Anthropic Gave METR Employee-Like Access. What the Three Tiers Say, and What They Do Not Tell Builders

On October 15, Anthropic said it has started giving a team from METR, a nonprofit that evaluates frontier AI models, employee-like access to its internal systems. METR will publish its own analysis. This article covers what Anthropic's post says and where its limits are.

This is Anthropic describing its own arrangements. I have not seen METR's side or any published METR analysis under this arrangement, so I treat the terms as Anthropic's account.

What Anthropic announced

According to the post:

• Last month Anthropic committed to stronger independent, third-party assessment of its models and safety practices, and signed the White House Accord on Super Intelligence, in which companies pledged to partner with independent external auditors or evaluators.
• It has onboarded six METR employees with company hardware, office space, and access to internal tools and systems roughly on par with its own risk assessment teams.
• METR will publish its analysis of Anthropic's risk levels, incidents or practices.
• Anthropic is also working with SecureBio and Accenture as evaluators, and is in early discussions with several others, including Hugging Face.

Anthropic's stated reason: it cannot publicly share all safety-relevant information, since some could help malicious actors or is commercially sensitive, such as compute or training information. So it gives evaluators deep access and has them publish evidence and conclusions.

The three access tiers

Anthropic says it is developing three tiers:

1. Tier one. Narrowly scoped risk investigations. Anthropic decides the access, and evaluators publish findings with Anthropic's approval.

2. Tier two. Evaluators can publish without approval and have access to more information. Anthropic can still require removal of specific categories of information, and evaluators can publish their views on whether the redactions were justified.

3. Tier three. Employee-like access with publication rights similar to tier two. This is the arrangement described for METR.

Per the post, SecureBio is reviewing the chemical and biological weapons chapter of Anthropic's August Risk Report, after publishing a pilot review of the previous one. Accenture and Faculty are described as a partnership that includes evaluating and red-teaming models, alignment assessments, safeguard testing and capability building.

The limits Anthropic states

The post is explicit about boundaries, which is worth reading closely:

• Employee-like access excludes a small number of defined categories, with examples given: customer data, attorney-client privileged information and information about model architectures.
• Anthropic cannot veto METR's publication, but can require redaction of information in those predefined categories. Anthropic ultimately decides what falls into them. METR reserves the right to make certain statements about the level of access and information it received.
• The METR engagement is limited to a small team under enforceable agreements, and other METR staff are siloed from that team's work.
• Two footnotes say they were updated on October 15 and 16 to clarify the current project terms with SecureBio and METR.

The post lists four things Anthropic says evaluators need: expertise, independence (no equity in, and no financial or operational dependence on, the company), enough access, and freedom to publish. It uses bank supervision, with resident examiners, as an analogy and says the analogy is not exact.

How a builder might read this

These are my own reading and untested suggestions, not Anthropic's claims.

1. Watch for the publications, not the announcement. The value depends on what METR and the other evaluators publish, and what gets redacted. The post commits to publication but gives no dates.

2. Check independence criteria yourself. Anthropic lists no equity and no financial or operational dependence as criteria. Accenture is described as a partner in a broader capability-building arrangement, so how that fits the independence criterion is something to read for, since the post does not discuss it.

3. Look at who decides redactions. Anthropic decides which information falls into the redaction categories. Evaluators can comment on whether redactions were justified at tier two and above.

4. Keep your own testing. An external review of a lab's risk report is not a test of your application on your data.

What I would not conclude

• That any Anthropic model has been assessed as safe or unsafe. The post announces access and process, not findings.
• That other labs do or do not do this. The post says every frontier company should, but does not describe others.
• That the access is unrestricted. By the post's own terms it has defined exclusions.

Frequently asked questions

What did Anthropic announce?

That it has started giving a team from METR employee-like access to its information, and that METR will publish its own risk analysis.

How many METR people are involved?

Six METR employees have been onboarded, per the post.

Can Anthropic block METR from publishing?

The post says Anthropic cannot veto publication, but can require redaction of information in predefined categories.

What is excluded from access?

Examples given are customer data, attorney-client privileged information and information about model architectures.

Who else is evaluating?

SecureBio and Accenture, with early discussions with others, including Hugging Face.

What are the three tiers?

Tier one is narrow investigations published with Anthropic's approval. Tier two can publish without approval but with redactions possible. Tier three is METR's employee-like access with tier-two publication rights.

Does this change what I should do as a builder?

The post does not address builders directly. My suggestion is to read the published evaluations when they appear and keep testing your own use cases.

Sources

• Anthropic, An update on independent evaluators (October 15, 2026, footnotes updated October 15 and 16): all claims above.