Anthropic has granted the nonprofit evaluator METR “employee-like access” to its AI models and internal systems, embedding a team of outside researchers inside the company in one of the most concrete third-party safety arrangements a leading AI lab has disclosed to date. The move follows through on a commitment the Claude maker has made to expand external scrutiny as concerns mount that increasingly capable systems could cause catastrophic harm — whether through cyberattacks, economic disruption or loss of human control.

According to reporting by Ars Technica, METR now has a team embedded in Anthropic’s offices with access to its hardware and internal systems. Unite.AI reported the team comprises six evaluators. MSN, summarizing the arrangement, reported that METR holds an unconditional right to publish its findings — meaning the lab cannot block or veto a negative assessment.

What the arrangement actually involves

METR — Model Evaluation and Threat Research — is a nonprofit founded in 2021 that has carved out a niche as an independent assessor of frontier models. It has previously worked with OpenAI, Anthropic, Google and Meta, and is best known for designing task-based evaluations that test whether models can autonomously carry out dangerous capabilities, such as replicating themselves across servers or acquiring resources in ways that could evade oversight.

The distinction between “access” and “employee-like access” is the crux of the announcement. Historically, external evaluators have received API keys and limited, sandboxed access at arm’s length — enough to run prompts, but not enough to observe how a model is trained, how safety filters are tuned, or how internal decisions get made. An embedded team with access to internal systems and hardware sits materially closer to the engineering process.

“Employee-like access” — with an unconditional right to publish findings — is the phrase that defines the arrangement: access close to full-time staff, paired with a publication right the company says it cannot override.

Anthropic has not disclosed the precise scope of what the evaluators can see, how long the arrangement runs, or how disputes over publication would be resolved — gaps that independent observers are likely to press on.

Why third-party evaluation is the new battleground

A greater role for outside evaluators has become one of the few concrete proposals labs have coalesced around in response to rising concern about frontier model risk. Self-assessment — a lab testing its own systems and reporting its own results — is widely viewed as insufficient, both by regulators and by safety researchers who argue that the entity with the strongest commercial incentive to declare a model safe should not be the sole gatekeeper.

Anthropic’s Responsible Scaling Policy, introduced in 2023, established a tiered framework of “AI Safety Levels” with if-then commitments: if a model crosses a capability threshold, the company pledges to apply stricter safeguards before deployment. External evaluation is the mechanism that is supposed to verify those claims rather than take them on faith. Rival labs have built parallel structures — OpenAI’s Preparedness Framework and Google DeepMind’s Frontier Safety Framework — and governments have entered the field, with the UK AI Safety Institute and its US counterparts negotiating pre-deployment testing access.

Skeptics: embedded is not the same as independent

Not everyone reads the news as a breakthrough. A recurring critique is that “employee-like access” cuts both ways: an evaluator working inside the building, reliant on the company’s goodwill for access and cooperation, may be structurally less inclined to deliver a harsh verdict than one operating entirely outside it. The publication right is meaningful only if findings are specific enough to be checked, and if the evaluator can publish the underlying methodology without the lab’s input.

There is also the question of coverage. METR’s evaluations tend to focus on specific, measurable dangerous-capability thresholds. Critics of the current evaluation paradigm argue that the most worrying risks — subtle misalignment, deceptive behavior, gradual erosion of human oversight — are precisely the ones that resist clean benchmark measurement. METR’s own collaboration with Apollo Research on “in-context scheming” in frontier models was notable for suggesting that models can, in contrived settings, take actions designed to evade oversight; such findings are exactly the sort that a lab might prefer stayed unpublished.

And a single nonprofit cannot audit an entire industry. With six people embedded at one company, the arrangement is a template as much as a solution.

How different outlets framed it

Coverage of the announcement split along familiar lines. Ars Technica positioned the news within the broader arc of safety commitments, framing external evaluators as the industry’s principal answer to catastrophic-risk concerns. Business-facing outlets, including Seeking Alpha, treated it as corporate-governance news — a lab adjusting its risk posture. MSN’s coverage emphasized the mechanics and, above all, the unconditional publication right, which is the provision most likely to determine whether the arrangement has teeth. Unite.AI focused on the size and shape of the team: six evaluators, embedded.

What to watch

  • The first published report. Whether METR’s findings are detailed, methodologically transparent and critical will matter more than the access agreement itself.
  • Precedent. If Anthropic’s model works, expect pressure on OpenAI, Google and Meta to match it — and for regulators to cite it as a minimum standard.
  • Policy backdrop. The EU AI Act’s general-purpose model obligations and California’s frontier-model transparency law are pushing labs toward auditable third-party testing; voluntary deals may become de facto compliance.
  • Scope creep — or its absence. Access granted during evaluation but revoked at deployment, or confined to a narrow set of benchmarks, would undercut the announcement’s significance.

For now, the arrangement is best understood as an experiment in institutional design: a bet that proximity plus a publication right can produce scrutiny that is rigorous without being adversarial. Whether that bet pays off will be judged not by the access granted, but by what the evaluators say once they are inside — and whether the company lives with it.