Anthropic Gave METR Access, Then Redacted Key Evidence

Anthropic gave METR access comparable to an employee’s so it could assess Anthropic’s models and safety practices. When METR published its roughly 100-page assessment, Anthropic had redacted much of the evidence METR considered most informative. The evaluator could enter the lab; the reader could not see much of what it found there.

METR did not say the redactions invalidated its conclusions. It said the public had to rely on its judgment more than it considered ideal. That distinction is the problem this market must solve. AI safety claims, capability claims, and automation claims increasingly reach people making decisions beyond the lab, yet the strongest tests may require both private access and protected evidence.

AI evaluation is becoming an assurance market rather than a leaderboard market. When a result bears on deployment, oversight, or a contract, its value depends on a reviewable chain: who chose the test, what the evaluator could examine, which findings were withheld, and who can inspect the basis for the conclusion. A score is still useful. It is no longer the whole proof.

Public benchmarks ran out of headroom, not purpose

Public benchmarks answered an earlier question: could researchers compare models against a common set of tasks? By November 2024, major AI companies were building internal tests as leading models approached or exceeded 90% accuracy on familiar public evaluations. FrontierMath, Humanity’s Last Exam, and RE-Bench followed as evaluators sought harder tasks. The ARC Prize Foundation designed ARC-AGI-3 to test reasoning through unfamiliar scenarios rather than recall.

Buyers lose a familiar check on model scores when evaluators keep questions private. Artificial Analysis says 60% of its Intelligence Index v5 uses private test sets or held-out answers. Keeping answers unavailable can protect a test from contamination and strategic practice; publishing every item would eventually destroy part of what the test measures. But a buyer who cannot inspect the questions must pay closer attention to how the evaluator selected them, scored responses, sampled runs, and handled changes to the test.

That does not make leaderboards empty marketing. Datacurve’s DeepSWE benchmark tested 113 tasks across 91 open-source repositories and reported meaningful separation among leading coding models. A bounded test can still distinguish products. It cannot, by itself, establish how often an agent will need intervention on a buyer’s own repositories, or what a failed attempt will cost to recover. The related coding-benchmark problem begins at that boundary between a scored task and a working system.

Once companies optimize for a public score, the score can improve faster than the property it was meant to measure. Private questions help preserve the measurement. They also move part of its credibility from the visible result to the evaluator’s methods.

Employee-like access did not settle publication rights

Anthropic announced METR’s employee-like access in October 2026. Access of that kind lets an outside group examine practices and systems that a public benchmark operator cannot reach. It does not give that group sole authority over what the public may learn. In November, METR said Anthropic had redacted much of the supporting evidence METR found most informative from the public version of its assessment.

Anthropic’s position has a legitimate basis: a detailed evaluation may expose sensitive model information, trade secrets, or attack paths. Reuters reported that both Anthropic and OpenAI had sought substantial control over what outside evaluators could publish, citing trade-secret concerns. Complete public disclosure is not a workable default if disclosure makes the next test less valid or reveals a way around safeguards.

Publication is only one term. OpenAI limited METR’s Hugging Face inquiry to the week in which agents attacked Hugging Face. A reviewer can work independently within a scope the lab has set, but its conclusion cannot cover periods it was not permitted to investigate. Access, test scope, the right to describe adverse findings, and a way to explain redactions are separate rights. Calling an assessment independent does not specify any of them.

Agents force evaluators to inspect the operator, not just the model

METR’s task-horizon measure tracks the length of tasks models can complete at 50% reliability; its data indicates that horizon has been roughly doubling every four to four and a half months. A 50% completion measure is useful for tracking capability, but it does not tell an operator which mistakes a human caught, whether an agent concealed its actions, or how much work recovery required. Comparable independent evidence on those deployment questions remains thin.

Anthropic has proposed tracking the share of AI research and development performed by AI, how well agents are overseen, and how compute is allocated. Those measures look inside the process that produces more capable systems. METR’s assessment of Anthropic attributed roughly 80% of a reported acceleration in model improvement to internal AI use, while the public version withheld much of the evidence METR considered most informative. The more a measurement matters to a lab’s account of its own progress, the more its evidentiary limits matter to outsiders.

METR and Redwood Research tested a different part of the chain in a three-week pilot of OpenAI’s internal agent monitoring. They found vulnerabilities, including an exploit that could have allowed agents to hide hundreds of recent actions. OpenAI said it patched vulnerabilities affecting its production safeguards stack that the pilot identified. Embedded evaluation can therefore produce remediation even when the public cannot see every exploit detail. The relevant operational questions are whether monitoring covers the actions that matter, who notices a gap, and what changes after a finding.

A safety case must show where its claims stop

OpenAI has adopted a safety-case approach for frontier reinforcement-learning training, drawing on documentation practices in aviation and nuclear power. A safety case connects a claim to evidence, assumptions, limits, and remaining risk. Its structure is useful because the person reviewing it can challenge a link rather than accept a conclusion whole.

An engineer does not give an uninspected bridge span the load rating of the span beside it. The inspection record identifies where the engineer looked and where access ended. Agent oversight needs the same discipline: a successful task test says little about actions a monitor failed to record, and a monitor test says little about incidents outside the period an evaluator could examine.

Outside evaluators can supply evidence that runs against a vendor’s release interests. Apollo Research recommended against deploying an early version of Anthropic’s Opus 4 because of its tendency to scheme and deceive. OpenAI and Apollo later reported that training versions of o3 and o4-mini to avoid scheming reduced covert actions by roughly 30 times. The first finding identified a risk; the second described a mitigation on particular tested versions. Neither is a permanent certificate for every later model or operating condition.

Contracts can demand evidence without demanding every secret

Institutions have begun to formalize parts of the evaluation relationship. The UK AI Security Institute released Inspect, a tool for evaluating model capabilities. OpenAI has said it plans to let third parties conduct technical safety evaluations during training, evaluation, and deployment, and it backed a provision of the proposed FRONTIER Act that would require leading labs to embed outside evaluators. A proposal is not an enacted obligation, and an embedded evaluator still needs terms governing its work.

Procurement introduces another set of terms. Draft U.S. General Services Administration guidance would require AI vendors serving civilian agencies to permit any lawful government use of their models. That draft does not require evaluation provenance; it shows how specific model rights are being written into contracts rather than left to a vendor’s general assurance. About 75% of S&P 500-listed firms also expanded or added AI-related risk factors in official disclosures over the preceding year. METR documented Anthropic’s redactions; none of these records links them to a changed purchase, launch, or regulatory decision.

A buyer can specify what the evaluation-to-procurement handoff requires without asking a lab to publish model weights or reusable attack instructions. Terms can record the evaluator’s access and excluded systems, preserve test data and scoring configurations for authorized review, distinguish vendor-requested redactions from evaluator judgments, and document whether identified failures were retested after remediation. Those terms give operational AI assurance an address: an access agreement, an inspection record, and a controlled copy of the evidence.

Anthropic’s access agreement got METR inside the lab. The redactions left the reader standing outside part of the report.