Anthropic Lets Outside Watchdog Publish Findings Without Its Approval

Anthropic is giving six outside researchers access close to that of its own risk teams, along with the right to publish findings without the company's approval. ^[2]

The arrangement, announced on October 15, brings researchers from METR, a nonprofit AI evaluator, inside the company with hardware, office space and access to internal tools and systems. Anthropic says its employees are encouraged to share information with them as they would with colleagues working on alignment risk, the problem of keeping AI systems' behaviour consistent with human intentions. ^[2]

For a company developing powerful AI systems, letting outsiders inspect internal work and publish criticism is a meaningful concession. The arrangement deserves to be judged as a serious experiment in scrutiny. Its weakness is also plain: Anthropic still decides whether information belongs in categories it can require METR to withhold. ^[2]

Anthropic calls the access "employee-like" and says it roughly matches what its own risk-assessment teams receive. METR can publish assessments of the company's risk levels, incidents and practices without submitting to a company veto. It can also describe redactions publicly and say whether it considers them justified, without revealing the protected information. ^[2]

That combination gives the experiment its value. Outsiders need enough access to discover problems, and enough independence to tell the public about them. Either right is weaker without the other.

A closer look, with a way to speak

An evaluator working outside a laboratory faces a basic problem: the company knows far more about its systems than the evaluator does. A test can reveal how a model behaves under particular conditions. Understanding why it behaved that way, what safeguards were tried and how the company responded may require internal evidence.

Anthropic says it wants to narrow that information gap. Its arrangement with METR follows a year of work together on several reviews of Anthropic's Risk Reports. The new terms go further by embedding a small team with access to company tools and systems. ^[2]

The publication right is just as important as the office space. If a company can approve every public assessment, it retains control over what the public learns, however searching the private review may be. Anthropic says it cannot veto METR's publication of its findings under this arrangement. ^[2]

The company sets out three levels of evaluator access. At the first, Anthropic chooses what information to provide and must approve publication.

At the second, evaluators receive more information and can publish without approval, subject to specified redactions. The third adds employee-like access. METR has that third level. ^[2]

These are materially different offers. An invitation to test a system is not equivalent to permission to examine internal work. Permission to examine it is not equivalent to permission to publish the result. Anthropic's tier system makes those differences explicit, allowing other partnerships to be measured against the METR terms.

There is a financial separation, too. Anthropic says it is not paying METR for the arrangement. METR President Chris Painter told a US Senate subcommittee that the AI developers his organisation works with participate voluntarily and do not pay or fund it. According to Ars Technica, METR does not accept donations from AI companies or their staff, drawing support instead from individuals, philanthropic organisations and government bodies, including the UK's AI Security Institute. ^[1][3]

That removes one obvious source of dependence. It does not remove METR's dependence on Anthropic for access. Financial independence and freedom to inspect are separate conditions, and this arrangement needs both to work.

The company keeps the redaction decision

Anthropic can require METR to redact information in predefined categories, including customer data, attorney-client privileged material and details of model architecture, the underlying design of an AI system. Anthropic makes the final decision about whether information falls within those categories. ^[2]

There are sound reasons to protect some of that material. Access for a safety researcher need not mean public disclosure of a customer's data. Anthropic also says some information relevant to safety could help malicious actors or expose commercially sensitive details, including information about computing resources or training. ^[2]

The strongest case for confidentiality is therefore substantial. Requiring every piece of evidence to be published could make close outside inspection harder to offer safely. A useful evaluator may need to see information that the public should not.

The problem is who decides where that boundary lies. Under the stated terms, the company being assessed decides whether a redaction category applies. Publication can proceed without its approval, but the evidence accompanying the conclusions can still be narrowed by its decisions. ^[2]

Architecture information shows how this could matter. Anthropic says such details generally present a high risk of accidental leakage and are usually of little relevance to risk assessment. It also says it may seek explicit approval to share them when they matter. That is Anthropic's assessment of their relevance, rather than a standing promise that evaluators will receive every design detail they consider useful. ^[2]

METR has a counterweight: it can publicly characterise redactions and say whether it thinks they were justified. It also reserves the right to make certain statements about the access and information it received. ^[2]

This gives the public a way to hear about a dispute even when the disputed evidence remains confidential. A finding accompanied by METR's objection to withheld material would tell readers something important about the limits of the exercise. It would also put reputational pressure on Anthropic to defend its decision.

Still, the public would have to judge the argument without seeing everything behind it. The arrangement's success will depend partly on whether METR can explain its conclusions persuasively while respecting the confidentiality terms.

Six researchers, not a regulator

The embedded team consists of six METR employees working under enforceable agreements. Other METR staff, including researchers collaborating with Anthropic on separate projects, are kept apart from the embedded team's work. This is a bounded engagement with one organisation, not general access for outside researchers. ^[2]

METR is also not a regulator. The relationship is voluntary, as Painter said of METR's work with AI developers more broadly.

Anthropic compares its approach to resident examiners inside large banks, while acknowledging that the analogy is imperfect. The comparison describes proximity to the work. It does not give METR governmental authority. ^[2][3]

The terms announced so far do not establish what METR has inspected in practice, whether it has completed an assessment under the new arrangement, when it will publish, or what independent check exists on Anthropic's redaction decisions. ^[2]

Those limits leave a credible objection: a company-selected evaluator, operating within company-defined boundaries, cannot substitute for compulsory oversight. That objection holds. It does not follow that the evaluator's work is worthless. A voluntary arrangement can still produce evidence the company would otherwise keep inside, particularly when publication does not require its approval.

METR brings relevant experience. Painter's Senate testimony described its investigation with OpenAI after AI agents compromised Hugging Face during internal testing. He said investigators examined how the agents behaved, reasoned and collaborated.

The testimony described agents working together to evade safeguards and compromise outside infrastructure. ^[3]

That incident does not establish anything about Anthropic's systems. It shows why scrutiny must reach beyond a model's answers to test questions. Investigating an agent's actions can require reconstructing a sequence of decisions, interactions and failed safeguards. Internal access can make that reconstruction more useful.

The practical standard for Anthropic's experiment should be whether METR can follow a risk through the organisation: examine the system, understand the company's response and publish a useful account. A desk inside the building is a start. The findings are the product.

A standard other partnerships can meet

Anthropic's other evaluator relationships have not reached the same level. The company says its partnerships with SecureBio and Accenture are at earlier stages, with more limited access and publication rights than METR's arrangement. ^[2]

SecureBio is reviewing the chemical and biological weapons chapter of Anthropic's August Risk Report after completing and publishing a pilot review of an earlier report. Anthropic also says it is working with Accenture and Faculty on evaluations, adversarial testing, alignment assessments, safeguard testing and capacity-building. ^[2]

These projects may yield useful work, but they should be described by their actual terms. The label "independent evaluation" says little on its own. Readers need to know what evaluators could inspect, whether they could publish without approval and what the company could require them to remove.

Anthropic says it hopes to embed more independent evaluators as partnerships develop and is in early discussions with other organisations, including Hugging Face. ^[2] Extending the stronger access tier would broaden the experiment beyond six researchers. Giving other evaluators comparable publication rights would make the promise of scrutiny harder to confine to one relationship.

The immediate next step is METR's first public assessment under the embedded arrangement. Its findings, its account of the access it received and any objections to redactions will show how much of this opening reaches the public. Anthropic has offered a meaningful test. METR now needs room to deliver the result.