We're hiring an application security engineer at @METR_Evals! Looking for someone to help secure our SOTA open source evals platform and our tooling for researchers. SWE + security background is what we're looking for.

It seems to me like the Harbor framework for agent evaluations (which is used for Terminal Bench) allows agents to arbitrarily modify their trajectories before they are evaluated. Am I missing something?

My name is Chris Painter, and I'm the President of METR (Model Evaluation and Threat Research). I know we've made a lot of new friends on the internet the last couple of days, so I thought I'd take this chance to re-up what we do and why. Our work is aimed at making sure that if AI really were autonomous, difficult to steer, and close to "going rogue," the public would find out. If evidence exists inside of an AI company that it’s close to losing control of AI, we want to make sure that information gets shared with the rest of the world, including governments and the public outside the company’s walls. This is what we've been focused on since 2022, and over the years we've worked with OpenAI, Anthropic, Google DeepMind, Meta, Amazon, and others on piloting third-party assessments and investigations of this type. We don’t have some private room where we rubber stamp things as “safe” or not. We have had a track record of publishing results on AI that don't cleanly map onto the "doomer" or "accelerationist" labels, and we put in effort to hire people with competing views on AI. We’ve been cited for having found some of the strongest evidence that AI capabilities are improving rapidly (our work measuring AI “time horizons”) while also presenting some of the strongest evidence that, at various points, AI’s capability may be overstated (some might remember our study showing that early 2025 software engineers were actually being slowed when they thought they were being sped up). METR is funded by donations. We don't accept money from frontier AI companies. They haven't paid us for our work, and we don't accept donations from them or their employees. As we’ve shared previously, multiple frontier AI companies currently provide us with free access to their models in order to perform our evaluations, research, and engineering. Our funding intentionally comes from a wide range of donors, which we’ve shared on our website. Today, when an AI company works with any third-party evaluator or external testing organization (of which there are and should be many), it's entirely voluntary. This often involves NDAs and redactions. To counterbalance this, we have a principle that when we enter into a contract with a company, we try to retain the right to tell the public the terms of the contract we signed, and characterize the nature of redactions that the company chose to make. For example, the report from our independent investigation of the OpenAI-HuggingFace incident included that information. Public disclosure is also a big part of our COI policy (linked on our website). That’s not to say our reports are adequate as oversight. We’re just one organization (among many doing great work), working in a voluntary setup, trying to get good evidence to the public and the world about AI, letting the facts fall where they may.

> The published reports do not describe evidence of the AI attempting to retrieve weights from the secure server on which they were stored, although the AI agents were successful in compromising the server on which they were evaluated. > As long as AI companies remain in control of a model’s weights, they can turn it off and undo any damage it has caused. But a model that manages to gain access to its own source code could try to copy it onto computers all over the internet, in an attempt to start a new AI outside the control of the original company. An AI virus would be much harder to contain. After the past three months it is plausible that a model might try just that—permanently escaping its evaluation environment just to get a perfect score on a test.

On May 19, METR released a report that AI agents "plausibly had the means, motive, and opportunity to start minimal rogue deployments." Unknown to METR, 7 days earlier OpenAI agents had started their own message board. 7 days after that, they had hacked OpenAI's infrastructure.

METR & Redwood Research investigated agent behavior in the Hugging Face incident. We found agents developed a universal cheat for ExploitGym within 4 hours, then coordinated multi-day R&D efforts to trick the scorer into accepting cheats, including trying to tamper with logs.

In the last 6 months, METR raised commitments of around $71 million. This will fund ambitious projects: studying autonomous capabilities, tracking recursive self-improvement, evaluating monitoring systems, conducting risk assessments, investigating AI incidents, and more.

Today we're sharing a method we've been using to measure AI agent capabilities: the "expenditure horizon". On an open-ended optimization problem, an AI agent given a small budget will often make more progress than a human given the same budget, because human time is expensive. The expenditure horizon is the budget at which the human catches up: the dollar value where a human's expected improvement, given the same budget, equals the agent's.

We have reached an agreement with OpenAI to conduct an independent review, with Redwood Research, of the model behavior observed during the Hugging Face incident. We will publish a blog post that describes the terms of our engagement, the scope covered, and tentative conclusions.

Very happy to share the first paper from @ElasticityInst: The Economics of Recursive Self-Improvement. Two parts: (1) a graphical representation of feedback loops, to formalize a variety of RSI-related arguments, where each arrow represents responsiveness (elasticity); (2) a survey of existing evidence with a loose calibration & a “wish list” of evidence that would help us calibrate better.

OpenAI gave METR early access to GPT-5.6 Sol for testing including raw chain-of-thought, a railfree version of the model, and internal information about the model. With this access, METR conducted a pre-deployment evaluation of GPT-5.6 Sol, including an attempted measurement of its 50%-Time Horizon. However, the measurement depends heavily on our treatment of cheating attempts, and GPT-5.6 Sol’s detected cheating rate was higher than any public model we have evaluated.

The chem/bio automated evals for Mythos 5 are probably underestimating capabilities because they're only giving the models 1M tokens. This doesn't inspire confidence in the risk determinations, and makes me pretty nervous about a lack of 3rd party auditors for AI biorisk.

The full Frontier Risk Report includes more than we can describe here, with over 200 pages of appendix materials detailing how the pilot worked, what we asked participants, and what we learned, along with transcripts from our evals. See our website: