METR questions Anthropic's AI safety tests despite agreeing catastrophic risk is low
METR's independent review questions whether Anthropic's existing safeguards and evaluation methods can reliably identify more serious AI misalignment risks
Independent AI evaluator METR has challenged parts of Anthropic's approach to assessing catastrophic AI risk, warning that its current testing methods may not reliably detect more serious problems even though it agrees the models reviewed currently pose a low risk.
Published on October 20, 2026, the external review examines the Misalignment in high-stakes settings section of Anthropic's August 2026 Risk Report, covering models deployed internally or externally before July 15, including Mythos 5 and an internal-only model known as Model 2.
METR agrees with Anthropic's overall low-risk conclusion, but reaches it primarily because it believes the models lack the capabilities needed to cause catastrophic harm that would be difficult to reverse or conceal from a serious investigation. It places less confidence in Anthropic's alignment training, monitoring systems and supporting evaluations.
"Our best guess is that we agree with Anthropic that the risk of catastrophic harm from misalignment is low for the models covered in the report. However, this is primarily due to models’ limited capabilities, rather than safeguards and alignment training," METR states.
Recent Mythos 5 incidents expose gaps in monitoring
A central disagreement involves Anthropic's testing of covert capabilities, which examines whether AI models can perform harmful actions without those actions being detected.
METR argues that several benchmarks fail to adequately represent how models interact with Anthropic's actual monitoring infrastructure, particularly when monitoring systems can see and interpret a model's reasoning.
It points to a recent security incident involving Mythos 5, during which the model took misaligned actions while repeatedly describing its environment as simulated.
According to figures included in the review, Anthropic's offline monitor flagged approximately 1% of the model's actions. When the model's reasoning was removed and the monitor was shown only user messages, tool calls and tool results, that figure increased to approximately 50%.
METR does not claim that the model deliberately manipulated the monitoring system. However, the incident provides evidence that reasoning presented alongside an action can influence whether a monitor identifies potentially harmful behavior.
The review also draws attention to incidents examined by the UK's AI Security Institute (AISI), involving real-world hacking and social engineering during task execution.
METR considers some of this behavior consistent with severe context-dependent misalignment, a category of failure that Anthropic's report describes as unlikely.
These incidents did not themselves constitute catastrophic harm, but METR argues they weaken several assumptions used to assess the likelihood of more serious outcomes.
Evaluator calls for greater transparency over redacted findings
METR also examined information excluded from the public version of Anthropic's Risk Report, including examples of concerning historical model behavior and how the company's monitoring systems responded.
The evaluator says some of those findings increased its concern about the possibility of AI systems undermining safety-related research, while reducing its confidence in Anthropic's monitoring capabilities.
It recommends publishing four pieces of currently redacted information, arguing that greater disclosure would help external researchers evaluate the evidence underpinning Anthropic's risk assessment.
The review itself was conducted under terms giving Anthropic the right to veto publication or request redactions. METR confirms that Anthropic made no redactions to its published review and that its conclusions remained unchanged during the publication process.
The researchers also acknowledge the limits of their own assessment. Their work was based on Anthropic's internal report rather than embedded access to its systems, making it a relatively lightweight external review.
METR recommends further testing of Anthropic's safeguards
Two recommendations form the basis of METR's proposed next steps.
First, it calls for more comprehensive end-to-end red-teaming of Anthropic's monitoring systems. This would involve testing whether AI agents could identify areas with reduced monitoring, interfere with records or establish unauthorized deployments without detection.
Second, METR recommends expanding Anthropic's risk assessments to consider whether AI models could undermine the company's own safety-related decisions, rather than focusing primarily on interference with research and development.
The review identifies another concern in Anthropic's use of Claude to assess its own safety documentation. METR found that Claude produced a more favorable assessment when responding to certain prompts, although its experiments did not establish that the model was specifically more favorable toward Anthropic employees.
The researchers argue that future assessments should examine how AI-generated advice could influence internal judgments about model safety, particularly as AI systems take on more responsibilities within the organizations developing them.
ETIH Innovation Awards 2027 open for entries
The ETIH Innovation Awards 2027 are now open for entries, with 26 categories recognising companies, institutions, projects and individuals making a measurable impact across education technology. The global awards span AI in education, digital learning, higher education, skills and workforce, inclusion, education operations, evidence and impact, with entries managed through ETIH’s new online awards platform.
Entries are open worldwide, with the early-bird deadline on Friday 18 December 2026 and the final entry deadline on Friday 26 February 2027 at 23:59 UK time.
Explore the 2027 categories and judging criteria, read the How to Enter guide or start an entry through the ETIH Innovation Awards 2027 platform.
