Anthropic gives six METR researchers employee-level access and drops its veto over their reports

Anthropic said on October 15 that six researchers from METR, a nonprofit that evaluates frontier AI models, have effectively moved in: they got Anthropic-issued laptops, office space and access to internal tools that the company describes as “roughly on par with what our own risk assessment teams have access to.” The same post converts a pledge that existed only as talking points into a written arrangement — Anthropic states it can no longer veto what those researchers publish, and it can demand redactions in exactly three categories. This is the first time a frontier lab has put an outside evaluator in the top tier of an access ladder it is willing to describe in public.

Key points

• The announcement is dated October 15, 2026; six METR researchers are already embedded with company hardware, space and internal tools. The post gives no start date, no contract term and no payment figure, saying only that the small team works “under enforceable agreements.”
• Redaction is limited to three categories: customer data, attorney-client privileged material, and model architecture details. Anthropic’s own phrasing: “we can’t veto publication, but we can require them to redact information.”
• METR keeps the right to characterize a redaction publicly and argue it was unwarranted, as long as it does not disclose what was removed.
• The post publishes a three-tier ladder for the first time: METR alone sits at tier three; the biosecurity nonprofit SecureBio sits at tier one, where Anthropic approves publication; Accenture and Faculty are climbing toward tier two; Hugging Face is in early discussions.

The three tiers

The yardstick the announcement publishes alongside it is what makes this matter. Tier one runs narrow risk investigations: Anthropic decides what access to grant, and findings can be published only with its approval — SecureBio’s review of the chemical and biological weapons chapter of the August risk report sits here. Tier two gets broader information and the right to publish without approval, but the post says partners at that level first have to demonstrate they can protect confidential information and bring the needed expertise and resources; Accenture, working with Faculty, is described as heading for an “ambitious partnership” covering red-teaming, alignment assessment and safeguard testing. Tier three has one occupant, METR, with access comparable to Anthropic’s own risk assessment teams and publication rights like tier two’s.

One instruction to employees is specific: they are encouraged to share information with the embedded researchers as they would with a colleague working on alignment risk. The analogy Anthropic draws is the resident examiner model regulators install inside the largest banks. It says it hopes to seat multiple evaluators at tier three over time, each publishing its own analysis of the company’s risk posture and major decisions.

Veto versus redaction

“Gave up veto power” is accurate but coarse. The sentence Anthropic actually wrote is that it cannot veto publication but can require redaction of information in narrow, predefined categories — customer data, attorney-client privileged material and model architecture details. A footnote explains why architecture is on that list: it carries “a high risk of inadvertent leaks,” and its value for risk assessment is usually low, so it gets shared only when highly relevant and with explicit internal approval.

METR’s side of the bargain is a channel: it may state publicly that something was removed and argue whether the removal was justified. That turns redaction from a unilateral deletion into a deletion the company has to defend in public without being able to say what was deleted.

METR’s own rules

The day before Anthropic’s post, on October 14, METR published its own approach to risk assessment, and the two documents read well against each other. METR states that it has chosen not to accept payment or donations from frontier AI companies, and that it has declined funding offers “when an AI company would have influence over us.” It still takes free model access, but only, it says, where “we can afford to pay for any free tokens we receive without materially affecting our operations.”

The arrangement METR itself prefers is a unilateral right to attach a redaction summary to a report, indicating whether the company redacted information material to the overall conclusion — a device for pulling negotiations off sentence-level wording and onto whether the deletion changes the finding. METR also warns about NDAs as such: standard company agreements typically treat the existence of the NDA itself as confidential, and companies often “want the final say on what we can and cannot publish.” Its stated current best practice is that an evaluator can at least disclose the broad terms of the engagement, the redaction and publication terms, informal pressure it faced, and whether the access and redactions were adequate.

Where the doubts come from

A September 16 TechCrunch piece collected skepticism from four named researchers, aimed at execution rather than intent. Alexander Meinke, head of research at Apollo Research, points out that by default companies “will do neither” — neither carefully check training behavior nor report it truthfully. Adam Gleave, CEO of FAR.AI, wants access to training checkpoints, post-training environments, transcripts, logs and employee interviews; he says his firm has refused contracts from several frontier developers seeking too much control, because default terms treat evaluators as ordinary contractors bound by “restrictive NDAs.” John Steidley, chief of staff at Palisade Research, compares benchmark gaming to Volkswagen’s Dieselgate and wants public standards for which auditors companies may rely on, to prevent “evaluator shopping.” Henry Papadatos, executive director of Safer AI, argues voluntary pledges rest on goodwill and can be reversed after a PR crisis, so legislation is the sturdier route: “You cannot have it both ways, having zero accountability externally.”

The same report supplies the comparison case: OpenAI gave METR and Redwood Research roughly a week on site to investigate the earlier Hugging Face breach, and both concluded that scope and timing limits prevented confident findings. Apollo got three days of pre-release testing on GPT-6 Astra and concluded that low misbehavior rates “do not provide substantial evidence about the model’s alignment or misalignment.” Under those arrangements time and scope decided the outcome, and neither belonged to the evaluator. Anthropic’s tier three is a standing seat rather than a one-week visit, but the post still commits to no term.

Our take

The useful thing in this post is the contract vocabulary. Four questions that frontier labs used to answer in closed rooms are now on paper: how deep the access goes, who may publish, what the company may delete, and whether the deleted party can object in public. Anyone writing or reviewing safety commitments now has a template to compare against, and TechCrunch’s framing — OpenAI pledged the same arrangement after Dario Amodei’s September essay — means the template will be tested at a second lab.

The catches are real. METR’s financial independence is rare and worth crediting, but it is a nonprofit that depends on frontier labs to do the work; nothing in the post says how the day-to-day tension of sitting inside a host company gets managed. Anthropic keeps the right to argue in public over its own redactions with no third-party arbitration behind it. And the announcement carries no start date, no term and no payment terms — the official claim reaches only as far as “this has begun.” Reuters and The Information have reported independently on the bargaining over veto rights inside labs, but both pages were unreachable for this entry, so none of their specifics appear here.

This same thread has run through OpenAI dismissing its technical contact for METR, through the FTC inquiry and the California subpoena that added compulsory force to outside oversight, and through Anthropic cutting live internet access to its internal evaluations after finding it could not reliably control its own agents. Anthropic’s new arrangement answers the first two. It does not touch the third — the control gap the company has already admitted. The next check has a date attached: METR’s first full risk analysis, and how many times it says “redacted here.”