When an AI lab says its newest model is safe to release, who checks? Increasingly, the answer includes outside organizations that specialize in testing frontier systems for dangerous capabilities. This week Anthropic announced it is giving a team from one of them, METR, employee-like access to its internal systems. This guide explains who the main outside evaluators are, what each one does and where their work stops.
Why outside evaluators exist
Labs run their own safety tests, but an organization assessing its own product has obvious incentives. Third-party evaluators add independence, specialized expertise, and the ability to publish findings the company might prefer to keep quiet. The idea has support across the industry: Anthropic’s chief executive proposed embedding external auditors in leading labs last month, and, according to Ars Technica, OpenAI’s Sam Altman and Elon Musk said they backed the idea. Anthropic compares the setup to bank supervision, where regulators station resident examiners inside the largest banks. Critics counter that evaluators who depend on the companies they review can develop conflicts of interest, as in the accounting profession.
METR
METR, pronounced “meter,” is a nonprofit that, in its own words, “evaluates frontier AI models to inform the public about their risks and capabilities.” Most of its research consists of evaluations of how far an AI system can autonomously carry out substantial tasks, from general-purpose work like conducting research or developing an app to concerning capabilities such as conducting cyberattacks or making itself hard to shut down. It has also begun studying how AI affects real-world software developer productivity: a randomized controlled trial it ran found that experienced open-source developers systematically overestimated how much AI tools helped their productivity.
Its best-known research measures the length of tasks AI agents can complete, which METR says has doubled roughly every seven months for six years. METR also prototyped the Responsible Scaling Policies approach, which it says nine AI developers have adopted. According to Ars Technica, METR does not accept donations from AI companies or their staff, and is funded by individuals, philanthropies and government bodies including the UK’s AI Security Institute. Under the new arrangement six METR staff work inside Anthropic with hardware and tools roughly on par with the company’s risk teams, and Anthropic cannot veto their publications, though it can require redaction of customer data, privileged material and model architecture details.
UK AI Security Institute
The AI Security Institute (AISI) is a research organization within the UK government’s Department for Science, Innovation and Technology. Its stated goal is “building the world’s leading understanding of advanced AI risks and solutions, to inform governments so they can keep the public safe.” Its work includes testing leading AI systems before they are released publicly and collaborating with top AI companies to improve their safety and security, informing policymakers in the UK and allied governments about emerging capabilities and risks, and funding research, with more than £15 million in grants. It describes itself as designed “like a startup in the government,” with more than 100 technical staff.
Because it is a government body, AISI’s findings feed directly into policy. It differs from METR in its legal footing and its mandate: it serves governments rather than the public at large, and its access to models depends on voluntary agreements with companies rather than on law.
SecureBio
SecureBio focuses on biological risk. Its mission is to “secure the future against catastrophic pandemics,” working on technologies and policy proposals to delay, detect and defend against pandemic threats, whether natural or engineered. In the AI context, that expertise matters because one of the main concerns about advanced models is that they could help people with harmful intent understand or plan the creation of dangerous pathogens. Ars lists SecureBio among third-party testers working with Anthropic. Evaluating that risk requires specialized biological knowledge that a general AI lab may lack.
How the roles differ
| Organization | Type | Main focus |
|---|---|---|
| METR | Nonprofit | Autonomous capabilities, risk of rogue behavior, developer productivity research |
| UK AI Security Institute | Government research body | Pre-release testing, advising governments, grant funding |
| SecureBio | Nonprofit | Biological and pandemic risks, including AI-enabled bio risk |
What outside testing cannot do
Evaluations are only as good as the access they get. If an evaluator sees only a model’s public interface, it may miss capabilities that are hidden or unlocked by clever prompting. Embedded access like METR’s addresses part of this. But a test can show that a model has a dangerous capability; it cannot prove that none exists. Results can also be disputed, delayed or redacted, and voluntary access can be withdrawn. Unlike regulators in safety-critical industries, evaluators generally cannot stop a release. Whether governments should make third-party testing mandatory is an open policy question, and the answer will shape how much weight these organizations carry. Our explainer on frontier AI safety frameworks shows how labs’ internal commitments interact with outside review.
What to watch next
- METR’s first public analysis from inside Anthropic.
- Whether OpenAI, Google DeepMind and other labs agree to similar embedded access.
- Any move to make third-party testing a legal requirement.
- How evaluators handle redactions and publication disputes.
- The role of national institutes, such as AISI, alongside nonprofits.
Key takeaways
- Independent evaluators add expertise and independence to lab safety testing.
- METR focuses on autonomous capabilities; AISI is a UK government body; SecureBio focuses on biological risk.
- Embedded access gives evaluators a closer look than public interfaces do.
- Evaluations can reveal risks but cannot prove a model is safe.
- Mandatory testing remains a policy debate.
Frequently asked questions
Can evaluators block a model release?
Generally not. They report findings; decisions on release remain with the company, and regulation varies by country.
Who pays for METR?
According to reporting, individuals, philanthropic organizations and government bodies such as the UK AI Security Institute; METR does not accept donations from AI companies or their staff.
Why does bio risk get special attention?
Because experts worry advanced AI could lower barriers to creating dangerous pathogens, so specialized evaluators test for that risk.