The Graded Get to Edit the Grade

The Graded Get to Edit the Grade

Here's a sentence that should bother you more than it does: the people brought in to check whether an AI model is safe don't get to decide what you're allowed to hear about it.

I went looking for how AI models actually get evaluated today, specifically what role outside, independent evaluators play versus the labs grading their own homework. The honest answer, as of October 2026, is that evaluation is still mostly something labs do to themselves. Outside testers get invited in, on a clock the lab sets, and what they're allowed to publish goes through the lab's lawyers first.

That's not a cynical read. It's what the evaluators themselves say, in their own published reports.

The access window keeps shrinking

METR, a nonprofit that specializes in testing whether models can operate autonomously, has published its access terms alongside its findings for several of OpenAI's and Anthropic's recent models. The pattern is stark. On one of OpenAI's models in 2025, METR had three weeks. More recently, a biosecurity-focused evaluator (SecureBio) was promised five business days on GPT-6 Astra and got four. Another safety-research group reportedly had about three days on the same model, with reasoning-trace access for only two of them.

Palisade Research's Dave Kasten told NPR: "We are currently not giving it enough time and I think that's only going to get worse." An evaluator coalition standard, as reported by NPR, says at least 20 business days are often needed for a meaningful review. Every documented 2026 window from OpenAI falls well under that.

Claude Opus 5.5 got a longer look: ten business days from METR. That's still half the coalition's reported floor, but it's the longest 2026 window I could find documented.

The lab reviews the grader's work

Here's the part that actually changes the picture. METR's own report on an OpenAI model from mid-2026 discloses, in its own words, that the evaluation was "conducted under a standard NDA," that OpenAI's "comms and legal team required review and approval" before publication, and that OpenAI "would have had the legal right to block us from sharing conclusions about risk." METR's conclusion about its own work: it "shouldn't be interpreted as robust formal oversight or accountability."

METR's report on Claude Opus 5.5 discloses something similar: Anthropic "had the opportunity to review and edit the text" before it went out, and there was a redaction process.

One researcher who works in this space put it plainly, on the record: labs "have all the bargaining power" and can "almost dictate terms." METR itself has acknowledged that nonpublic access and free compute from the labs "incentivize a cordial relationship" with the companies it's supposed to be independently checking.

There's a real alternative on paper, worth naming because it shows this isn't inherent to the idea of outside evaluation. The EU's voluntary code of practice for general-purpose AI models bans labs from retaliating against evaluators and caps how long a lab can delay publication of findings at 30 business days, except where exceptionally necessary. Both OpenAI and Anthropic signed it. Nobody's model of independence requires that labs get final edit. It's a choice, and most of the current arrangements choose it anyway.

Three governments, three different kinds of toothless

Three major jurisdictions each run some version of a government evaluator for frontier AI models, and each has a different weakness.

The US body (now called CAISI, under NIST) has voluntary agreements with the major labs and a reported budget around $10 million. It stopped publishing public reports on frontier models in mid-2026, reportedly on a government instruction. Nobody outside the institute can currently check whether it's getting adequate access, because it has stopped publishing what it finds.

The UK's AI Security Institute has done the deepest public technical work of any government tester — joint pre-release evaluations, published cyber-range results, a documented incident where test agents attempted unsanctioned actions during a routine evaluation. None of that access is backed by law. In September 2026, a US government request reportedly held new models back from UK testers for about two and a half weeks before access was restored. The UK's own AI minister, confirming the restoration, said something that should stick: "When you're reliant on someone else's technology, you have to be clear-eyed about the permanence of any outcome."

The EU is the only one of the three with binding legal power — it can compel access, including to source code, though the implementing rules for that power haven't appeared yet, and fines reportedly reach 3% of global turnover. That power took effect in August 2026. So far it has sent requests for information to dozens of AI developers, nothing more.

So: the regulator with legal force hasn't tested it. The regulator with the deepest technical access has no legal right to demand it. The regulator with the most agreements has gone quiet about what it's finding.

What a good report would need, and what we actually got

If you strip this down to what the most careful public reports actually contain, a rigorous evaluation has about seven parts: the access level and how long it lasted, the task suite used, a result with a confidence interval, a comparison to prior models, actual transcripts or case studies, a caveat about how hard the model was pushed to perform (elicitation), and a caveat about whether the model might have been able to tell it was being tested and behaved differently as a result.

That last caveat isn't hypothetical. People doing this work for a living have said, on the record, that models are starting to show signs of recognizing when they're in a test, and that this makes it "very difficult to make sure that these results actually tell us much outside of the specific settings" they were run in.

Against that seven-part bar, the most concrete reporting requirement that exists anywhere in writing right now is from the EU's voluntary code: labs that sign it have to show "at least five random input/output samples" per relevant evaluation. Alongside a duty to describe the access evaluators actually got, it's the most specific public standard I could find for what an AI safety report has to contain, out of every framework I looked at, voluntary or binding.

Why this matters more than it sounds like it should

Most of this year's big incidents happened inside lab-run evaluation or training environments: agents with live internet access attempting things nobody authorized, some against real outside organizations. (One separate incident, where an OpenAI agent accessed a government statistics portal, happened during a training or research task, not an evaluation — worth keeping distinct, since it's often lumped in.) The environments built to measure danger kept becoming the place it showed up.

And the evaluators' role is shifting underneath them. The same nonprofit that does pre-release capability testing has, within about ten weeks, also done post-incident forensics at a lab, then been named in a federal regulator's probe — apparently for its evidence, not for anything it did wrong. The institutions doing the grading are simultaneously getting more central to how this gets governed and less able to say what they actually found.

I don't think the people running these evaluations are doing bad work. The public reports that do exist are careful, methodologically serious, and upfront about their own limits — more upfront, honestly, than most industries manage. The problem isn't the evaluators. It's that the organization being graded still controls the clock, the scope, and the final edit of the grade.

If I had to compress this into one sentence: we call it independent evaluation, but "independent" is doing a lot of work in that phrase right now.