METR agrees Anthropic's misalignment risk is low, but doubts the methods

What METR concluded

METR reviewed the "Misalignment in high-stakes settings" section of Anthropic's Risk Report from August 2026. Anthropic's report concludes that, as of July 15, 2026, "the risk of catastrophic harm caused by misalignment of [their] models is low." METR's best guess is that it agrees for the models covered in the report.

METR says it views the risk as low mainly because it does not expect the covered models to have the capabilities to cause hard-to-reverse catastrophic harm through misalignment, even with much weaker mitigations. According to METR, even without the monitoring and security mitigations Anthropic describes, the models could not make potentially catastrophic actions hard to reverse or hide them from serious investigation efforts. This mirrors a finding in METR's Frontier Risk Report, that agents earlier this year might have set up rogue deployments but could not have made them robust to serious efforts to discover and shut them down.

METR also says it relies somewhat on the fact that more than a month had passed since the report's initial publication without very concerning news about the alignment and capabilities of the covered models, though it calls this limited assurance.

Doubts about the methodology

METR says it is not confident that the report's methodology would reliably identify a higher risk if there were one. It describes the report as thoughtfully written and generally appropriate in conveying uncertainty, but "far from adequate for confidently ruling out misalignment." A strong argument, METR writes, would need much more extensive empirical work and the solution of multiple open scientific problems.

• The covert capabilities benchmarks are, in METR's view, a poor proxy for models' ability to evade Anthropic's internal usage monitoring system. They miss ways of evasion such as convincing the monitor that a harmful action is legitimate, which METR says have since been demonstrated in real incidents.
• METR thinks Anthropic acknowledges some of these limitations but not strongly enough.
• Recent incidents undermine several of the report's arguments. Some seem well described as "unknown severe context-dependent misalignment," a failure mode the report argues is "unlikely."

Anthropic's case and the models covered

Anthropic's section argues that misalignment risk is "low" for its models deployed internally or externally before July 15, 2026, including Mythos 5 and an internal-only model called "Model 2." METR notes that this rating is higher than in Anthropic's earlier risk reports, which placed similar risks at "very low." Anthropic also says it has "substantial uncertainty" about the overall level of risk.

The argument rests on eight risk pathways, including broad sandbagging on safety-relevant R&D, code backdoors for future misaligned models, poisoning the training data of future models, self-exfiltration, persistent rogue internal deployment, and undermining decisions within major governments. It also relies on eight key claims. The first, that models are unlikely to have strong covert capabilities, underpins several of the others, according to Anthropic.

Recommendations and transparency

METR makes two key recommendations. First, Anthropic should conduct end-to-end red-teaming of its monitoring systems, for example an exercise in which a well-resourced red team tries to start a rogue internal deployment without being detected. Second, it should expand the risk pathways to include AIs undermining safety-relevant decisions at Anthropic.

METR also recommends publishing four pieces of redacted information. None changes its final conclusion, but some informed its views. Seeing examples of historical concerning model behavior and the monitoring pipeline's responsiveness to them led METR to believe that risks of broad sandbagging and targeted undermining of safety-relevant R&D are higher than public evidence suggests, and that Anthropic's monitoring system is weaker than public evidence suggests.

On independence, METR says Anthropic could veto publication or redact any part of the review. No redactions were made and no conclusions changed, though METR made minor wording changes and improved the methodology of one experiment after Anthropic's feedback. The review is described as relatively lightweight and based solely on Anthropic's internal report.

What it means

The review suggests the current low risk rating depends largely on how capable the models are today. METR's concern is that as capabilities grow, the report's evidence on alignment training, assessments and monitoring may not be strong enough to show when the risk has risen, and METR expects future engagements to be governed by different terms.