Anthropic Gives METR Employee-Like Access: Six Staff, Three Evaluator Tiers

Anthropic has started giving a team from METR, the nonprofit that evaluates frontier AI models, employee-like access to its internal systems. In an announcement on October 15, 2026, the company says it has onboarded six METR employees with company hardware, office space and access to internal tools roughly on par with what its own risk assessment teams use. METR will publish the results of its risk assessments, and Anthropic says it cannot veto them.

This follows the commitment Anthropic made last month to stronger third-party assessment, and the pledge in the White House Accord on Super Intelligence that companies would partner with independent external auditors or evaluators. It is also the first concrete version of what METR itself proposed a day earlier in its embedded assessments framework.

TL;DR: what the post actually says

Why does Anthropic want outsiders inside?

The company's own explanation is that it cannot publish everything relevant to safety. Some information could help malicious actors, and some is commercially sensitive, such as compute or training information. So instead of publishing it, Anthropic says it will give evaluators deep access and have them share evidence and reasoned conclusions. The stated aim is to "close the gap between what evaluators understand about a frontier AI company's systems and what the company itself understands."

Anthropic lists four things an evaluator needs: expertise (including knowing how evaluations go wrong, for example through alignment faking), independence (no equity in the company, no financial or operational dependence), enough access to see training and safeguards, and the freedom to publish.

It also offers an analogy: bank supervisors place resident examiners inside the largest banks because banks know more about their own risk than outsiders do. The company notes the analogy "isn't exact."

What does "employee-like access" mean in practice?

According to the post, Anthropic employees are encouraged to share information with METR staff "just as they would with a fellow employee working on alignment risk," outside a small number of defined categories. The METR team operates under enforceable agreements and is siloed from other METR staff, including researchers who work with Anthropic on other projects. Anthropic stresses this is not a way for other organizations to obtain its information or that of customers and partners.

METR has already worked with Anthropic on several reviews of its Risk Reports over the past year. Anthropic's August 2026 risk report is one of the documents that outside reviewers have been examining.

The three tiers

Anthropic says it is building three tiers of access, and hopes eventually to have several evaluators at the third.

1. Tier one: narrowly scoped risk investigations. Anthropic decides what access to give, and findings can be published with its approval.
2. Tier two: evaluators can publish without approval and see more information. Anthropic can still require removal of specific categories, and evaluators may say whether they think the redactions were justified.
3. Tier three: the METR arrangement, with employee-like access and publication rights similar to tier two.

SecureBio is currently in tier one. It is reviewing the chemical and biological weapons chapter of the August Risk Report after completing and publishing a pilot review of the previous report. Anthropic says it will consider more access afterwards.

Where does Accenture fit?

Accenture and Faculty are described as partners in "an ambitious partnership" covering evaluating and red-teaming models, alignment assessments, testing safeguards, and building capabilities across the organizations. That connects to the earlier Anthropic and Accenture $1B each commitment to embedded evaluation.

Separately, on the same day 404 Media published a report headlined that Accenture is telling employees they can now spend only $29 per month on Claude, with some staff reportedly spending up to $1,000. We could only see the headline and summary, not the full article, so we cannot confirm details. The two stories involve the same two companies but are different things: one concerns safety evaluation, the other reportedly concerns internal tool budgets. Anthropic's post does not mention the spending report.

What does it not settle?

• Independence is partial. Anthropic chooses evaluators and tiers, and METR's team works under agreements Anthropic helped set. The post says evaluators should not depend financially on the company, but independent verification of that is outside the post.
• Architecture is mostly off the table. Anthropic says architecture information has high leak risk and typically low relevance to risk assessment. Critics may reasonably disagree for some risk questions.
• Redaction is a lever. Anthropic cannot veto, but narrow-category redactions can still shape what readers see. The safeguard is METR's freedom to characterize redactions publicly.
• No results yet. Nothing has been published from the embedded team. The value will depend on what METR reports.
• It is voluntary. Regulators have started probing labs, as in the EU AI Office probes of OpenAI and Anthropic, and political scrutiny is rising, for example the NYC comptroller's letter urging Anthropic to pause an IPO. A voluntary arrangement does not bind other labs.

How does this compare with what METR proposed a day earlier?

METR's embedded assessments proposal framed the question around three areas: alignment, control of internal agents, and AI R&D acceleration. It said plainly that such assessments are not a safety guarantee or formal oversight. Anthropic's post is the supply side of that idea. It describes who gets in, what they can read, and who controls the pen when a report is written.

The two documents agree on the central trade-off. Insiders know more than outsiders, and the usual fix, publishing everything, runs into security and commercial limits. The answer both point to is a small number of qualified outsiders working under confidentiality, with a public record of their conclusions. What differs is emphasis. METR's framework focuses on what to measure. Anthropic's post focuses on the contract terms that make measurement credible: no veto, narrow redaction categories, the right to criticize redactions, and no equity ties.

Questions readers are likely to ask

Is six people enough? The post does not claim it is. It describes a small team on purpose, because a small, siloed group under enforceable agreements limits leak risk. Whether six people can examine a company of Anthropic's size depends on where they look, which is why the first publication matters.

Does this change anything about the Claude models themselves? Nothing in the announcement alters a model, a price or a plan. It is a governance and transparency step. Any effect on products would come indirectly, if METR's findings lead Anthropic to change a safeguard or delay a release.

Why name Hugging Face? The post lists Hugging Face among organizations in early discussions without describing the scope. Hugging Face has recently become part of a larger industry story, as our coverage of NVIDIA's agreement to buy Hugging Face explains, so independence questions may come up if a deal with Anthropic goes further. That is our observation, not something the post says.

What would a bad outcome look like? Evaluators who are quietly constrained, reports that arrive late or heavily redacted, or a tier structure that keeps the most critical voices in tier one. The design includes a check on that: evaluators in the higher tiers can say publicly whether redactions were justified.

How should a customer read the report cadence? Anthropic says it is committed to sharing updates as it goes. Watch for dated METR and SecureBio publications rather than for further company statements, because the company's own post is the weakest evidence of whether the arrangement works.

What this means for people building with AI

If you depend on Claude for production work, the practical takeaway is modest: expect more published third-party risk analysis and, over time, more detail on incidents. For example, Anthropic's earlier alignment assessment of Mythos 5 was self-reported, and this approach is meant to add outside readers. For teams running their own agents, the same logic applies at small scale: give someone independent visibility into what the agent can do, and use runtime guardrails such as AgentBeam, the agent security platform from the explainx.ai team that stops AI agents before they take dangerous actions.

What to watch next

• The first METR publication from the embedded team, and whether it comments on redactions.
• SecureBio's review of the chemical and biological chapter, and whether it moves up a tier.
• Whether Hugging Face, named in early discussions, signs on, and which tier it lands in.
• Whether OpenAI, Google or Meta announce comparable arrangements. Anthropic says it believes every frontier company should embed evaluators voluntarily.

Related reading

• METR's embedded assessments proposal
• Anthropic and Accenture commit $1B each to embedded evaluation
• White House Accord on Super Intelligence
• Anthropic August 2026 risk report
• Anthropic alignment assessment: Mythos 5 and PyPI
• EU AI Office probes of OpenAI and Anthropic

Details are as published by Anthropic on October 15, 2026 and may change.