Andrew Freedman retweeted
Come join us in getting one of the most important relationships in frontier AI governance right for the world.
I am very excited about embedded third-party assessments! If you're excited too, please come help expand our capacity to work with great 3p organizations. This team is small and has lots of buy in; opportunity for impact is huge! jobs.ashbyhq.com/openai/5c5e…
Andrew Freedman retweeted
Excited to share the results of a recent pilot project with Amazon!
Companies use private safety evaluations to make decisions with big public consequences.
Our review led to several improvements in Amazon’s internal evals.
Thanks to @rahul1987iit for collaboration on this:
AI companies make safety calls based in large part on internal tests they develop themselves. It’s rare for there to be independent assessment of the quality of those tests.
Earlier this year, @Amazon and @AVERIorg agreed to a pilot project in which AVERI assessed the quality of Amazon’s internal safety evaluations. Today we’re releasing the result of that independent review. As a result of this project, Amazon is changing how it tests future models.
Our review of Amazon’s internal AI safety evaluations confirmed several strengths such as topical diversity, and we found the evaluations to be consistent with Amazon’s public statements on them. At the same time, we found areas for improvement:
On attack sophistication, some prompts represented relatively straightforward attack vectors that would test safety filters rather than deeper model reasoning.
On evaluation signal quality, we identified a concern that superficial cues, rather than safety reasoning, may drive some model refusals, so passing these evaluations might not indicate robust safety behavior in novel situations.
On linguistic and stylistic diversity, some multilingual prompts were included, but prompts across risk categories were predominantly in English, and some prompt structures were reused across scenarios.
On evaluation freshness, a small number of prompts contained temporal references that could become outdated.
In response, Amazon reports four changes for future internal evaluations:
Refreshing its test sets to remove redundant prompts and add more challenging adversarial scenarios;
Introducing a tiered difficulty calibration framework;
Expanding multilingual coverage across all risk categories; and
Establishing a quarterly review schedule to identify staleness and incorporate emerging attack patterns.
Why does this matter? A passing grade on an easy test doesn’t tell us much on its own. As the stakes of AI development and deployment grow, we think that this kind of independent evaluation of internal evaluations (“metaevaluation”) will grow in importance.
We appreciate Amazon opening their internal evaluations up to outside review. We hope more companies take this step to help make their models safer.
While no clear standards exist for metaevaluation yet, @AVERIorg is working to change that. We look forward to sharing more pilot results in the coming months and will continue our work developing standards with institutions like @aievalforum.
Read AVERI’s full blog post here: averi.org/ourwork/averi-pilo…
Read Amazon’s blog post on the collaboration here: amazon.science/blog/strength…
There's a new version of this post
This is my Dad’s study. A very large dose of choline through pregnancy (much larger than what is in typical prenatal vitamins) is shown to have amazing results for increasing IQ and decreasing autism.
Labs, lawmakers in both parties, and even the President have said we need independent testing of AI. But as that testing gets underway, what does “good” actually look like for embedded/independent/third party evaluations?
As the architects of the IVO framework, we think a lot about this. Here's my take, the first in a series from @Fathom_org where we’ll go deeper. Give us your input:
fathomai.substack.com/p/inde…
It is really hard to argue with Nathan’s logic here. If Anthropic thinks the legislation was a bad misfire, they should call that out explicitly and explain how that happened and what they are doing to correct it so that they can have credibility next time they bring a policy proposal. It would also be helpful to hear the contours of what the legislation looks like if not a misfire. Though I would understand if Anthropic chose to take a little time with that. If the policy proposal is an honest summation of their wish list, then there is a reckoning with the AI policy and safety community that shouldn’t be brushed over.
Dario — Thank you for taking the time to respond to my previous post. I think it's great when this kind of engagement happens in public rather than on company Slacks, and I hope to see more of it.
I agree that Anthropic isn't best modeled as a profit-maximizer. Your post gave several compelling examples of Anthropic taking competitive hits for safety, and insofar as my previous post suggested otherwise, that's on me. But I don't think I made my main point as clearly as I could have, so let me try again. It comes down to four key claims:
1. Anthropic seems to be racing at breakneck speed to build recursively self-improving superintelligence (RSI). By its own lights, that could kill billions of people or literally destroy the world.
2. Risking destroying the world is very hard to justify. It is only conceivably acceptable if serious attempts to put RSI under robust societal governance are failing.
3. Far from meeting that burden, Anthropic, when push comes to shove, often works to keep governments from tying its hands. It seems to care much more about preventing government overreach than about reducing the risk that it and other AI companies will destroy the world.
4. Even if the AEGIS Act really was an honest mix-up, as you suggest, that is itself a serious problem. It suggests Anthropic isn't treating the governance of this technology with anything close to the gravity it deserves.
In greater detail for those who want it:
1. Anthropic is racing to RSI, and by its own lights that is insanely risky.
Launching RSI could literally destroy the world. That's according to you, your co-founders, and most of your safety staff and capabilities researchers, not to mention many AI researchers outside your walls. You are intentionally trying to create generally intelligent systems more capable than all humans that you claim in six to twelve months “could be capable” of taking over the entire internet before we have the ability to reliably monitor, control, or align them.
“Succeeding” at RSI could kill or permanently disempower billions of people in the near future, including me and everyone I love. Yet Anthropic’s primary focus seems to be marshalling an immense amount of resources and talent in a race to get there first.
2. Risking destroying the world carries an enormous burden of justification.
I believe the vast majority of people do not want Anthropic to do this (to the extent they know what it's doing). Imposing even a modest chance of catastrophe on billions of people who never consented requires an extraordinary justification. The central one Anthropic has offered: someone will build RSI regardless, so it's better for a safety-focused lab to be at the front of the pack, using that position to support strong AI governance. (Other reasons Anthropic has given, like modestly accelerating improvements in healthcare or economic growth, don’t seem remotely proportionate to the risks Anthropic is imposing by its own lights.)
But that argument only works as a last resort. Racing to RSI is only conceivably okay if attempts to institute robust societal governance to manage that race are failing despite your best efforts. A lab that relies on this justification should be a strong, consistent supporter of efforts to enact governance that could bind it, including governance that could slow it and significantly constrain what it does.
3. Rather than supporting efforts at strong regulation, Anthropic has intervened to keep governments from tying its hands.
Anthropic has sometimes helped: it played a very helpful role in passing transparency bills in Illinois and ongoing efforts in Massachusetts, and I'm sincerely appreciative. But transparency is far from enough for a technology that will be the world's most powerful superweapon at best, and an uncontrollable swarm of lethally superintelligent agents at worst. When it matters most, Anthropic has often pushed for weak regulation.
The AEGIS Act is the most obvious example. No highly risky industry is regulated as anemically as AEGIS would regulate frontier AI: not nuclear, not banking, not aviation, not food safety, not the manufacture of explosives. In all of those industries, specialist regulators can address unsafe practices well before they cause harm. AEGIS would bar the federal government from intervening to block unsafe development or deployment of models until there is an "imminent risk" of catastrophic harm, and would require it to meet a demanding burden of proof in court. Worse, AEGIS would also prevent states from picking up the slack. This design makes perfect sense if you're a company trying to minimize the risk that the government can overly constrain you. It makes little sense if you want American democracy to govern frontier AI effectively.
This isn't the first time. The initial version of California's SB 1047 would have let the Attorney General sue to stop developers like Anthropic from imposing unreasonable risks of catastrophic harm. It would also have created a regulatory agency to help set safety standards. Anthropic objected, and helped get both provisions removed before ultimately offering some support for the bill (which I also genuinely appreciate). I’m not saying that Anthropic should have supported 1047 in its initial form; that’s a complex issue and I realize there were questions about whether earlier versions of the bill were less politically feasible. Still, in Anthropic's own words, it helped weaken the bill because "[t]here is a substantial risk that the bill and state agencies will simply be wrong about what is actually effective in preventing catastrophic risk, leading to ineffective and/or burdensome compliance requirements."
The same goes for New York's RAISE Act, whose initial version also would have let the Attorney General sue to stop unreasonable risks of catastrophic harm. Anthropic credits itself as a supporter of RAISE, but it did not support the bill while it was in the legislature, including when it nearly died. After the bill passed the legislature, Anthropic publicly critiqued it, saying "Any state proposals should be narrowly focused on transparency and not overly prescriptive."
Why does Anthropic consistently take the risk of clumsy government action far more seriously than its own repeated warnings that companies like Anthropic will literally destroy the world by racing to RSI?
4. Even if AEGIS was an honest mix-up, that is itself a serious problem.
Your response frames AEGIS as an early draft and a miscommunication. Perhaps you would have strengthened it and narrowed its preemption. (That wouldn't explain Anthropic's interventions to weaken SB 1047 or RAISE, but leave that aside.)
Suppose that's exactly right. A federal framework for governing RSI is one of the highest-stakes documents your company will touch. Your post admits Anthropic "could have handled [these matters] better," but its tone ("This kind of thing happens a lot in large organizations") doesn't reflect the gravity of this issue. Anthropic talks about the need for “operational excellence” in critical areas, and I have a hard time believing that a similarly cavalier attitude would be tolerated while Anthropic was negotiating a key compute deal or preparing its next large pre-training run.
In short
The justification for racing rests on Anthropic fighting for strong governance, and Anthropic's record on regulation points the other way. Together with its breakneck racing, that fits a much darker picture of the company than the one that seems to prevail among your employees. I hope that Anthropic reflects on this picture, supports stronger regulation, exercises extraordinary caution when advocating for weak regulation, and doubles down on its founding purpose of helping the world safely navigate transformative AI together, instead of prioritizing Anthropic’s ability to win a race that imposes intolerable risks on everyone alive.
Very important work from @METR_Evals here. Even with our growing skepticism of large companies, we still tend to believe that they are the experts, and that any lapses in safety and security are more often a case of either market forces pushing stuff to market, or else something more sinister. But I submit something simpler is happening here. Companies, like people, develop blind spots, get stuck in a point of view, and bring bias to their work. I think third-party auditing and verification matters for many reasons, but one is simple: our work gets better when we have great editors.
Andrew Freedman retweeted
Amid upset in the AI safety world over leaked proposals from Anthropic, @chrislehane from OpenAI pounces with an essay calling for congressional action. He continues leaning into Obernolte/Trahan FRONTIER and even nods to kill switches linkedin.com/pulse/raising-b…
If you are ever feeling like you can't have an impact on AI policy, go back to this and remember that @CharlieBull0ck and @_NathanCalvin meaningfully moved the AI policy debate through a series of nerdy weekend tweets.
Charlie is a smart person.
Big news. My take: Anthropic deserves some credit for actually proposing a pretty reasonable AI safety bill; that's more than other frontier labs have done.
But they don't deserve *too* much credit, IMO; this bill is weaker than the Trahan-Obernolte FRONTIER Act in some key ways, and since the political momentum has shifted significantly in the direction of safety since FRONTIER was introduced back in July, I think new bills introduced today should ideally go further than FRONTIER was able to go rather than regressing.
To be fair to Anthropic, the main places where this bill is significantly weaker than FRONTIER are (a) rulemaking (very strong in FRONTIER, almost nonexistent in Anthropic's bill) and (b) the emergency shutdown authority. Even if you take safety seriously, it might make some sense to dial those authorities back if you didn't trust the executive branch to wield them responsibly, because those are the easiest provisions for a hypothetical President who hypothetically might not like a certain frontier AI company to abuse.
There are some improvements over FRONTIER as well; for instance, this bill does specify that auditors are employed on a continuing basis and has better provisions regarding auditor access to information. Happy to see that from Anthropic (although I think their access provision is still a little undercooked and has Fourth Amendment problems).
Overall, I think the embedded auditor bills that get introduced in the coming months are going to be significantly better and more ambitious than this, and I hope Anthropic supports those bills instead of opposing anything that treats catastrophic risks like the serious national security issue they are. Still, it's encouraging to see a frontier lab come this far.
Replying to @AnthropicAI @METR_Evals
SpaceX will probably do the same
Some good news! Potentially amazing news.
Andrew Freedman retweeted
Today, METR is sharing its vision for its version of “embedded assessments” for AI loss of control. The goal of these exercises is to make sure the public receives good evidence about whether or not the AI industry in general is on track to retain control of its AI agents as they become better at improving themselves.
Passing the first-ever IVO framework in CA (SB813) was a huge milestone and the next step is making sure its implementation delivers on its promise.
AI labs are increasingly opening their doors to outside safety evaluations, but California setting the standards for the organizations doing that work sets up the independence, expertise, and accountability the system needs to work.
There’s growing support among frontier labs, states across the country, both parties in Congress, and even the President for independent evaluation of AI to check whether it’s safe, secure, and works as advertised.
As I told @CNBC, government oversight is key, because without it, evaluators could become beholden to large AI labs for revenue and “start rubber-stamping stuff.” Our independent verification organization (IVO) framework sets up the independence, expertise, and accountability needed for this approach to work.
AI’s quiet safety gatekeepers are stepping into the spotlight cnbc.com/2026/10/11/ais-quie…
Andrew Freedman retweeted
This sounds very promising. If I'm reading the tea leaves correctly, we're going to be getting some kind of oversight by independent auditors, and the federal government is going to make sure it has access to important information from those audits. I am not optimistic about the "voluntary" version of this regime; I think in the medium-term we need legislation to require this by law. But it's a relief to see that the White House seems to be coming around to some version of this idea.
In my view, the crucial features for this auditing regime to include if it's going to be effective are:
- Continuous oversight. Coming in and evaluating one of the developer's models thirty days before they deploy it publicly is not good enough; that would not have prevented Hugging Face or similar incidents, and it's not a good way to address risks from RSI or loss of control. The auditor has to be able to assess the risks posed by internal use of the developer's models, not just misuse by the public. That requires continuous, ongoing oversight of the development process.
- Auditor independence. This is not a new concept and we don't need to reinvent the wheel in the frontier AI context. The same rules that guarantee the independence of auditors in other industries should mostly work here.
- Transparency. It's important for the public to know about the results of these audits for a bunch of different reasons. Publish the reports or other outputs, with redactions for trade secrets and national security as necessary.
- Information sharing. One agency in the federal government having access to information about the risks that frontier models pose doesn't do much if that agency doesn't do anything with that information.
- Access to information. The standard "employee-like access," i.e., access similar to the access that a senior safety employee at the company would have, gets suggested a lot and seems about right. There's a lot of work to be done on operationalizing what that means in practice; e.g., what kind of access does the auditor have to records of Slack communications?
Even if this voluntary auditing regime ends up being useless, I hope that we'll learn from the ways in which it doesn't work out what the failure modes are and how we can improve on the model next time. It's an incredibly difficult task, but I think it's extremely important for our society to get as good at it as we can as fast as we can. The best way to do that is by trying something out and then iterating.
🚨 🚨 Super Intelligence Force Vice Chair @skupor details independent security audits, corporate responsibility, and clear expectations for SI companies.
“We’re not just gonna sit around and wait for the companies to tell us they’ve done their work.”
Andrew Freedman retweeted
WHO IS @deanwball?
Our fireside chat at ProgressCon just wrapped. The full recording will be out in the coming weeks. In the meantime, enjoy the video introduction to Dean that played at the start of our excellent conversation:
Andrew Freedman retweeted
couldn’t agree more.
third-party auditing can address at least two things here:
1. The system: is it safe and secure?
2. The company: do its risk management practices hold up, including for the people raising safety concerns?
OpenAI’s January 2026 Raising Concerns policy “expressly prohibits harassment and retaliation” against employees who raise concerns.
bring in a third party to verify it.
right now, the public can debate what happened but cannot verify it -- that takes an auditor’s access.
get the audit frameworks right and accountability follows.
openai.com/index/openai-rais…
Add this to the ever-growing list of things it'd be great to have more transparency on, but one lesson is clear:
For everyone involved – labs, researchers, and third party evaluators – the rules of the road for working with external evaluators have to be set by someone other than the labs.
Andrew Freedman retweeted
AI is increasingly helping build the next generation of AI. For people to trust it, those in charge need to understand what’s being built.
AI now writes 75%+ of new code at Anthropic, OpenAI, and Google. Meanwhile, in open-source AI projects, the number of review comments per line of code has dropped by roughly half since early 2024, which means human review might not be keeping pace.
Our Senior Advisor @ghadfield, @ronbodkin, and @bahradx have an idea called comprehension audits. Independent auditors select important pieces of AI R&D work, and the teams responsible have to explain what they built, how they built it, and what they learned, kind of like defending a thesis.
The bar is practical: teams must demonstrate meaningful understanding of their own work, including its design, implementation, and results, without being expected to explain every aspect of model behavior.
This isn’t to punish individual researchers. It's to identify gaps in understanding. If a team can't demonstrate adequate understanding, the affected work and any dependent releases are held until the gaps are addressed.
Through a mix of targeted and random spot checks, independent auditors can help catch problems without having to review everything.
Having humans in the loop isn't enough if they don't understand what they're approving. Independent verification can help make sure that human oversight actually means something.
Replying to @ronbodkin
Claude leads 26% of Anthropic's R&D and at least collaborates on 90%+. Dario Amodei says recursive self-improvement "is starting to happen across the industry."
New preprint with @ghadfield and @bahradx on how to respond: arxiv.org/abs/2610.10064 (2/11)





























