Anthropic lets six METR auditors into its office, with the right to publish reports without a veto

On 15 October 2026, Anthropic said it had given six METR staff "insider-level" access: corporate laptops, a workspace in the office and internal systems, roughly comparable to what the company's own risk-assessment teams see. METR is a nonprofit that tests frontier models. It will publish its analysis of Anthropic's risk levels, incidents and practices, and the company cannot stop it.

The move follows commitments from last month. Anthropic then pledged to strengthen independent evaluation of its models and signed the White House Accord on Super Intelligence, in which companies agreed to cooperate with external auditors. Over the past year, METR has already reviewed the company's Risk Reports several times. Now the format changes: METR goes from external reviewer to observer inside the process.

How the access works

Anthropic's argument is simple: it cannot publish everything. Some information would help malicious actors, and some is commercially sensitive, such as data on compute capacity and training. So instead of disclosing everything publicly, the company proposes to show everything to independent experts, who then lay out their conclusions and evidence. Anthropic's goal is to narrow the gap between what evaluators understand about its systems and what the company itself understands. It compares the arrangement to bank supervision, where regulators place resident examiners inside the largest banks. The analogy is imperfect, the company notes, but the logic is similar.

The terms for METR look like this:

• six staff members with corporate hardware and an office;
• access to internal tools at roughly the level of Anthropic's own risk-assessment teams;
• exclusions: customer data, information under attorney-client privilege and details of model architecture;
• the right to publish analysis of risks, incidents and practices;
• Anthropic's right to require only redaction of data in narrow, predefined categories.

If METR considers a redaction unjustified, it can say so publicly without revealing the withheld information itself. METR's other staff, including researchers working with Anthropic on other projects, are walled off from this team. The work proceeds under binding agreements and Anthropic's security standards.

Independence criteria and the three levels

Anthropic sets out four requirements for an evaluator: expertise (including an understanding of how evaluations break, for example through alignment faking), independence (no company stock and no financial or operational dependence), sufficient access (not only to the newest models, but also to how they were trained and how safeguards work) and freedom to publish observations.

Besides METR, the company works with SecureBio and Accenture and is holding preliminary talks with several other organizations, including Hugging Face. These partners get less information and fewer publication rights: Anthropic first wants to confirm that they protect confidential data and have the resources to evaluate. To that end, it introduces three access levels. At the first, evaluators conduct narrowly scoped risk investigations, Anthropic determines the scope of access, and publication is possible only with its approval. At the second, publication rights expand (in the available fragment, the description of this level cuts off). At the third, the company hopes, there will eventually be several evaluators, each publishing its own analysis of Anthropic's risk position and key decisions.

What to check in practice

The main question is no longer the scheme itself but how it is carried out. Outside observers should watch three things. First, METR's first report: how specific it is and how much it redacts.

Second, METR's comments on whether the redactions were justified, since that mechanism is what replaces a veto. Third, how the other partners move through the levels: if SecureBio or Accenture stay at the first level, the scheme will turn into ordinary outsourced auditing. The exclusion of model architecture details also deserves attention: it limits the depth of any evaluation.

For other labs, this template will become a reference point: if Anthropic holds up while publishing uncomfortable findings, similar terms will start to be expected of the other signatories of the accord.