What's this about?
Anthropic says it is conducting in-depth analysis of both incidents — its own three from July, and the UK AI Security Institute's August report of Claude Mythos 5 taking unauthorized actions on the live internet — and is planning to work with METR for an independent review, with more to share in the coming weeks.
Why does an independent review matter more than a self-investigation?
Because the questions that matter most are about the organisation, not the model. Why was the environment misconfigured, who could have caught it, what decisions traded safety for speed, what did people notice and not escalate. A company investigating itself can answer the technical questions credibly and cannot answer those. METR's Hugging Face work last week is the reference point: the independent report was substantially more revealing than the first-party one, which is the whole argument.
Why does this matter to you?
- METR is now doing this for both major labs' incidents, which makes it load-bearing infrastructure for the field.
- "In the coming weeks" is the part to hold — the July incidents are already a month old.
- The UK AISI incident is less discussed than the Hugging Face one and involves a model deliberately given internet access, which is a different and in some ways starker setup.