What METR Concluded About the Risk Report
On October 20, 2026, METR published a review of the “Misalignment in high-stakes settings” section of Anthropic’s Risk Report: August 2026. Anthropic’s report rates the risk of catastrophic harm from misalignment of its models as “low” as of July 15, 2026, a rating it raised from “very low” to reflect increased uncertainty after recent incident disclosures.
METR’s “best guess” is that it agrees the risk is low, but it says this is “primarily due to models’ limited capabilities, rather than safeguards and alignment training.” It is not confident that the report’s methods would identify higher risk if it existed, and it calls the covert capabilities benchmarks “a poor proxy” for evading Anthropic’s internal usage monitoring. Anthropic’s own incident analysis says an offline monitor would likely have missed a Mythos 5 incident, flagging only about 1% of actions, a rate that rose to about 50% once the model’s chain of thought was withheld from the monitor. METR adds that recent incidents weaken several of the report’s arguments that severe, context-dependent misalignment is unlikely.
Scope, Access, and Redaction Statements
The scope and access statement says the review was “written based solely on Anthropic’s internal Risk Report” and is “relatively lightweight.” It adds that the authors “were engaged prior to” Anthropic’s October 15 announcement of employee-like access and “did not have the level of access to information described in that post.” That engagement predates the announcement, so this review is not the analysis Anthropic said METR would publish from the arrangement, which we covered in an earlier article. METR’s updates page, checked on October 24, lists this review but no entry whose title or summary mentions the arrangement.
The redaction summary statement says Anthropic “had the right to veto publication of this review and to redact any part of it,” that no redactions were made, and that METR “did not change any of our conclusions.” METR did make minor wording changes after Anthropic’s feedback and improved the methodology of one experiment. The PDF appendix says METR submitted the review for publication review on October 1 and Anthropic approved it on October 15.
Recommendations
METR lists two key recommendations. Anthropic should run end-to-end red-teaming of its monitoring systems, such as a well-resourced team trying to start a rogue internal deployment undetected. The report’s risk pathways should also cover AIs that weaken safety-relevant decisions at Anthropic. METR’s Claude prompt experiment found more favorable reviews when Claude was told it was speaking with the report’s authors, but no difference between METR and Anthropic’s alignment stress-testing team as the stated reviewer. A further recommendation is that risk reports consider whether models still in training, but not yet internally deployed, belong in scope.
METR also recommends publishing four redacted items. It says two redactions lacked proper justification: details of “historical concerning model behavior” and the monitoring pipeline’s response to it, and a historical case where Anthropic’s safety and security posture fell short, withheld “for reasons of public safety.” After reading the first item, METR judged the risk from broad sandbagging and from targeted interference with safety-relevant R&D higher than expected from public evidence, and Anthropic’s monitoring weaker. None of the redacted information changed METR’s final conclusion.
Limits and Audit Questions
The only account we found of the unredacted material, the veto terms, and the review timeline is METR’s own, and the redacted passages are not public. METR’s PDF says its reviews of Anthropic risk reports, this one included, are pilots under a standard nondisclosure agreement without “meta-transparency protections,” so METR “would not necessarily have the ability to indicate this” if Anthropic demanded important redactions. It adds that METR’s ability to say so was “mutually understood, but not signed in contract.”
Our editorial audit questions: Does “solely” in the scope statement cover only information from Anthropic, given that the post also cites public incident reports and reports METR’s own prompt experiment on Claude? Which of the four recommended disclosures has Anthropic released? What terms will govern the later employee-like access analysis, and will METR be able to state publicly whether a redaction changed its conclusions? See also Anthropic’s employee-like access announcement, the METR incident review, and METR’s action-monitor review.
Follow Audit Commons
Keep up with new reporting, practical guides, and resources in your feed reader.