Anthropic Gives METR Employee-Like Access to Audit AI Safety Risks

Anthropic has started giving six employees of METR, a nonprofit AI evaluator, "employee-like access" to its hardware, office space and internal tools and systems — a level of access the company says is roughly on par with what its own internal risk-assessment teams get. The arrangement, announced October 15, 2026, lets METR publish independent findings about Anthropic's AI risk levels, safety incidents or practices without Anthropic's sign-off; Anthropic can only require redaction of a narrow, predefined set of categories such as customer data, attorney-client privileged material and model architecture internals. It's the first deployment of a new three-tier framework Anthropic is using to formalize how deeply outside evaluators can see into its operations, and it arrives alongside parallel work with SecureBio on biological and chemical weapons risk, and a developing partnership with Accenture and its AI unit Faculty on model evaluation and red-teaming.

What changed on October 15

In a post titled "An update on independent evaluators," Anthropic said it has "onboarded six METR employees with company hardware, office space, and access to internal tools and systems." The company describes that access as "roughly on par with what our own risk assessment teams have access to" — a notably specific benchmark, since Anthropic runs its own internal red-teaming and risk-assessment functions ahead of each model release.

The embedded METR staffers are walled off from the rest of the nonprofit: Anthropic says other METR employees are siloed from the embedded team's work, presumably to prevent information that requires redaction from leaking into METR's broader operations or client relationships. METR has already reviewed several of Anthropic's Risk Reports over the past year, including a sabotage-risk review of Claude Opus 4.6 and a review of the automated-R&D section of Anthropic's February 2026 Risk Report, according to METR's own risk-assessment page. The new arrangement moves METR from an outside reviewer reading Anthropic's self-published reports to an embedded team with direct, ongoing access.

Critically, Anthropic says it "can't veto publication, but we can require them to redact information if it falls into predefined categories" — namely customer data, attorney-client privileged information, and details of model architecture. Anthropic decides what falls into those categories in any given case, but METR "reserves the right to make certain statements about the access it received," giving the nonprofit a way to flag if it believes redactions went further than the stated categories justify.

The three-tier access framework, explained

Anthropic's post frames the METR deal as the first real-world example of a broader access framework it is rolling out for third-party evaluators. The framework has three tiers, distinguished mainly by how much access an evaluator gets and how much control Anthropic retains over what gets published.

Anthropic says it "hopes to have several evaluators at Tier 3 eventually," which suggests METR is a pilot for a model the company wants to extend to other nonprofits and audit groups, not a one-off arrangement. The framework also implies a pathway: a group like SecureBio could, after finishing its current review, be considered for "projects with increased access" — effectively graduating toward Tier 3.

Why this matters

Independent evaluation of frontier AI has mostly meant companies publishing their own safety reports, sometimes with an outside group reviewing the finished document after the fact. Giving evaluators standing, employee-level access — badges, hardware, office space, ongoing visibility into internal tools — is a different model: it lets outside reviewers see problems as they develop rather than reconstructing them from a published report after a model has already shipped. Anthropic frames this explicitly as a credibility move, writing that "we're embedding evaluators voluntarily, and we believe every frontier AI company should do the same."

The redaction categories matter just as much as the access grant. By pre-committing to redact only customer data, privileged legal material, and model architecture internals — rather than reserving broad discretion over anything "sensitive" — Anthropic is trying to make its own ability to suppress unflattering findings narrower and more predictable. Whether that holds up in practice will depend on how Anthropic applies those categories the first time METR wants to publish something the company would rather not see in print.

This also follows a pattern of Anthropic publicly tying its safety practices to outside scrutiny, something it has leaned on in other contexts, including its cyber-defense initiatives for critical infrastructure and its expanding cyber-verification program for AI-assisted code. The common thread is that Anthropic is increasingly using third-party validation — rather than its own say-so — as the evidence that its safety claims hold up.

SecureBio, Accenture and Faculty: the wider evaluator bench

METR isn't the only outside group Anthropic is working with. SecureBio, a nonprofit focused on biosecurity, is reviewing the chemical and biological weapons chapter of Anthropic's August 2026 Risk Report. SecureBio previously completed and published a pilot review of an earlier Anthropic risk report, from February 2026. Anthropic says that after the current review wraps, it will consider moving SecureBio to a project with increased access — language that maps onto the Tier 2-to-Tier 3 progression described above.

Separately, on September 18, 2026, Anthropic announced a much larger-scale partnership with Accenture, with the actual evaluation work led by Faculty, Accenture's specialist AI unit. That partnership covers evaluating and red-teaming Anthropic's models, conducting alignment assessments, and testing model safeguards. Anthropic and Accenture each expect to invest at least $1 billion over five years in that work, with Anthropic funding Accenture's side directly. Anthropic describes the arrangement as non-exclusive, and says it was already in parallel conversations with METR and other nonprofit evaluators at the time — conversations that appear to have produced the Tier 3 METR deal a month later. The Accenture announcement traces this commitment back to Anthropic CEO Dario Amodei's essay, "We Must Pace the Frontier," and states plainly that "independent embedded evaluators do not reduce our accountability, but help to make it more verifiable."

Anthropic also says it's in early discussions with several other organizations about similar arrangements, including Hugging Face, though no details on scope or timing have been disclosed for those talks.

How this compares to bank-style examiners

Anthropic's own framing — hardware, office space, and access "roughly on par" with internal risk teams — is closer to how banking regulators place examiners inside large financial institutions than to how most tech companies handle outside audits. Bank examiners from agencies like the Federal Reserve or the OCC can sit inside a bank's own offices, review internal records on an ongoing basis, and issue findings the bank doesn't get to veto. The difference is that bank examiners answer to a government regulator with statutory authority and the power to compel compliance; METR is a private nonprofit with no regulatory mandate, participating because Anthropic invited it in and chose the rules governing what gets redacted. Anthropic itself still writes the redaction categories and decides case by case what falls inside them, so the comparison to examiners is useful for picturing the level of access, but not for picturing the level of independence or enforcement power — there's no regulator standing behind METR's findings if Anthropic ever decided to end the arrangement.

What's still unresolved

Several open questions aren't answered by Anthropic's post. It's unclear how long the METR arrangement is meant to run, whether it's renewable, or what happens if METR and Anthropic disagree about whether something falls into a redacted category — beyond METR's stated right to say something about the access it received. It's also unclear how many evaluators Anthropic ultimately intends to bring to Tier 3, what the entry criteria are for Tier 1 versus Tier 2, and whether Accenture/Faculty's work will eventually be folded into the same tiered framework or operate on separate terms. Anthropic's own post was updated twice within a day of publishing — footnote 2 on October 16 to clarify METR's project terms, and footnote 3 on October 15 to clarify SecureBio's — a reminder that the specifics here are still being worked out even as the company announces the headline arrangement. None of this is disclosed in detail by Anthropic, and no financial terms for the METR deal (unlike the disclosed Accenture figures) have been published.

There's also the matter of context: Anthropic says it signed the White House Accord on Super Intelligence, under which signatory AI companies pledged to partner with independent external auditors or evaluators. Anthropic's own post is the only primary confirmation available of that specific pledge's wording; the Accord itself has not been published as a standalone document on a government site that we could independently verify, so readers should treat the pledge's exact terms as Anthropic's characterization of its own commitment rather than a quoted government text.

What happens next

The near-term signal to watch is whether METR actually publishes something under this arrangement that Anthropic would rather not see — and whether Anthropic's redactions, if any, stay inside the three stated categories. SecureBio's review of the bio/chem chapter of the August 2026 Risk Report is also still in progress, and Anthropic has flagged that a favorable outcome there could move SecureBio toward broader, Tier 3-style access. On the commercial side, the Accenture/Faculty partnership is still ramping up toward its five-year, multi-billion-dollar commitment, and Anthropic's "early discussions" with other groups, including Hugging Face, could produce further embedded-evaluator deals. For a company that has also been adjusting its own usage policy around model deployment, the evaluator framework is effectively a parallel track: rules about who can check Anthropic's safety claims, running alongside rules about what its models can be used for.

Written byTheo Park

Theo Park runs the AI desk at Pandromeda. He follows model launches from the frontier labs and the open-weight community, tracks the assistants and developer tools built on them, and explains what each release changes on pricing, capability and safety. His reporting leans on primary sources: model cards, technical reports, API documentation and the companies' own announcements.

More from Theo ParkAll AI coverage