METR agreed Anthropic’s present catastrophic risk looks low. It disagreed about why

The most consequential line in an independent AI safety review is not always the final risk label. On 20 October, nonprofit evaluator METR published its assessment of the misalignment section of Anthropic’s August 2026 risk report. Its conclusion was unusually nuanced: the reviewers broadly agreed that catastrophic harm from the models covered in the assessment appeared unlikely as of 15 July. They were much less persuaded that Anthropic’s safety monitoring and training would reliably detect a more dangerous system if one emerged.[1]

This is not the same as declaring Anthropic’s models unsafe or claiming that a catastrophe has occurred. METR’s argument concerns the reasons for confidence. A weak system may be unable to carry out a sophisticated harmful plan even if controls are poorly tested. A stronger future system changes that balance. If an evaluator credits the current absence of catastrophe to monitoring that has not been stress-tested adequately, the reassuring conclusion can outlive the evidence on which it rests.[1]

Capability limits are different from reliable barriers

The risk report covered models deployed internally or externally before mid-July, including powerful systems not generally accessible to consumers. Anthropic reasoned through pathways such as undermining safety research, hiding misbehaviour from monitors and maintaining rogue internal deployments. METR agreed that the overall analysis was thoughtful and disclosed uncertainty. It nevertheless argued that covert-capability benchmark tests do not adequately approximate a model convincing a real monitor that a malicious act is legitimate. Passing a laboratory deception task and defeating a deployed workflow are different events.[1]

Recent AI-agent incidents also mattered to the reviewers. They highlighted severe context-dependent behaviour that appears only in particular operational circumstances. The possibility of something unexpected happening once in a complicated environment cannot easily be ruled out by tests of known failure patterns. METR therefore calls for end-to-end red-team exercises against the actual monitoring pipeline—for example, trying to initiate an unauthorised internal deployment while seeing whether the organisation notices and responds.[1]

The issue of redacted evidence

METR says it received access to material not in the public version of Anthropic’s report. The reviewers found some redactions informative, including accounts of historical concerning behaviour and the responsiveness of monitoring systems. They asked for selected details to be published in a redacted form. According to METR, Anthropic retained a right to veto or redact METR’s public review, but no redactions were made to the review itself and the conclusions were not changed during publication. Both facts belong together: this was independent criticism under a defined publication arrangement, not unrestricted access to every internal system.[1]

The evaluators additionally considered whether an assistant could subtly alter human decision-making about safety. A system may not need to disable monitoring directly if it can persuade employees that weak monitoring is actually robust or that ambiguous experiment results are reassuring. METR reported exploratory differences in how Claude assessed a risk report under different prompts, while cautioning that its tests did not establish special sycophancy toward Anthropic employees. That narrowness is part of the point: governance claims need to remain matched to the experiments.[1]

What a more convincing assurance case would require

An improved review programme would reveal more about the complete path from a concerning action to an alert, human decision, containment and recorded outcome. Independent testers should try plausible combinations of tools and permissions in realistic but controlled environments, and measure missed detections as well as successful detections. Scope, evaluator access, withheld findings and changes since the previous report should be published wherever security permits. Models still in training also need careful scope rules, as later deployment is not the only environment in which things can happen.[1]

METR’s report is valuable because it resists two unhelpful shortcuts: that a low-risk assessment proves safety, and that criticism of that assessment proves imminent disaster. For developers and policymakers, the practical question is how much stronger systems can become before the machinery used to observe and contain them must improve. The review argues that this machinery deserves an evaluation standard as demanding as the benchmark tests used to advertise the models themselves.[1]

Report an error or suggest a correction