ability to publish findings without Anthropic’s approval. (arstechnica.com)
The distinction matters, but deeper access does not establish that models are safe or that an evaluator is independent. An October 17 assessment by the Cloud Security Alliance’s AI Safety Initiative argues that the arrangement’s value depends on funding, the treatment of unwelcome findings and whether readers can verify the access evaluators actually received. (labs.cloudsecurityalliance.org)
What the access covers
Anthropic describes the access as “employee-like,” not identical or unrestricted. The embedded team operates under enforceable agreements and is separated from other METR employees, including researchers working with Anthropic on separate projects. Its published analysis can address risks, incidents and company practices. (anthropic.com)
The company is developing three evaluator tiers. The first involves narrowly scoped investigations and company-approved publication. The second offers broader information access and publication without approval, subject to redactions. METR’s third-tier arrangement adds employee-like access with similar publication rights. (anthropic.com)
In the Cloud Security Alliance authors’ assessment, embedding can help outsiders identify evidence that a developer might not otherwise supply. They also warn that close working relationships can weaken skepticism. Those are competing possibilities inherent in the design—not findings that METR has either overcome or succumbed to such pressures. (labs.cloudsecurityalliance.org)
Publication is not unrestricted disclosure
Anthropic retains redaction rights for predefined categories, including customer information, attorney-client privileged material and model architecture information. Its current statement says METR reserves rights to make certain statements about the access and information it received. That is narrower than a promise that all underlying evidence will become public. (anthropic.com)
METR’s own October 14 explanation of its general approach provides a framework for interpreting such work. It says readers should be told the scope and duration of an assessment, whether access limitations affected conclusions, and whether important information was redacted. It also calls for disclosure of formal restrictions and informal pressures that materially influenced conclusions. (metr.org)
That policy is not confirmation of every term in the Anthropic arrangement. METR says some previous or ongoing work does not meet its current best practices. It also acknowledges that voluntary engagement leaves it dependent on companies to provide access and permit publication, and that information supplied by developers may not be independently verified. (metr.org)
A broader experiment in oversight
The initiative follows Anthropic’s September 18 announcement of an embedded-evaluation partnership with Accenture. At that time, Anthropic said access standards, reporting practices and a settled funding system for independent evaluation were still missing. It described the work as an evolving effort rather than an established assurance regime. (anthropic.com)
That earlier announcement also illustrated different funding approaches: Anthropic said it would directly fund Accenture’s work while discussing pilots with nonprofit evaluators using their own funding. Those statements provide background, not documentation of the final financial or in-kind support terms governing the newly described METR team. (anthropic.com)
METR says its general policy is not to accept payments or donations from frontier AI companies. It does accept substantial free model access, while maintaining that it could pay for those resources without materially affecting operations. Financial separation alone does not resolve its acknowledged dependence on developers for information. (metr.org)
There is also relevant experience beyond this engagement. In its May 2026 pilot Frontier Risk Report, METR described how maintaining relationships with participating companies shaped its process and some reporting judgments. It called for clearer standards governing what companies disclose to assessors and what assessors disclose publicly. That earlier pilot should not be mistaken for evidence about this arrangement’s performance. (metr.org)
What remains to be established
The Cloud Security Alliance assessment did not locate a METR statement independently confirming the announced terms. For enterprise readers, its central recommendation is to examine the specific scope, access level, redactions and financial or operational ties behind an evaluation—not treat the phrase “independently evaluated” as a blanket assurance. The announced access creates an opportunity for scrutiny; the resulting evidence must establish its value. (labs.cloudsecurityalliance.org)
