Anthropic gives METR employee-level access to internal systems

What METR can see and say

The six METR staff members have work devices, office space and access to Anthropic’s internal tools and systems. Anthropic employees are asked to share information with them as they would with colleagues working on risks related to model alignment.

The access has defined limits: customer data, information protected by attorney-client privilege and model architecture details are excluded. METR works under binding agreements, and the rest of the organization—including researchers working with Anthropic on other projects—is separated from the team.

Anthropic cannot block a METR publication, but it can ask the group to remove information from a narrow, pre-agreed set of categories. METR can disclose that material was withheld and say whether it considers the removal justified, provided it does not reveal the information itself.

The arrangement is part of a broader effort to narrow the gap between what an AI company knows about its systems and what outside evaluators can learn. The case Anthropic makes is that meaningful scrutiny needs more than access to a model: evaluators need to understand its training, safeguards and potential failure modes, and be free to publish their findings.

Anthropic compares the approach, with caveats, to bank supervision: regulators place examiners inside major banks because the institutions know more about their own risks than outsiders do. The analogy is useful, but incomplete. A company’s voluntary access agreement is not the same as regulatory authority.

Three tiers of access

Anthropic is developing three levels of evaluator access. The METR arrangement is the third tier, combining employee-level access with publication rights similar to those at the second tier.

Other partnerships are at earlier stages, with less information and narrower publication rights. Anthropic says it wants to assess partners’ ability to protect confidential material and their available expertise and resources before expanding access.

SecureBio is currently working at the first tier, reviewing the chemical and biological weapons section of Anthropic’s August risk report. It previously completed and published a pilot review of an earlier report. Anthropic says it will consider broader access and publication rights after the current review.

The company is also developing a larger partnership with Accenture and Faculty, covering model evaluation and vulnerability testing, alignment analysis, safeguards testing and capability-building on both sides. It has held preliminary discussions with several other organizations, including Hugging Face. Over the past year, Anthropic and METR have conducted several reviews of risk reports.

The trust test

My read is that the important test is not whether Anthropic can give a small group access; it is whether the resulting assessments can remain independent when publication runs into a real disagreement over what should stay confidential. METR can disclose that material was removed, but not the material itself. That preserves some accountability while leaving outsiders unable to inspect the boundary directly.

Anthropic says it wants several evaluators eventually to reach the third tier, each publishing its own analysis of the company’s risks and key decisions. It also says participation is voluntary and argues that every company developing advanced models should take part. The model depends on trust in both directions: evaluators must protect sensitive information, while the company must tolerate scrutiny that it cannot fully control.