Anthropic Gives Outside Researchers Employee-Level Access to Check Its AI

Anthropic has given six researchers from METR employee-level access to independently assess its models, safety practices and risk management.

The company described the arrangement on Oct. 15, 2026. The six received Anthropic-issued laptops, office space and access to internal tools roughly on par with Anthropic's own risk assessment teams, according to TechCrunch and Anthropic.

METR will publish its own assessments of Anthropic's risks, incidents and practices. Anthropic cannot block or veto publication. It can require redaction only in narrow, pre-defined categories, including customer data, attorney-client privileged material and model architecture information.

For context on why those publication rules stand out, independent checks of frontier systems, the most advanced AI models, have usually meant outside access through an API, a fixed set of tests and a joint decision on what gets disclosed. Here METR controls the write-up. The categories that can be removed are set in advance. Everything else can be published.

METR is so far the only evaluator in the top tier of Anthropic's three-tier evaluator system. The company has not named others at that level.

The access model follows earlier tests. An embedded evaluation partnership with Accenture, described on Sept. 18, placed evaluators inside AI companies with access comparable to an employee's. A Sept. 9 alignment assessment tied to cybersecurity incidents gave METR wide-ranging access, including to transcripts from beyond the period when the incidents occurred. In March, Anthropic provided substantial access to relevant internal systems and information and made staff available to answer questions for METR's red-teaming, or adversarial testing, of Anthropic's internal agent monitoring systems. On Sept. 15, Anthropic employees were permitted to share confidential information with METR as part of its independent investigation.

Other access tracks remain separate. An expanded Cyber Verification Program announced Oct. 6 makes advanced cyber capabilities and reduced blocking classifiers, or filters that stop certain risky outputs, available to qualifying security professionals. That program covers defensive use. The METR arrangement covers oversight.

A note on language helps here, because METR, a nonprofit that evaluates frontier AI models, said in an Oct. 13 proposal on better informing the public about loss-of-control risks, where an AI system acts outside human control, that it does not require true employee-level access as defined in a recent public letter. The Oct. 15 arrangement uses employee-level and employee-like language to describe laptops, workspace, tooling and internal contacts. The difference raises a practical question for evaluation design, what level of access is enough to see failure modes, incident handling and risk management as they actually work, rather than as they appear through a testing interface.

The broader context here is that evaluation of the most advanced systems is shifting from model testing toward organizational inspection. Capability benchmarks, or standard performance tests, and red-team prompts can show what a model does. They show less about detection, escalation, patching, access controls and internal incentives. Those details live in logs, tickets, transcripts, postmortems and day-to-day conversations. It is the difference between tasting a finished dish and watching how the kitchen handles a bad night. Access roughly on par with internal risk teams is an effort to bring those details into scope without making the evaluator an employee.

In my view, the publication and redaction terms will decide whether this becomes a useful template. Employee-level visibility without independent publication is secondment. Publication without sufficient access is commentary. Anthropic has paired the two, with redactions limited to customer data, legal privilege and architecture detail. For practitioners, the test will be concrete. Do reports include incident timelines, tool limitations and disagreements about risk, or only summary judgments. Do redactions stay narrow in practice. Do findings change deployment decisions, monitoring investments or disclosure habits.

Worth flagging is the operational cost. Embedding six external researchers with internal tooling, staff time and confidential information flows is heavier than granting tokens or API quotas, which Anthropic, OpenAI and xAI have previously provided for METR evaluations, research and engineering. It also creates new insider-risk and information-boundary problems that have to be managed case by case. That cost explains why only one evaluator sits in the top tier so far. It also suggests this model will spread selectively, for deep dives rather than routine checks.

On the optimistic side, better visibility should produce better public information about how frontier systems fail and how labs respond. If METR can document risks, incidents and practices from inside, with the ability to publish, other labs and enterprise adopters get a clearer basis for their own controls around agentic systems, monitoring and incident response. That outcome depends on execution, not on access alone, but access of this kind makes that execution possible.