Anthropic gives METR employee-level access and a no-veto to publish

Frontier labs usually keep their deepest risk tooling for people on the payroll. On 15 October 2026, Anthropic handed that kit to six outsiders from METR, the nonprofit Model Evaluation and Threat Research, and promised not to block what those outsiders write about its risk levels, incidents or practices.

The fine print is where the story tightens. Anthropic still names the redactable categories, decides what falls inside them, and keeps most model architecture behind an internal approval gate. A day earlier, METR had already warned that voluntary embeds leave access at the company’s discretion.

Anthropic put six METR staff on company hardware and risk-team tools

Anthropic’s own post is the primary record. The company says it has onboarded six METR employees with company hardware, office space, and access to internal tools and systems “roughly on par” with what its risk-assessment teams see. Outside a short list of defined categories, Anthropic staff are encouraged to share information with them as they would with a fellow employee working on alignment risk.

The announcement lands on top of commitments Anthropic had already made in public. Last month Dario Amodei argued for embedding outside evaluators inside labs. Anthropic also signed the White House Accord on Super Intelligence, which asks companies to partner with independent external auditors or evaluators. Thursday’s post turns that pledge into an operating arrangement for one evaluator.

Anthropic frames the design with a bank-supervision analogy: resident examiners sit inside large banks because the bank knows more about its own risk position than outsiders do. The company is careful to say the analogy is imperfect, and the gap is easy to name. A bank examiner arrives with a regulator behind them; METR arrives under enforceable agreements that Anthropic helped write.

The no-veto still leaves Anthropic deciding what counts as redactable

On publication, Anthropic’s terms are unusually plain for a lab. METR will publish its analysis. Anthropic cannot veto that publication. It can require redactions only when material falls into predefined categories such as customer data, attorney-client privileged information, or information about model architectures. METR may characterise those redactions in public and say whether it believes they were justified, so long as it does not reveal the withheld content.

A footnote updated on 16 October 2026 is the clause that prices the bargain. Anthropic ultimately decides what information does and does not fall into the redactable categories. METR reserves the right to make certain statements about the level of access and information it received. Read together, those sentences give METR a real publication path while leaving Anthropic as the referee of the redaction map.

Redaction power under predefined categories is ordinary in sensitive oversight. What Anthropic is selling as novel is the package: employee-like access plus a no-veto, with the lab still naming the categories and deciding membership. That is a Frontier reading of the document. It does not mean METR has already failed the assignment.

Architecture stays gated unless Anthropic approves a share

The architecture carve-out is where “employee-like” thins out. Anthropic’s footnote says architecture information presents a high risk of inadvertent leaks when evaluators also work with other companies, and that its relevance to risk assessment is typically low. When it is highly relevant, Anthropic says it will generally seek to share it, though that will require explicit internal approvals.

In practice, architecture starts withheld and moves only when Anthropic green-lights a share. For anyone trying to assess training dynamics, scaffolding, or how safeguards attach to a specific stack, that gate is the access story itself.

The embed is also narrow by design. Anthropic says the engagement is limited to a small METR team under enforceable agreements. Other METR employees, including researchers who work with Anthropic on other projects, are siloed from that team’s work. Embedded evaluation, in the company’s words, gives a few qualified people working under Anthropic’s security standards a close view of how it operates, without opening a pipe for other organisations to obtain Anthropic’s information or its customers’.

SecureBio and Accenture sit on lower rungs while Hugging Face talks start

METR sits alone, for now, at the top of a three-tier scheme Anthropic says it is building.

In the first tier, evaluators run narrowly scoped risk investigations. Anthropic decides what access to provide, and publication needs its approval. SecureBio is reviewing the chemical and biological weapons chapter of Anthropic’s August Risk Report after a published pilot on a prior report. Anthropic says it will consider broader access after that work.

In the second tier, evaluators can publish without approval and get more information, still subject to category redactions they can challenge in public. Anthropic says it is working toward an ambitious partnership with Accenture and Faculty that includes evaluating and red-teaming models, alignment assessments and safeguard testing. Which tier that partnership will occupy remains undisclosed.

The third tier is the METR arrangement: employee-like access with publication rights similar to tier two. Anthropic says it is also in early discussions with several other organisations, including Hugging Face.

Funding is part of the independence story. CNBC reports that Anthropic is not funding METR’s work. That sits beside Anthropic’s earlier statement that it would fund Accenture directly because of urgency, a choice that drew independence criticism when it was announced. Anthropic has said standards for what embedded evaluators should see, how they should report, and how independent evaluation should be funded are still unsettled, and that long-term it wants pooled or government money.

METR warned a day earlier that voluntary embeds still leave access at company discretion

METR published its own terms of engagement before Anthropic’s blog. On 14 October 2026, it released its approach to working with AI companies and a separate proposal on informing the public about loss-of-control risks.

In the approach post, METR says it will publicly describe scope, duration, access limits, redactions and other constraints that may affect conclusions. It also says it remains dependent on companies to engage, provide access and permit publication, and that even with transparency a company can use withholding or redaction to shape what evidence the public receives. In the loss-of-control proposal, METR is blunter still: all access is ultimately at the company’s discretion, so in practice METR will lack the same access as senior internal staff doing similar risk work. The same post says the proposal stops short of “true employee-level access” as framed in a recent public letter, and omits weight security and sandbox robustness from its scope.

Read beside Anthropic’s 15 October terms, those lines give the checklist against which the first METR report under the new bargain should be scored. A no-veto beats tier-one approval, and still leaves METR short of a statutory examiner with compel power or a security-audit mandate.

Reuters reporting relayed earlier in the week that labs had sought significant control over what outside reviewers could publish, worried about trade secrets. Anthropic’s post answers that fight by splitting the problem: the analysis can run without a veto, while narrow redactions remain available and METR stays free to say when those cuts matter. Whether that split holds when a sensitive incident lands is still a future document.

The first METR report under these terms will show what the bargain is worth

What is still missing is the paper that would let a careful reader price the arrangement. The full engagement contract remains unpublished. There is no METR assessment yet under the new employee-like terms that discloses access limits and redaction summaries the way METR’s own process policy promises. Anthropic has not named which tier Accenture and Faculty will occupy, or what Hugging Face would see if talks advance. There is no public schedule for when METR’s first report under these rights will appear.

For counsel, cloud buyers and lab compliance teams, Monday already has a posture. Price Anthropic’s no-veto and METR’s unfunded status as real movement in the voluntary column, while treating “employee-like” as limited for as long as architecture stays behind an Anthropic approval gate and Anthropic decides category membership. Watch for METR’s first access-and-redaction disclosure under the new terms; that document will show how much of the bargain survives contact with a hard finding. Other labs can adopt the ladder while watering down the no-veto, so read their announcements against the same two questions: who can block publication, and who decides what may be cut.

Anthropic has offered the sharpest voluntary US answer yet to a week of harder external pressure: put the evaluator inside, keep the veto off the page, and let the public argue about the redactions. Whether that becomes the industry’s preferred substitute for compel-and-stop powers depends on what METR is willing to say, in public, the first time Anthropic’s category map bites.