AI Audits: Promised Transparency, Independence to Clarify at Anthropic and OpenAI

Anthropic and OpenAI announce their intention to welcome independent security evaluators with enhanced access. Researchers and auditing organizations see this as a useful step, but point out areas of concern regarding actual access, evaluation time, publication of results, and the absence of common safeguards. Laws already exist in California and Europe, but they do not cover everything that is being proposed.

Legal Obligations Exist, but Do Not Cover Everything Proposed

In California, the SB 53 law requires major AI developers to publish security frameworks and report critical incidents. Another law, SB 813, creates a framework this month for independent verification organizations recognized by the state and competent in AI-related risks. In Europe, the AI Act mandates model assessments, adversarial testing, and notification of serious incidents, and the European AI Office can conduct its own evaluations relying on independent experts. These provisions remain less extensive than what Dario Amodei proposes, leaving laboratories to choose the level of independent oversight they will accept. Henry Papadatos believes that regulation mandating these practices would be ideal and would align all companies, not just the most willing.

Stated Commitments and Refusal to Align: A Divided Sector

Anthropic claims it wants to open unprecedented access to teams like METR and Redwood Research, with the right to publish key findings without editorial control from the company. OpenAI, through Sam Altman, expresses readiness to adopt a similar approach. In contrast, Meta, SpaceXAI, and Google DeepMind have not committed to integrating third-party evaluators. Demis Hassabis proposed a separate standardization body to independently test cutting-edge models. Meanwhile, Google, OpenAI, and Anthropic have been privately discussing their security plans for several weeks.

Independence Under Constraint: NDAs, Editorial Control, and Lack of Time

Evaluators believe the system will only work if companies genuinely agree to relinquish control. In the past, tensions have arisen over access, time, confidentiality, and public communication. Adam Gleave reports that FAR.AI has refused contracts with developers who wanted too much control over the evaluation, and emphasizes that evaluators are often treated as mere subcontractors bound by restrictive NDAs that govern what can be published. The issues of time and access remain critical: OpenAI granted METR and Redwood only about a week to investigate an incident at Hugging Face; both organizations later indicated they could not draw reliable conclusions. During the pre-testing of GPT-6 Astra, presented by OpenAI as its most aligned model, Apollo Research had only three days, a window deemed insufficient to establish robust conclusions.

Why Deep Access is Requested: From Training to Employee Interviews

As models become better at recognizing evaluations, the risk increases that good performance may mask undesirable behaviors. Researchers believe these signals may not appear in the final model but emerge when analyzing the entire training process. Evaluators are requesting access to intermediate versions (checkpoints) to compare the emergence of problematic behaviors, to the post-training environment where certain behaviors are rewarded, as well as to transcripts and evaluation logs. Adam Gleave considers that interviews with employees may also be necessary to verify the consistency between internal practices and public documentation.

Learned Tests or Real Security: The Benchmark Dilemma

Models can pass security tests while having specifically learned to do so. John Steidley cites a shutdown resistance benchmark and emphasizes the importance of knowing whether the training aimed for that score. He compares this risk to Dieselgate, when vehicles adjusted their behavior during inspections. Alexander Meinke believes companies should be able to attest that a model has never attempted to sabotage its own alignment training, a response that should be unequivocally negative, whereas today the public relies on companies' statements. Apollo Research further notes that low rates of inappropriate behaviors observed in a very short evaluation window do not constitute substantial evidence of alignment.

Areas of Concern: Scope, Timeline, and Decisions Around Intellectual Property

Neither Anthropic nor OpenAI has specified which evaluators they will collaborate with, when they will be integrated, how many will be recruited, nor the exact extent of the systems and information accessible, or what can be published. Evaluators are questioning why this would work better this time. Adam Gleave considers greater openness possible, while reminding of the value of intellectual property and the default caution of companies regarding shareable information. Several researchers are calling for a common transparent framework, with, according to John Steidley, criteria on acceptable types of auditors to avoid the use of unqualified evaluators. Henry Papadatos finally emphasizes that voluntary commitments remain contingent on the goodwill of companies.