Anthropic's METR Access: What Independent AI Reviews Can Prove

Anthropic announced on October 15, 2026 that six employees of the nonprofit evaluator METR have begun receiving employee-like access to parts of the company. That is more substantial than giving an external group a model API key, but it is not a published safety certification. The practical question for anyone relying on frontier AI is what the evaluators can inspect, what they can disclose, and which decisions remain under the developer's control. Anthropic updated a clarification of the publication terms on October 16.

What six embedded evaluators can access

Anthropic says the six METR employees have company hardware, office space and access to internal tools and systems roughly comparable to its own risk-assessment teams. Its employees are encouraged to share relevant information with them, subject to defined exclusions. The exclusions include customer data, attorney-client privileged material and certain model-architecture information. Access to some particularly relevant restricted information may require additional internal approval. 'Employee-like' therefore describes an embedded working arrangement, not unrestricted access to every system or document.

Publication rights—and the redaction limit

The arrangement gives METR room to publish its analysis of risks, incidents and company practices. Anthropic says it cannot veto a publication outright. It can, however, require redactions in predefined sensitive categories, and Anthropic ultimately decides what fits those categories. METR retains a right to comment on the level of access and information it received. These details matter because a report can be independent in its conclusions while still having an incomplete view of confidential evidence.

METR's standard for credible evidence

METR's own October 14 policy statement explains why independence cannot be judged from a partner announcement alone. The nonprofit says its reports should describe the scope and duration of an engagement, access limits, relevant redactions, conflicts of interest and pressures that could affect conclusions. It aims to disclose evidence and methods sufficiently for outside scrutiny, and it does not treat its role as deciding whether an AI company should release a model.

The distinction between access and assurance is essential. Anthropic has announced an evaluation process; it has not, in that announcement, released the future findings of the embedded METR team. No specific Claude model was certified safe by the October 15 post. An organization deciding whether to deploy an AI agent should not translate 'METR has access' into 'the model passed an independent audit.' Instead, watch for a report identifying the model or system assessed, the threats tested, the evaluation period and the evidence supporting its conclusions.

Three tiers of third-party evaluation

Anthropic describes three access tiers. Tier one consists of narrow investigations where Anthropic chooses the access and approves publication. Tier two allows publication without company approval and broader information access, though certain sensitive details may still be removed. Tier three is the embedded, employee-like arrangement with publication rights comparable to tier two. This is Anthropic's proposed structure for its evaluator partnerships, not an industry-wide regulatory standard.

The company also names SecureBio and Accenture among organizations with which it is working, while describing other partnerships as earlier-stage or more limited. That does not make their access or publication rights identical to METR's. For a meaningful comparison, readers need each project's actual scope, permitted disclosures and results, not simply a list of evaluator logos on a safety page.

A five-point review for AI buyers

1. Classify the evidence: access announcement, completed assessment, system card or audit opinion.
2. Check evaluation scope, model versions, dates, methodology and who selected the tests.
3. Read access restrictions and redaction summaries for limits that may affect conclusions.
4. Check conflicts of interest, funding and publication rights.
5. Test your own workflow's permissions, data exposure, monitoring and incident response separately.

A procurement or governance team can turn these announcements into a repeatable review. First, identify whether the document is an access announcement, a completed assessment, a model system card or an audit opinion. Second, check who selected the tests and whether the evaluator could pursue unexpected findings. Third, inspect access and redaction disclosures, especially anything that could alter the overall conclusion. Fourth, check the evaluator's conflicts and financial independence. Fifth, map the findings to the organization's own workflow: tool permissions, data exposure, monitoring and incident response. A broad model-risk review does not automatically test a particular CRM agent or customer-data integration.

What remains unverified

The most important unresolved question is what METR will actually conclude after using this deeper access. Its October 14 policy acknowledges that voluntary evaluations remain dependent on companies supplying information and allowing publication, and that some evidence may be impossible to verify fully. Anthropic's October 15 agreement may reduce those limitations, but the degree of improvement should be assessed from METR's eventual disclosures. Until then, the credible headline is expanded third-party access with defined boundaries—not proven safety.