Anthropic gives METR an inside view—with defined access and publication limits

An outside test can still have an inside blind spot

An evaluator can run a model without seeing the processes that produced or constrained it. Anthropic’s October 15 update, clarified on October 16, attempts to narrow that information gap by giving a team from METR access closer to that of the company’s own risk assessment teams.

Anthropic says six METR employees have been onboarded with company hardware, office space and internal tools. It calls the arrangement “employee-like access,” while identifying excluded categories, including customer data, privileged legal information and model architecture information. The announcement is therefore about substantially deeper access, not an unrestricted opening of every system.

The distinction matters to any founder buying or building consequential AI products. A test result can be useful, but the ability to inspect the conditions around the test affects what the result can establish. Access to a public interface is different from access to internal safeguards and operational processes. Neither should be described as the other.

The publication boundary is part of the arrangement

Anthropic says METR will publish risk assessments and that the company cannot veto publication. It also says it can require redaction within predefined categories and ultimately decides what falls into those categories. Those two statements belong together. Omitting the redaction boundary would overstate the freedom described in the announcement.

This does not establish that a particular result has been suppressed or that the arrangement lacks value. It shows why publication rights are a substantive part of an evaluation agreement rather than a detail left until the final report is written.

An evaluator needs enough freedom to communicate a useful conclusion; a company may also have legitimate reasons to protect customer information or security-sensitive material. The practical question is how the boundary is defined and handled when the parties disagree. Readers should distinguish that governance question from an accusation about conduct that has not been evidenced.

The other partnerships have different histories and current scopes. Anthropic says SecureBio has already completed and published a pilot review of an earlier risk report. It says SecureBio is now reviewing the chemical and biological weapons chapter of its August report, with increased-access projects to be considered after that review. The prior published work and the current unfinished review are different pieces of evidence.

Anthropic also describes work with Accenture and Faculty toward a broader evaluation partnership, alongside early discussions with other organisations. Their stages and access rights should not be assumed to match METR’s. A reader needs the status of each engagement, rather than a count of names that mixes earlier published work, active reviews and preliminary discussions.

An evaluation record should therefore identify which report is already available and which assessment is still expected. The distinction is especially useful when a procurement decision depends on outside assurance now. SecureBio’s earlier published pilot can be examined on its own scope; it does not establish a result for the separate current review.

For enterprise buyers, the useful diligence question is not merely whether an outside name appears on a vendor’s website. It is which system was assessed, what the assessor could inspect, when the assessment occurred and what the published conclusion actually says. An engagement announcement does not answer all of those questions.

A framework to examine, not a safety certificate

Anthropic presents expertise, independence, meaningful access and freedom to publish as requirements for effective assessment. Those are stated principles. Their appearance in a company announcement is not independent proof that every requirement has been fully satisfied in practice.

Nor does deeper access certify a model as safe for every use. Different deployment settings create different questions, and an assessment has a scope. A buyer still needs to relate a published finding to the product version and operating context it intends to use.

A hypothetical startup evaluating a supplier could make that scope explicit in its own procurement record. It could preserve the assessment date, distinguish tested capabilities from untested ones and identify controls that remain the startup’s responsibility. That would turn a general assurance into a more useful decision record.

The October 15 announcement is significant because it changes what an outside team can potentially see. The next evidence to read is the team’s published work, including its limitations. Access is the start of an assessment process. A credible conclusion is something the process still has to produce.