Anthropic embeds six METR evaluators with employee-level access and waives its veto over published findings
Anthropic has given six METR staff internal access to its models and safety data: and cannot block what they publish.
Six METR employees now sit inside Anthropic with company hardware, office space, and access to internal tools at roughly the same level as Anthropic’s own risk assessment teams. Anthropic has also waived its right to veto what those evaluators publish. That combination, deep access plus publication freedom, is what makes this arrangement worth paying attention to.
What METR can see, and what it cannot
METR’s embedded team can access safety data, internal tools, and information about how models behave and how safeguards function. Anthropic staff are instructed to treat them as they would a colleague working on alignment risk.
Three categories remain walled off: customer data, attorney-client-privileged information, and model architectures. Everything else is, in principle, on the table.
METR can publish its findings without Anthropic’s approval. Anthropic retains a narrow right to request redactions within those three defined categories, but it cannot simply veto a report it dislikes. There is also a notable detail about what happens when Anthropic does request a redaction: METR is free to say publicly that a redaction was made and whether it thinks the redaction was justified. It just cannot reveal the redacted content itself. That provision gives the public a meaningful signal even when information is withheld.
The embedded METR team is siloed from other METR staff, including researchers who collaborate with Anthropic on separate projects. That keeps the arrangement clean and limits the risk of information leaking sideways.
Anthropic is not funding METR’s work.
A three-tier framework for evaluator access
This is not a single bespoke arrangement. Anthropic has formalised three tiers of evaluator engagement, and METR sits at the top.
Tier one is a narrowly scoped review. The company being evaluated decides what access to grant, and evaluators need Anthropic’s approval before publishing. SecureBio is currently operating at this level, reviewing the chemical and biological weapons chapter of Anthropic’s August 2026 Risk Report. It completed a pilot review of the previous report and published those findings. If the current review goes well, Anthropic says it will consider moving SecureBio to a higher tier.
Tier two removes the publication veto. Evaluators get more information, can publish without approval, but Anthropic can still request redactions in the same narrow categories. As with tier three, evaluators can characterise those redactions publicly.
Tier three is the full embedded model, which METR now occupies. It combines employee-like access with tier-two publication rights.
Anthropic has said it hopes to have several evaluators at tier three over time, each publishing their own independent assessment of its risk posture.
Why this matters for AI safety oversight
The recurring problem with third-party AI audits has been that the companies being audited control the terms. They decide what auditors can see, and often retain approval rights over what gets published. The result is that audits can become endorsements rather than assessments.
The structure Anthropic has put in place addresses both of those problems directly, at least on paper. METR gets meaningful access, and cannot be silenced after the fact. The fact that METR can characterise redactions publicly adds a further layer of accountability: even a suppressed finding leaves a visible trace.
It is also worth noting the timing. This announcement came two days after Reuters reported that Anthropic and OpenAI had sought significant control over what outside evaluators could publish. This arrangement is a direct counter to that framing, and Anthropic has been explicit that it thinks every frontier AI company should adopt the same approach voluntarily.
What this means for you
If you work at an organisation making decisions about which AI providers to trust, the practical value here is that METR’s published assessments will carry more credibility than a typical third-party review. The independence conditions Anthropic has set out, no equity stake, no financial dependence, freedom to publish, are meaningful criteria you can apply when evaluating claims from other providers too.
If you work in AI governance or policy, the three-tier framework gives you a vocabulary and a reference model. Anthropic is not the only company that needs independent evaluation, and this structure is replicable. The question of who funds that evaluation at scale remains open. Anthropic has said it believes long-term funding should come from pooled or government sources, as it called for in its Advanced AI Framework in June 2026. For now, it is working with different evaluators under different funding arrangements, which means the independence picture varies across tiers.
The Accenture partnership, announced on 18 September 2026, is worth keeping in mind here. Anthropic is directly funding that work, which is a relevant fact when assessing evaluator independence. The company has acknowledged this tension and has not resolved it.
Early-stage discussions with Hugging Face
Anthropic has confirmed it is in early discussions with Hugging Face about a potential evaluator relationship. No tier has been assigned, no scope has been agreed, and no timeline has been given. It is mentioned here because it has been confirmed, not because anything concrete has happened yet.
The METR background
METR was founded by Beth Barnes, a former alignment researcher at OpenAI who left in 2022 to form ARC Evals, the evaluation division of Paul Christiano’s Alignment Research Center. In December 2023, ARC Evals was spun off into an independent 501(c)(3) nonprofit and renamed METR. Anthropic and METR have worked together on several Risk Report reviews over the past year. This formalises and significantly deepens that relationship.
Dario Amodei named METR by name in an essay published 33 days before this announcement, calling for the industry to work with evaluators of exactly this kind. This arrangement is the first concrete implementation of that ask.