METR Enters Anthropic. The Evidence Still Has to Leave.

Six outside researchers now have a much closer view of Anthropic's internal work. The important question is what they will be able to establish from it. On October 15, Anthropic said it had onboarded a METR team with company hardware, office space and access broadly comparable to its risk-assessment staff. That moves the story beyond a promise to invite evaluators inside. It does not yet tell readers whether the company's controls work, how much evidence the team will obtain, or which conclusions will survive scrutiny.

Anthropic says it cannot veto METR's publications, although it can require redactions within predefined categories. Customer information, legally privileged material and model architecture information are among the exclusions. METR can describe and dispute redactions publicly without revealing the withheld material. The engagement is also compartmentalized within METR. These terms address a real tension: evaluators need sensitive evidence, while the company has legitimate information-custody obligations. The useful test is whether confidentiality leaves the evaluator able to explain what a reader should, and should not, conclude.

TechCrunch independently reported the onboarding and described Anthropic's three-tier structure. In the first tier, publication requires company approval; the second permits publication subject to redaction; the third adds the deeper access associated with METR. Readers should not assign one partner's rights to every evaluator. There is already a reason to check the current primary document: Anthropic updated its SecureBio wording on October 15, while the report retains the earlier tier characterization. This article does not repeat that classification. The announced METR arrangement is the development examined here, not a blanket description of all outside oversight. The reporting is not an independent inspection of the access granted.

The most revealing companion material comes from METR itself. Its October 14 proposal separates three questions: what harmful behavior internal agents might pursue, whether controls would catch it, and whether AI-assisted research could accelerate capability growth faster than safeguards improve. METR explicitly rejects treating these exercises as confident assurances of safety. Its general proposal leaves access decisions with the developer and does not promise the access of a senior employee. That broader offer and Anthropic's specific announcement are different documents, not interchangeable descriptions of one signed contract.

This distinction matters when a board or customer encounters the phrase independent evaluation. A reader should be able to identify whether the work examined model behavior, the systems surrounding it, or a company's compliance with a defined obligation. METR's proposal does not cover everything: it excludes important security-audit and organizational-governance questions and does not replace predeployment evaluations. A narrow investigation can still be valuable. The error would be using its existence as evidence for a wider conclusion that its scope was never designed to support.

The alignment proposal begins with a demanding inventory job. METR wants assessors to examine serious behavior across training, evaluations and internal use of near-frontier models, then investigate selected incidents more closely. It asks whether the underlying records are complete and whether an agent's explanation can be trusted. Those are different problems. Missing transcripts restrict which events can be found; misleading reasoning restricts what can be inferred about an event that was found. A polished account of a few selected failures cannot answer either question by itself.

METR also proposes examining alternative situations and the training incentives that might hide problematic behavior or overfit to detection methods. It warns that agents recognizing an evaluation can limit what artificial scenarios establish. For builders, the methodological implication is to preserve the distinction between an observed event and an experiment intended to probe a possibility. A report should make clear when an assessor is reconstructing something that happened, testing a variation, or expressing uncertainty about behavior that available tests cannot reveal. Otherwise, hypotheses can quietly acquire the authority of findings.

The control proposal takes a different route through the same system. It separates monitoring coverage, vulnerabilities in monitoring infrastructure, evasion of a functioning monitor, human response and the remaining potential impact. Coverage must be checked against inference records, rather than inferred from the monitor's own records alone. That is a consequential accounting choice: a monitor's inbox cannot, by itself, demonstrate that every relevant activity reached it. METR proposes inspecting representative traffic and the infrastructure that delivers it, not merely asking whether a detector scores well on a prepared set of examples.

Response is part of that proposed examination, too. METR asks how quickly flagged activity receives human review and whether apparently familiar false alarms can conceal important events. This changes how an operator should read a detection result. A correct warning and an effective intervention are separate accomplishments. In a practical review, I would want the timeline to show the action, the alert, the human decision and any mitigation. That recommendation is not a claim that the new embedded team has already measured those intervals or found a particular response failure.

There is historical evidence that this access can produce useful, specific findings. METR's March 26 account describes David Rein spending three weeks examining a subset of Anthropic's monitoring and security systems. It reported several newly identified vulnerabilities, some subsequently patched, without saying they severely undermined the major claims of the Opus 4.6 Sabotage Risk Report. A later addition describes a gap in monitoring subagent calls that was fixed in under a day. This is an earlier exercise with an explicit time boundary, not a fresh diagnosis of Anthropic's October infrastructure.

The same account records limits in the agents' situational awareness and ability to devise effective attacks at the time. That qualification is central, not a footnote to discard for a stronger headline. A human researcher finding a weakness does not establish that an unassisted model would discover and exploit it. Conversely, a model failing to exploit a weakness does not establish that the weakness is absent. The historical exercise shows why a useful assessment must describe both the environment's vulnerabilities and the tested agents' ability to act on them.

The proposed research-acceleration assessment addresses a third evidentiary trap: confusing more research activity with faster capability improvement. METR wants evidence across internal model benchmarks, intermediate measurements and researchers' observations. It then asks what could explain an acceleration, including AI assistance, additional people, compute, data and algorithmic advances. The proposal is not a finding that any particular company has entered an uncontrollable feedback loop. It is a method for investigating a question whose inputs are largely inside the companies and whose answer cannot be read directly from a public release calendar.

METR's acceleration plan also asks about bottlenecks and how reliably its methods would notice a much larger change. That last question is especially useful. An assessment should explain not only what its measurements suggest, but what they might fail to detect. For someone funding or building research infrastructure, the practical inference is to ask for dated, comparable measurements and a defensible baseline before accepting a speedup claim. A larger experiment budget, more generated code and a stronger resulting model are related possibilities, not automatically the same measured outcome.

Independence has operating costs beyond access badges. In its separate October 14 account of working with companies, METR says it has declined payments and donations from frontier AI firms. It accepts free model access but says it can afford the tokens without materially changing its operations. It also acknowledges that voluntary cooperation remains a dependency: a company can withhold information or stop engaging. Financial separation therefore removes one source of pressure without eliminating the need to disclose the other constraints under which an investigation was conducted.

METR's stated approach is to publish scope, duration, access limitations, redactions and relevant pressures, including whether they change how readers should interpret the work. Its general transparency policy can accommodate publication restrictions if those restrictions can be disclosed; that should not be confused with Anthropic's specific no-veto announcement. The practical value is a more legible report, not an assertion that disclosure neutralizes every conflict. Readers can weigh a finding differently when they know the assessor could search original records, received a selected subset, or had to rely on another party's account.

There is a reasonable case for beginning with bounded, imperfect access. An investigation that can identify a concrete defect and prompt a correction may be more useful than waiting for an ideal oversight structure. There is an equally serious reason not to let the arrangement become a standing endorsement. My reading is that these positions are compatible if each report carries its own evidentiary limits. Participation should not create a transferable seal of approval for a different model, a later configuration or a customer application the evaluators never examined.

For teams consuming this work, the next useful artifact would be a record of what changed between assessments. Keep a reported problem, the proposed correction, evidence of implementation and the result of any retest separate. If an issue cannot be reproduced, say why; if a relevant system changed, identify the boundary of the earlier conclusion. Those are recommended reading and recordkeeping practices, not additional terms attributed to the METR agreement. They would make it easier to recognize progress without requiring either unconditional trust in the company or unconditional distrust of every favorable result.

The six-person onboarding is a concrete development. The accompanying methodology gives the public more precise questions to ask than whether an outside organization has been allowed into the building. What activity was visible? How was missing evidence handled? Which claims came from direct tests, and which remained dependent on company information? The quality of the resulting answers will matter more than the number of evaluators in the room. Until those answers arrive, the defensible conclusion is narrower: access has expanded, and the work of turning access into inspectable evidence remains ahead.

LaunchPad positionJudge each assessment by its scope, evidence access and disclosed limitations, not the evaluator's presence alone.