Anthropic said on October 15 that it has placed six researchers from an outside evaluation group inside the company with employee-level access, and that they may publish what they find without the company’s approval.
The researchers are from METR, a nonprofit that evaluates frontier artificial intelligence models. They receive company laptops, working space and access to the tools used by the internal risk team that assesses whether a model is safe to deploy. Staff were told to share information with them as they would with colleagues, according to the company’s account of the arrangement.
The comparison the company offered is to how central banks station examiners inside large banks. Supervisors with offices on site see the transactions, the internal arguments and the escalation decisions that never appear in a filing, and their presence changes the behavior of the people they sit near. That is the mechanism Anthropic says it wants.
The company gave up the right it would ordinarily hold. Under the arrangement, METR publishes its own assessments of risks and incidents, and Anthropic waives the review that a company usually retains over material about itself. The exceptions are pre-defined and narrow: customer data, information covered by legal privilege and details of model architecture.
Desensitization became a negotiable item rather than a unilateral decision. METR may state publicly whether the redactions it accepted were reasonable, which turns each withheld item into a documented disagreement. A reviewer that can describe the shape of what it could not see gives readers a way to judge the assessment’s limits.
The commitment traces to an article published in September by chief executive Dario Amodei, and the company has said more evaluation partnerships are in progress. OpenAI indicated it would follow with something similar, and Elon Musk said his rocket company might do the same, which is how a practice spreads before any of it is required by regulation.
The value of the arrangement depends on what employee-level access actually opens. A staff badge grants a laptop, internal documentation, the internal chat and the tools that monitor deployments. It does not grant access to training data permissions, to financial systems or to the process by which a model’s behavior is shaped after pre-training. The narrow categories the company reserved are exactly the ones where independence is tested.
Evaluators face an incentive problem of their own. An organization that publishes findings a company dislikes puts the arrangement at risk, and one that finds nothing new becomes part of a marketing exercise. The nonprofit’s funding, its governance and its willingness to publish uncomfortable results are the variables that determine whether the access produces information or reassurance.
The published findings will also be read by regulators and by plaintiffs. The Federal Trade Commission has demanded records from the company on safety incidents and protective measures, and state attorneys general have sued a competitor over product behavior. An independent assessment that appears in public becomes evidence in those proceedings, which is a reason a company might want the review and a reason it might want it limited.
Researchers who work on model evaluation have argued that third-party testing has been constrained less by skill than by access. The organizations capable of designing the right experiments have existed for several years, and they have mostly been given hosted access to finished models rather than a seat inside the process. Moving the evaluator into the building addresses the constraint directly.
There is a historical parallel in research ethics. Institutional review boards became mandatory for human-subject research after the harms of unregulated experimentation became public, and they work because the reviewer has authority over a study rather than an advisory role. The version here gives the reviewer a publication right instead of a veto, which is a weaker instrument aimed at the same problem.
Analysts said the arrangement will be judged by its first publication and by whether the relationship survives one. Reviews that produce only confirmations invite the question of what the access was for, and reviews that produce uncomfortable findings test whether the company meant what it said. Both outcomes are informative, and only one of them can be verified from the outside today.
The arrangement also creates a record that persists. Notes, findings and internal correspondence held by an outside organization do not disappear when a relationship changes, and a company that later restricts access cannot reclaim what was already shared. Those documents become searchable in litigation discovery, which is part of the cost of inviting outside reviewers in.
The arrangement also has an internal effect that is difficult to measure and central to the argument for it. Engineers who know that a reviewer can read their incident reports write those reports differently, and teams that expect scrutiny build evidence into their processes rather than reconstructing it afterward. That change in behavior is what supervisors stationed inside institutions are for.
