Anthropic announced on October 15, 2026 that it has started giving employee-like access to an embedded team from METR, a nonprofit that evaluates frontier AI models. Six METR employees have been onboarded with company hardware, office space, and access to internal tools and systems.
The announcement follows Anthropic’s commitment in September 2026 to stronger independent, third-party assessment of its models and safety practices, and its signing of the White House Accord on Super Intelligence, in which companies pledged to partner with independent external auditors or evaluators. Anthropic said it has worked with METR over the past year on several reviews of its Risk Reports.
The Terms of Employee-Like Access
Anthropic said the embedded team’s access to internal tools and systems is roughly on par with what its own risk assessment teams have. Outside a small number of clearly defined categories — data about customers, attorney-client-privileged information, and information about model architectures — Anthropic employees are encouraged to share information with the team just as they would with a fellow employee working on alignment risk.
A footnote in the announcement explains the architecture carve-out. Because evaluators, like bank examiners, may also work with other companies, Anthropic said it exercises caution around the possibility of inadvertent leaks: information about architectures presents a high risk of such leaks, and its relevance to risk assessment is typically low. When architecture information is highly relevant, Anthropic will generally seek to share it, though doing so will require explicit internal approvals.
Under the arrangement’s publication terms, METR will publish its analysis of Anthropic’s risk levels, incidents, or practices. Anthropic cannot veto publication, but it can require METR to redact information that falls into narrow, pre-defined categories. METR is free to characterize the redactions publicly and to say whether it believes they were justified, so long as it does not reveal the redacted information.
The engagement is limited to a small team operating under enforceable agreements, and other METR employees, including researchers who work with Anthropic on other projects, are siloed from the embedded team’s work. Anthropic described embedded evaluation as giving a few qualified people working under its security standards a close view of how it operates, and said it is not a way for other organizations to obtain its information, or that of its customers and partners.
Anthropic’s Rationale for Independent Evaluation
As models have become more powerful, they have required stronger safeguards and more challenging risk assessments, the company said. Anthropic said it wants to be publicly accountable for the decisions it is making, but cannot publicly share all the information relevant to its safety work, because some of it could be useful to malicious actors or is commercially sensitive, like compute or training information. Instead, it is giving third-party evaluators deep access to its information and having them share evidence and reasoned conclusions about the risks involved in building its models, with the aim of closing the gap between what evaluators understand about a frontier AI company’s systems and what the company itself understands.
The announcement lists four things evaluators need to evaluate frontier models: expertise in assessing the capabilities of frontier models, including understanding the ways evaluations can go wrong, such as alignment faking; independence, meaning they should not hold equity in the company they are evaluating or be financially or operationally dependent on it; enough access to meaningfully evaluate risks, extending beyond the latest models to visibility into how those models were trained and how safeguards function; and freedom to publish observations and assessments of a model or a process.
Anthropic drew an analogy to bank supervision while acknowledging the analogy is not exact: banks know more about their own risk positions than outsiders do, so regulators assign resident examiners to work inside the largest banks, and if a bank’s risk-taking could threaten the public, third parties try to see that in advance.
Three Tiers of Access
Anthropic said it is developing three tiers of access for evaluators. In the first tier, evaluators conduct narrowly scoped risk investigations; Anthropic decides what access to provide, and evaluators can publish their findings with Anthropic’s approval. In the second tier, evaluators can publish without Anthropic’s approval and have access to more information, though Anthropic can still require removal of specific categories of information, while evaluators can publish their views on whether the redactions were justified. The third tier is the arrangement with METR: employee-like access with publication rights similar to those of the second tier.
Over time, Anthropic said, it hopes to have several evaluators at the third tier, with each team publishing their own analysis of its risk posture and key decisions.
SecureBio, Accenture, and Early-Stage Talks
SecureBio is currently in the first tier. It is reviewing the chemical and biological weapons chapter of Anthropic’s August 2026 Risk Report, after completing and publishing a pilot review of the previous risk report. Anthropic said that after this review is complete, it will consider moving to projects with increased access and publication rights.
With Accenture and Faculty, Anthropic said it is working toward a partnership that includes evaluating and red-teaming models, conducting alignment assessments, testing model safeguards, and building capabilities across the organizations.
Anthropic also said it is in early discussions with several other organizations, including Hugging Face. Because those partnerships are still in early stages, Anthropic is providing those evaluators with more limited information, and they have more limited publication rights, while Anthropic confirms that partners protect confidential information and have the requisite resources and expertise. As partnerships progress and trust builds, Anthropic said, its goal is to fully embed more independent evaluators.
The September Commitment
In September 2026, Anthropic co-founder Dario Amodei published an essay, “We Must Pace the Frontier”, that made embedded evaluators with employee-like access the first step of a three-step plan for pacing frontier AI development. Amodei wrote that Anthropic is unilaterally committing to that step and called on governments to require other frontier companies to match. He wrote that “we must slow the pace at which we improve the capabilities of AI models,” so that risk prevention has time to keep up with capabilities advancement.
The essay said Anthropic intends to invite an embedded external review team equipped with desks in its offices, access badges, and company laptops; access to workspaces, tools, and permissions mostly comparable to what internal risk assessment teams have, with some exceptions where the law or contracts require it or to protect customers’ and partners’ private information; and a contract under which external reviewers have the right to publish key findings about risk levels, incidents, practices, and the access they received or did not receive, with Anthropic holding no editorial control over publication. Under those intended terms, Anthropic would keep a narrow ability to redact security-sensitive, legally privileged, commercially sensitive, or third-party confidential information but could not redact findings just because they are unfavorable, and reviewers could say publicly if a redaction removed something important to their conclusions.
Anthropic said it is embedding evaluators voluntarily and believes every frontier AI company should do the same. It said it is moving quickly with multiple evaluators, is learning actively about what kinds of partnership work, and is committed to sharing updates as it goes.
