An auditor who visits once a year sees what has been laid out for the visit. One with a desk down the corridor sees the rest, and that is the idea behind embedded evaluators. In an essay dated September 2026, We Must Pace the Frontier, Anthropic’s chief executive Dario Amodei committed the company to hosting outside reviewers with access close to an employee’s, and with a right to publish what they find.
We read that essay and the two company announcements that followed it. This piece sets out what the documents promise and what they leave open.
What are embedded evaluators, and who proposed them?
Embedded evaluators are the first step of a three-step plan in Amodei’s essay, which is his first-hand statement for Anthropic. The other two steps need other companies or other governments. This one he describes as something Anthropic is committing to alone.
The essay defines the role in one sentence. Each frontier AI company gives ongoing, employee-like access to a team of third-party evaluators, and that team verifies that the company keeps to its safety practices and commitments, reports incidents, and helps assess the alignment of training pipelines and processes as well as finished models. Amodei names METR, a nonprofit evaluation organisation, as an example of who might do it. He compares the arrangement to banking, where he says regulators’ supervisors are sometimes embedded alongside a bank’s own staff.
His stated reason is that the company otherwise decides what the public sees. Anthropic’s model cards and risk reports run to hundreds of pages, he writes, but Anthropic still chooses what goes in them. We have seen the limit of that from outside. The code we described in how AI companies hide tracking code sat in Claude Code, Anthropic’s terminal coding tool, without appearing in a release note, and it came to light in June 2026 because someone filed a public issue report.
What access do embedded evaluators get inside Anthropic?
The essay lists what Anthropic intends to give an external review team. The physical part is desks in its offices, access badges and company laptops. The working part is access to workspaces, tools and permissions that the essay calls mostly comparable to what Anthropic’s internal risk assessment teams have.
That comparison matters. The benchmark is the staff who already do risk assessment, which is narrower than every employee. Amodei also lists exceptions: where the law or Anthropic’s contracts require it, and where customers’ and partners’ private information has to be protected. He adds that Anthropic will set internal norms that back the reviewers’ access to information, with live conversations with employees included.
None of this is in force yet on the documents’ own account. The essay says Anthropic intends to invite the team in the near future. Anthropic’s announcement of September 18, which we come to below, says it will share more as the work begins.
What can embedded evaluators publish, and what can Anthropic redact?
The publishing terms are the most specific part of the essay. It says the reviewers should have a contract that gives them the right to publish their main findings on four subjects: risk levels, incidents, practices, and the access they received or did not receive. Anthropic would have no editorial control over those findings.
Anthropic keeps what the essay calls a narrow ability to redact. It names four categories: security-sensitive, legally privileged, commercially sensitive, and third-party confidential information. Then it sets a limit on its own power: “we can’t redact findings just because they are unfavorable”. The reviewers may also say in public that a redaction removed something important to their conclusions.
That last clause is the one to watch. A reader of a redacted report cannot tell a harmless cut from a damaging one, so the reviewers’ freedom to flag a cut does most of the work. The essay does not say who decides whether a cut fits one of the four categories. We searched it for dispute, disagree, arbitrat and appeal and found none of them.
Who are the embedded evaluators so far, and who pays them?
One organisation has been named. On September 18, 2026 Anthropic announced a partnership with Accenture on embedded evaluation, led by Faculty, which the announcement describes as Accenture’s specialist AI business. The work is to include evaluating and red-teaming models, conducting alignment assessments and testing model safeguards.
The money is stated as an expectation. Anthropic’s announcement says the two companies each expect to invest at least $1 billion over the next five years in building capacity in this area. Accenture’s own release of the same day gives the same sum and the same period, and describes it as investment in AI safety. Neither document says how much of it is a fee for the evaluation itself.
On who pays, Anthropic is direct. It says it will fund Accenture’s work directly, and in the same passage it says: “There is also no settled system for funding independent evaluation.” Its long-term preference is pooled or government funding, and it says neither exists today.
The nonprofit route is different. Anthropic says it is in dialogue with METR and other nonprofit evaluators to pilot elements of embedded evaluation with their own funding. That fits the position in METR’s funding update of August 14, 2026, which says of frontier AI companies: “We have not accepted funding from these companies”. The same update says those companies give METR a significant amount of free tokens. We found no METR statement on the pilot. The word embedded was absent from METR’s updates index when we read it on October 8.
Two more facts bear on independence. The partnership is non-exclusive in both directions: Anthropic says it will name other evaluators in the coming weeks, and Accenture will do similar work for other AI developers. Accenture is also in a second relationship with Anthropic. Anthropic’s announcement of October 2 about its Frontier Academy training programme lists engineers from Accenture in the first cohorts. Anthropic’s own line on the arrangement is that the safety of its models remains its responsibility.
What do the documents leave unsettled about embedded evaluators?
Anthropic says plainly that much is undecided. Its announcement states that there are no standards yet for what information embedded evaluators should be able to see or how they should report what they find, and that many details of how the scheme will run are still being worked out.
Some gaps the documents do not flag. The essay’s publication and redaction terms are not repeated in either Accenture document: we searched Anthropic’s announcement and Accenture’s release for publish, redact and contract, and none of the three words is in either. So we cannot say from the record whether the Accenture team works under the terms the essay sets out.
How long the access lasts is not stated either. The essay says ongoing, and in its section on regulation it speaks of permanent embedded evaluators, but neither it nor the announcement gives a contract length. The five years belong to the investment. For comparison, the agreement we reported in Anthropic’s fourth cyber incident disclosure gave METR access to transcripts and to employees for an initial eight weeks. Anthropic’s post of August 31, which first mentioned a METR review, does not contain the word embedded at all.
The size of the team is missing too: we searched the essay, the announcement and the release for how many and headcount and found neither. And the scheme covers one company so far. Amodei’s essay urges other frontier companies to follow suit, and none of the three documents names one that has.
Until a first report exists, outside inspection is the evidence anyone has, and it reaches only what a company ships. Our telemetry investigations tested seven local AI tools that way, by reading shipped code and capturing what left the machine. Embedded evaluators are meant to see the training runs and decisions that never ship, so the passage to read first in their first report is the one the essay gives them a right to publish: the access they did not receive.
