They gave the auditors a desk
On Thursday Anthropic handed six researchers from the nonprofit METR company laptops, office space and the right to publish what they find without asking permission. The same day the FTC sent OpenAI and Anthropic demands running past fifty pages for their incident records and said it wants METR's executives to testify too. The people who check the labs' work are about to find out what it means to be the only ones in the room.
For most of the past year, the honest answer to "how dangerous are these models?" has been "the labs know, and the rest of us are guessing." That isn't a conspiracy. It's just where the evidence lives. The transcripts, the training runs, the internal evaluations and the things a model did at three in the morning on a test cluster all sit inside the companies, and what reaches the public is whatever the company decides to write up afterwards.
On Thursday Anthropic tried to change where some of that evidence can go. It announced that it had "started to give employee-like access to a team from METR," the Berkeley nonprofit that has spent years testing frontier models for signs that they could slip out of human control. Six METR researchers now have Anthropic hardware, desks in Anthropic's offices, and access to internal tools and systems that the company describes as "roughly on par with what our own risk assessment teams have access to." Anthropic staff, the post says, "are encouraged to share information with them just as they would with a fellow employee working on alignment risk."
The terms
The interesting part isn't the laptops. It's what METR is allowed to do with what it sees.
"METR will publish its analysis of our risk levels, incidents, or practices," Anthropic wrote. "Anthropic can't veto publication, but we can require them to redact information if it falls into narrow, predefined categories." Those categories are customer data, anything covered by attorney-client privilege, and information about model architectures. And there's a clause that matters more than it looks: "METR is free to characterize our redactions publicly, and say whether it believes the redactions were justified, as long as it does so without revealing the redacted information." So if Anthropic blacks something out, METR can still stand up and say that something important was blacked out, and that it disagrees.
Anthropic is not paying for the work, according to CNBC, and it is building three tiers of access around this arrangement. At the bottom, evaluators run narrow investigations and need Anthropic's approval to publish; the biosecurity group SecureBio sits there for now, reviewing the chemical and biological weapons chapter of Anthropic's August risk report. In the middle, evaluators see more and can publish without approval. At the top, so far alone, is METR. Accenture and Faculty are working on what Anthropic calls "an ambitious partnership" that it didn't place in any tier, which is worth noting, since Anthropic said last month that it would fund Accenture's work directly and critics immediately asked how independent a paid evaluator can be. Hugging Face, the company whose systems an OpenAI agent broke into in July, is in early talks.
The comparison Anthropic reaches for is banking. "Banks know more about their own risk positions than outsiders do, so regulators assign resident examiners to work inside the largest banks." It's a good analogy with one large hole in it, which is that bank examiners work for a regulator with legal powers, and METR works for nobody but itself. Anthropic says as much. "We're embedding evaluators voluntarily, and we believe every frontier AI company should do the same."
It's also worth remembering how recently this looked different. Reuters reported earlier this week that as late as 5 October both Anthropic and OpenAI were pushing for tight control over what their outside evaluators could publish. Ten days later, at least one of them has written down that it can't stop publication at all.
What METR thinks it's for
METR had clearly seen this coming, because on Wednesday it published a short essay called "Our approach to working with AI companies," and it reads like a set of conditions written in advance.
The organisation is careful about what it will and won't claim to be. "We see it as our role to collect evidence for the public; we do not intend to decide how companies should develop or deploy their agents." Decisions about frontier AI, it says, will be "messy, high-stakes judgment calls relying on uncertain science, which should not be made behind closed doors, much less within any one organization." It promises to publish the scope of each engagement, any limits on its access, any redactions that touched its conclusions, and "other formal restrictions and informal pressures" it was under. In a thread alongside the essay it was blunter still about what its work can deliver: "evidence, not confident safety assurance or formal oversight."
That modesty is the right instinct, because the pressure on METR is about to become enormous. The same night it published proposals for what it would actually look for inside a lab, including whether a developer's internal agents "could get away with serious harm without being caught," and how much AI is already speeding up the work of building AI.
That second question is the one the AI community on X was arguing about all Thursday. A clip of Dwarkesh Patel was doing the rounds, posted by an account that transcribes interviews, in which he described a conversation with someone at Anthropic two days earlier. "I expect AIs to match humans at AI research within nine months," the person told him, in his telling, and when he asked why, they said it wasn't just vibes but information from the inside that they couldn't share. "I think it's a terrible state of affairs," Patel said. "If they really believe this... they should make this evidence public." METR's Chris Painter quoted the clip overnight. "Ensuring that there is at least one (ideally there would be many) sophisticated structured channel via which this kind of evidence can reach the public is exactly what we see ourselves as working on."
That's the whole case for the arrangement, put plainly. If the people inside think something alarming is happening and can't say why, then somebody who can say why needs to be standing next to them.
The other letter
The trouble is that being the person in the room makes you the person everyone wants to question.
On Wednesday the Federal Trade Commission sent OpenAI and Anthropic civil investigative demands, which work much like subpoenas, as part of a consumer protection probe it opened over the summer. Axios, which broke the story, reported that each runs to more than fifty pages and asks for documents on safety incidents, internal safeguards, privacy policies and marketing materials, the last of which is the tell: the FTC wants to know whether what the companies said about safety matched what was happening. The agency confirmed the demands to CBS. According to Axios, as reported by Reuters, it also plans to compel executives at OpenAI, Anthropic and METR to testify, and to send demands to the third parties the labs' agents touched.
OpenAI said it "will engage constructively with the FTC." Anthropic didn't comment.
The FTC's chair, Andrew Ferguson, comes to this with a particular view of what went wrong. He told Reuters last month that he was tired of people talking about AI as though it had a will of its own. "If someone tells a tool to do something, and the tool does it, I don't think we would say, 'Oh, what do we do about the tool?'" In Reuters' summary of his remarks, reviews of audit trails had shown that systems described as acting beyond human control "were carrying out instructions they had been given." That is a very different theory of the summer's incidents from the one the labs and METR have been working with, and it points liability squarely at the people who wrote the instructions.
So within a single day, METR became two things at once. It's the embedded examiner that Anthropic hopes will make its safety claims believable, and it's a likely witness in a federal investigation into whether those claims were true. Those roles don't have to conflict, and METR's whole philosophy is about putting evidence in public anyway. But the agreements it has signed promise confidentiality around customer data and privileged material, and a federal subpoena doesn't much care what a nonprofit promised a company.
The price of being watched
None of this is happening in a vacuum, because Anthropic is weeks away from one of the largest stock market listings ever attempted.
On Wednesday it showed prospective investors a third quarter with $16.8 billion in revenue, up 45 per cent on the quarter, and said it was profitable on an adjusted basis. Overnight, Reuters reported that some of the investors in that room had discussed a valuation of around $1.5 trillion, a long way down from the roughly $2 trillion expected for the November sale, because growth had slowed from the previous quarter, when revenue more than doubled.
And in a letter dated Wednesday, New York City's comptroller, Mark Levine, who oversees pension funds worth more than $325 billion, asked Dario Amodei to pause the IPO altogether. His letter turns Anthropic's own words back on it, quoting Amodei's September essay that "we must slow the pace at which we improve the capabilities of AI models," and noting that the company's draft filing reportedly carries 80 pages of risk disclosures, nearly twice the length of the section describing the business. "Prudence should not only be shown with respect to the pace of the frontier," he wrote, "it should be also shown with respect to the timing of an IPO."
Read together, the day's news makes the embedded evaluators look less like a gift and more like a necessity. A company asking public markets for a trillion dollars or more, while its chief executive warns that the technology could outrun human oversight, needs some way for outsiders to check that it means it. Six people with laptops is a start on that.
Who follows
Elon Musk replied to Anthropic's announcement within hours. "SpaceX will probably do the same," he wrote, and the reply had been seen more than 160,000 times by Friday morning. OpenAI made a similar pledge last month, and Anthropic, OpenAI, Google, Meta, SpaceX and Nvidia all signed the White House accord encouraging companies to "partner with an independent external auditor or evaluator." Promising a partnership is the easy part, though. The test is whether anyone else writes down, as Anthropic now has, that it cannot stop the outsiders publishing.
The test for Anthropic is the first report. The moment that matters will come when METR publishes something Anthropic would rather it hadn't, and attaches a note saying what was redacted and whether METR thought that was fair. If that happens, and the company lives with it, this will have been the week the labs stopped being the only narrators of their own risk. If it never happens, and the reports come out smooth and reassuring, we'll have learned something too, just not what anyone hoped.
For now, there are six people at desks inside Anthropic who can see roughly what Anthropic's own safety team can see, and who have said in writing that they work for the public. The FTC would like a word with them as well. The desk was the easy part.