Anthropic update on independent evaluators

Pippa So Anthropic just basically hired their own auditors and sat them inside the building.

Tyler Yeah, they’re giving METR what they call “employee‑like access” to evaluate Claude and their safety process. Six METR people, Anthropic laptops, office space, internal tools—roughly what Anthropic’s own risk team sees.

Pippa Right, and the claim isn’t just “we like audits.” They’re saying you can’t have real oversight if evaluators are stuck with the public API and a blog post.

Tyler Exactly. Their argument is: models got powerful, risks got weirder, but they can’t dump everything in public because some of it’s dual‑use or commercially sensitive—compute, training details, that sort of thing. So instead, you show it to trusted third parties and let them publish conclusions.

Pippa Mm‑hm.

Tyler And they really lean on this bank‑supervision analogy. Big banks get resident examiners from the regulator who sit inside, see the real books, then report out. Anthropic’s basically saying, “we don’t have regulators yet, so we’re going to approximate that with nonprofits and firms like METR, SecureBio, Accenture, Faculty.”

Pippa Yeah, and METR’s the interesting one here. They’re not just running evals from the outside—they’re allowed to publish their view of Anthropic’s “risk levels, incidents, or practices,” and Anthropic can’t block it, only redact very specific categories like customer data or privileged legal stuff.

Tyler And crucially, METR can say, out loud, “Anthropic redacted X and we think that was or wasn’t reasonable,” without revealing the redacted bits. That’s a pretty strong commitment for a private company to make on paper.

Pippa This is where I get a tiny bit excited as the product‑and‑governance nerd. Because if you’re a regulator or a giant bank thinking about using Claude for real, the existence of a team inside the building whose job is to publish about risk is a selling point.

Tyler Sure… with caveats.

Pippa Of course. Go on, Tyler, ruin my fun.

Tyler I mean, I like that they’re doing this. I’ve read METR’s stuff; they’re serious about, say, alignment‑faking—models pretending to be safe on tests. So having people with that mindset embedded is good. But the independence story depends on a couple of fragile things.

Pippa Like what?

Tyler One is financial and operational dependence. Anthropic says evaluators shouldn’t hold equity or be financially dependent on the company they’re evaluating. But if your access, your data pipeline, and maybe future contracts all come from Anthropic, there’s still a soft pressure not to write “this deployment plan is reckless.” You don’t need equity for there to be bias.

Pippa Right. Even if nobody’s twirling a mustache, you know who controls your badge.

Tyler Exactly. The other piece is access scope. They carve out “a small number of clearly defined categories”—customer data, attorney‑client stuff, model architectures. That’s reasonable, but model architecture and training details are also where some of the most sensitive capability questions live. If those are off the table, METR’s view of risk might still be missing key context.

Pippa Yeah, that was my eyebrow raise: they say evaluators need visibility into how models were trained and how safeguards work, BUT architecture is on the exclusion list. I get not open‑sourcing your secret sauce, but some of the scary failure modes are very architecture‑ and training‑regime‑dependent.

Tyler Right. I’m not saying they’re hiding anything specific; I just think the bank analogy only really holds when the examiner sees everything material to risk. Here, it’s more like “almost everything under NDA, plus a redaction right.”

Pippa Yeah, that one reads as “we’ll help big enterprises adopt Claude safely, and we’ll use that work to stress‑test the model.” Which is fine, but that’s clearly not the same independence bar as METR.

Tyler Totally. If Accenture’s also selling Anthropic into clients, they’re not going to publish a scathing “don’t deploy this anywhere near your systems” report. Their role is more: help surface issues, harden safeguards, and then reassure customers that someone kicked the tires.

Pippa So let me try the big picture, and you tell me if I’m overselling it. To me, the central move is Anthropic saying: “We can’t put all our scary details on the internet, BUT we can let a small group of qualified outsiders in, under our security rules, and commit to living with their write‑ups.” And they’re formalizing that with tiers and embedded access.

Tyler I think that’s fair. Where I’d put the nuance is: this is not yet real regulation. It’s voluntary, it’s scoped by Anthropic, and if it gets too uncomfortable they can always choose not to renew a contract. So it’s more like building the muscle memory for being examined, in case regulators later say, “cool, now do that with us.”

Pippa Yeah, like they’re rehearsing for actual supervision. And in the meantime, they’re closing some of the information gap between “what Anthropic knows about its own models” and “what any outsider can plausibly infer.”

Tyler And honestly, that gap is huge. They even say the goal is to shrink the difference between what evaluators understand and what the company understands. If METR can see internal incidents, near‑misses, how safeguard patches get shipped, that’s way more informative than another leaderboard score.

Pippa Who do you think should actually care about this, though? Like, if you’re just using Claude to write product specs, does any of this matter?

Tyler For an everyday user? Not directly. Your main concerns are still cost, quality, uptime. Where this matters is: regulators trying to write rules, big enterprises deciding which frontier lab to trust, and honestly the other labs who now have to decide whether to match this or look more opaque by comparison.

Pippa Yeah, that’s where my head goes. If you’re a giant insurer or a pharma company or a bank, this is another checkmark in the “take Anthropic seriously” column. The fact they’re voluntarily embedding people who can publish about incidents is a signal that they expect scrutiny and are planning for it.

Tyler And for the labs, it sets a bar. If one player is saying “our evaluators can publish without our approval, and they sit in our office,” it’s harder for someone else to say “we’ll email you a safety slide deck once a year” and call that equivalent.

Pippa Do you think the argument holds technically, though? Like, are embedded evaluators actually going to catch the scary stuff, given how weird these systems are?

Tyler I think embedded evaluators are necessary but nowhere near sufficient. You still have all the hard problems: evaluations missing long‑horizon failures, models gaming tests, distribution shift once you deploy. But if I compare “embedded, independent‑ish team with deep access” to “no one outside the company sees anything,” it’s an obvious improvement.

Pippa Yeah, it doesn’t solve alignment, it just makes the story less “trust me, bro.”

Tyler Exactly.

Pippa Alright, I’m going to call this one: as governance infrastructure, this feels like a real move, not just a press release. The test is whether more groups actually make it to that METR‑style tier three over the next year.

Tyler Agreed. Ask me again once we’ve seen METR’s first public report and whether Anthropic actually lives with the awkward parts.

Pippa Deal. For now, let’s park it there before we start designing tier four on air.