Anthropic Gives 6 METR Researchers Access—and Loses Its Publication Veto

More access isn't the most important part of Anthropic's new oversight deal. Losing control of the published verdict is.

AI companies already invite outsiders to test models. The uncomfortable question comes afterward: who decides what the public gets to read?

On October 15, Anthropic announced an arrangement giving six METR researchers employee-like internal access—and no company veto over their published assessments. That's the part that gets me excited. A safety report becomes considerably more interesting when the subject doesn't hold the publish button.

Six laptops, one consequential permission change

According to Reuters, the six METR employees receive Anthropic-issued hardware, office space, and internal tools and systems broadly comparable to those used by Anthropic's risk-assessment teams. Their scope includes models, safety practices, risk management, and incidents.

This isn't unrestricted access. Architecture information is generally excluded, with highly relevant details requiring explicit internal approval. Anthropic can require redaction of specified confidential information, including customer data, privileged legal material, and certain architecture details.

But METR can publicly describe redactions and dispute their justification without exposing the protected information.

Anthropic's three-tier framework makes the difference concrete. Tier 1 investigations require publication approval. Tier 2 removes that approval requirement, subject to categorical redactions. METR's Tier 3 adds employee-like access to those publication protections.

So when a vendor says externally evaluated, ask which version. Those words cover very different arrangements.

The useful friction already happened

METR's earlier review of Anthropic's Summer 2025 Pilot Sabotage Risk Report shows what outside scrutiny can accomplish.

The evaluator agreed with the report's overall low-catastrophic-sabotage-risk conclusion for Claude Opus 4. It also challenged arguments about hidden reasoning and monitoring reliability. After METR questioned training pressure on chain-of-thought reasoning, Anthropic investigated, found that pressure might not have been negligible, and revised its report.

That's useful friction. Not a ceremonial thumbs-up. Someone challenged an assumption, and the document changed.

That earlier review still went through Anthropic's publication review; METR said Anthropic made no modifications. The new arrangement removes the approval gate rather than relying on the company to leave it open.

The Elephant in the Room

An embedded evaluator still works inside someone else's house.

Anthropic controls the environment. Confidentiality restrictions constrain what outsiders can inspect publicly. METR's October 14 proposal explicitly acknowledges access limitations and the inability to fully protect against retaliation for adverse findings.

Then there's proximity. Spending your workdays alongside a company's engineers makes their constraints understandable—and their assumptions easier to absorb. No cartoon villain required. Shared lunch tables will do.

This remains voluntary oversight, not a regulatory inspection or a safety certification. As of October 16, there is no completed assessment under these new terms demonstrating how the arrangement performs under pressure.

I still think it's a substantial improvement. Independence needs mechanisms, not declarations, and a publication right is a real mechanism.

Your agent's explanation isn't an audit log

For developers, the interesting lesson extends beyond Anthropic procurement.

METR's proposal asks whether agents attempt harmful actions, whether controls detect and stop them, and whether AI-assisted research outpaces the ability to safeguard it. That's a much better engineering conversation than comparing benchmark decimals.

For an agent with repository access, shell tools, or deployment credentials, I'd want answers to:

• Which actions are logged outside the agent's control?
• Can it bypass or interfere with monitoring?
• Does an alert trigger intervention before damage spreads?

Readable reasoning is evidence, not a guarantee. Check tool calls, permissions, network activity, and changed artifacts. The friendly explanation isn't the filesystem.

Anthropic deserves credit for accepting scrutiny it cannot simply veto. But the decisive artifact won't be six badges or a partnership announcement.

It'll be the first uncomfortable METR report—and what Anthropic does after everyone reads it.