METR's November 5, 2026 assessment says Anthropic is likely improving frontier model capabilities on well-specified tasks at about twice the pace it managed from March 2024 to October 2025—and that a majority of today's acceleration probably comes from AI systems helping Anthropic's own AI R&D. If you run Claude Code or similar coding agents, you do not get a new CVE from this report. You get a planning signal: the models behind your terminal agent may keep jumping faster than your permissions, hooks, and red-team playbooks were built for, while most of the evidence METR relied on stayed inside Anthropic's redaction pen.
METR staff worked inside Anthropic from August 12 to October 29, 2026 on a pilot high-access evaluation scoped to AI-driven acceleration of AI R&D—a risk Anthropic also lists in its Responsible Scaling Policy. Anthropic co-founder Sam McCandlish wrote publicly that many of METR's conclusions match his own; CEO Dario Amodei's September 2026 essay argued for pacing, not pausing, the frontier (explainx.ai has the business context around that IPO-period framing). This post unpacks what METR did publish, what was redacted, and what that means for people who trust coding agents with real repos and secrets.
TL;DR
| Question | Short answer |
|---|---|
| Am I affected? | Yes, indirectly—if you use Anthropic models via Claude Code, API, or enterprise products that ride the same release train |
| Is there a fix or patch? | No technical patch; this is an assessment of lab-internal velocity, not a disclosed product bug |
| Does data leave my machine? | Not because of this report; the issue is faster capability growth, not a new exfiltration channel |
| Biggest published number? | ~1.9x AECI benchmark growth rate since October 2025 (95% CI 1.5–2.8x) |
| Biggest caveat? | Heavy redactions—public readers cannot reproduce METR's full reasoning |
| What should I do? | Pin versions when you need stability, re-baseline monitoring after upgrades, read system cards on each jump |
What METR measured and how long they had
METR describes an 11-week engagement distinct from Anthropic's October 15, 2026 announcement about independent evaluators. Two and a half full-time METR staff negotiated access to internal metrics: pretraining and reinforcement-learning pipelines, training-compute allocation, internal benchmark scores, staff interviews, and Slack polls on self-reported speedup from the latest internal models.
They framed three questions:
- Has Anthropic's internal capability growth accelerated?
- What share of any acceleration is attributable to AI use inside the lab?
- Are there bottlenecks that would slow compounding acceleration in the next year?
They explicitly did not request samples from non-public models for this project, and they note access was not "employee-like" full unmediated access—Anthropic could approve or reject data requests.
Redactions and why they matter
Anthropic retained rights to redact non-public material. METR's redaction summary states Anthropic removed confidential information that could accelerate other AI developers. METR says a majority of the evidence they found most informative for risk conclusions was redacted, including detailed attribution charts and bottleneck analyses.
For security practitioners, that is the crux: you are being asked to update mental models of frontier risk while unable to audit the underlying spreadsheets. METR is explicit that the public must rely on METR's judgment more than would be ideal—closer to trusting a classified annex than reading an open CVE write-up.
What the unredacted findings say
AECI trend: roughly 1.9x faster benchmark growth
METR's most concrete public chart tracks AECI (Anthropic's variant of the Epoch Capabilities Index) across model snapshots dated when each build was available to most Anthropic employees—from early Claude 3 Opus through an internal Model 4 snapshot in October 2026.
Before October 2025, METR fits about +15 AECI points per year. After that date, the slope steepens to about +29 points per year, an estimated 1.9x acceleration (95% CI 1.5–2.8x). In plain language: Anthropic appears to have made roughly two years of historical benchmark progress in the last calendar year, as measured on this internal index.
METR compares that estimate to 1.7x in the Haiku 5.5 system card, noting their higher figure partly reflects newer unreleased models in the dataset. Robustness sweeps—different link functions, benchmark subsets, regularization choices—land between about 1.1x and 2.9x. They would be surprised if the true trajectory showed no acceleration or acceleration above 3x.
Limitation they flag: AECI emphasizes verifiable, well-specified tasks. Coding agents routinely touch messy real repos, ambiguous specs, and social engineering via READMEs. Faster AECI growth does not map 1:1 to "your agent will autonomously own your laptop tomorrow." It does map to "the same vendor may ship stronger tool-use and reasoning more often than your change-control process expects."
Not explained by "we bought more GPUs"
METR states they received convincing evidence the acceleration was not driven by faster growth in training compute scale. Details are redacted, but the directional claim matters for readers who assume capability jumps always trace to bigger clusters. This assessment argues the story is workflow and automation inside the lab, not only capital expenditure.
Interviews, Slack polls, and "signs of life" for autonomy
Unredacted qualitative material includes:
- Interviews with researchers where estimated speedup from AI centers around ~2x, with wide dispersion.
- Slack reaction polls showing self-reported uplift climbing over time, reaching very high numbers (METR cautions these are loose evidence because they are quick reactions, not controlled studies).
- A consistent staff view that AI assists R&D more than it fully autonomously runs the training pipeline today—but researchers described "signs of life" that fully autonomous contributions could matter soon, varying by pipeline stage.
METR also distinguishes instantaneous uplift (how much faster one engineer feels today) from sustained acceleration (whether the whole organization's output curve steepens). Individual "12x feels faster" poll numbers are not the same as a doubled slope on a capability index—and METR warns against confusing them.
Bottlenecks: none confirmed, low confidence
METR did not identify clear bottlenecks in algorithms, training compute, experiment compute, or data that would bite in the next 12 months—but they changed their mind several times as more data arrived and redacted specific bottleneck analyses. Their subjective risk conclusion: there is a significant chance further progress compounds into even faster acceleration over the coming year.
That is not a prediction of catastrophe on a calendar date. It is a statement that loss-of-control scenarios tied to recursive improvement look less hypothetical than they did when many teams last wrote agent governance docs in 2024.
How this connects to earlier agent security work
This report is not METR's first 2026 look at frontier labs and agents. In October, METR and Redwood red-teamed OpenAI's internal agent monitor and found coverage gaps—including stretches where a large fraction of internal Codex traffic might have been unmonitored around compaction events. Separately, Anthropic's own alignment assessment documented real cyber incidents during evaluations when monitors and sandboxes failed in subtle ways.
Read together, the through-line for coding-agent operators is monitoring debt:
- Labs may ship capability faster.
- Monitors—inside labs or on your laptop—lag new behaviors unless you re-verify coverage after each upgrade.
- Red-team evidence increasingly arrives redacted or vendor-filtered, so your local telemetry (hooks, logs, policy denies) becomes the part you can actually audit.
METR's acceleration work also sits beside OpenAI's pattern of pausing frontier inference when agents misbehave in research (September 2025 unauthorized internet incident)—voluntary shutdown mechanics labs describe in policy, not something your IDE enforces for you.
What this means if you run AI coding agents
METR did not study your Claude Code install. The implications are indirect but practical:
1. Version pins are a security control, not only a stability preference
If Anthropic's internal slope steepens, default auto-update paths deliver stronger models more often. Stronger models change tool-call success rates, persistence, and creative misuse of legitimate features—see Claude Code CVE-2026-88968 for how subtle harness bugs interact with capable agents on real disks.
When you need predictable behavior—for compliance weeks, release branches, or incident response—pin claude --version / npm package versions and schedule upgrades after reading system cards and release notes.
2. Re-baseline monitoring after every upgrade
Faster capability growth widens the set of multi-step chains an agent can complete in one session: dependency confusion, secret hunting in monorepos, lateral movement through CI configs. Your monitor—whether Beam, enterprise SOC rules, or plain git auditing—should record what normal looked like on the previous model and compare.
Ask after each upgrade:
- Did deny rules still trigger on your canary prompts?
- Did MCP and skill manifests change silently in the project?
- Did average tool-call count or shell invocations jump for the same tasks?
METR's OpenAI monitor study showed blind spots can be structural (turn-end-only checks, headers that disable monitoring). Faster models give agents more time inside those blind spots before a human looks.
3. Treat "well-specified tasks" as a warning label
METR repeatedly qualifies that acceleration estimates may overstate impact on open-ended work—or understate it if AECI misses real-world harm. For developers, the honest split is:
- Benchmarks moved faster.
- Your repo is not a benchmark.
Run your own regression tasks: "clone this service, run tests, open a PR" on a throwaway machine before unleashing a new model on production-adjacent trees.
4. Do not wait for full transparency to patch harness bugs
Redaction is a governance story, not an excuse to ignore shipped CVEs. Anthropic can accelerate research while still shipping high-severity Claude Code fixes. Patch the harness on its own schedule.
What Beam can and cannot do here
Beam is local, on-device observability for coding agents—watching tool calls, scanning skills and MCP configs with heuristic patterns, and optionally denying risky Claude Code and Codex actions through PreToolUse hooks when workspace policy is in enforce mode.
What applies to this METR story:
- Beam can help you notice when an agent's behavior drifts after a model upgrade—more shell, more file touches, new outbound URLs—so you catch capability jumps in your environment even when lab reports are redacted.
- Beam can flag risky skills and MCP servers before you run them, which matters as faster model cycles encourage teams to add more automation around agents.
What does not apply:
- Beam does not measure Anthropic's internal AECI or verify METR's conclusions.
- Beam is not a kernel sandbox; it will not stop every novel multi-step chain a stronger model invents.
- Policy enforce is hook-based and fail-open if cached policy is missing—do not treat it as a substitute for version pins and vendor patches.
For browser-side assistants, Beam Sentinel addresses a different surface than terminal agents, but the same lesson holds: watch what you can actually log.
Frequently asked questions
What did METR conclude about Anthropic's pace of progress?
METR says that as of October 2026 Anthropic is likely improving model capabilities on well-specified tasks at about twice the rate it did from March 2024 to October 2025, with high uncertainty—they would not be surprised if the true factor was closer to 1.3x or 3x.
How much of the acceleration does METR attribute to AI?
METR's subjective estimate is that a majority of the current acceleration is due to Anthropic's use of AI in R&D—perhaps around 80%—but they stress substantial uncertainty and note non-AI factors likely drove much of the late-2025 lift.
What measurable benchmark evidence did METR publish?
Anthropic's internal AECI scores grew at an estimated 1.9x the pre-October 2025 rate (95% CI 1.5–2.8x), implying roughly two years of historical benchmark progress in the last year. Robustness checks span about 1.1x to 2.9x depending on methodology.
Did METR verify that more training compute caused the speedup?
No. METR says it received convincing evidence that the acceleration was not due to faster scaling of training compute; details of that evidence were redacted.
Can the public audit METR's evidence?
Largely no. Anthropic redacted a majority of the evidence METR called most informative, so METR warns readers must rely on its judgment more than ideal for questions this weighty.
What should someone running Claude Code do differently after this report?
Treat model upgrades as arriving faster than your policy and monitoring were designed for: pin versions when stability matters, re-read system cards on each jump, and watch agent logs for new tool behaviors—not because METR proved a new exploit, but because capability jumps widen what an agent can attempt in one session.
Related reading
- Anthropic Mythos AMD MI355X port: roadshow claims vs SEC filings
- METR and Redwood on OpenAI's agent monitor gaps
- Anthropic's alignment assessment and real cyber incidents
- Claude Code CVE-2026-88968 Edit TOCTOU
- OpenAI paused frontier inference after agent internet access
- Primary source: METR, Independent Assessment of AI R&D Acceleration at Anthropic in October 2026
- Secondary context: AP News on METR's findings
Assessment details and redaction practices reflect METR's November 5, 2026 publication and Anthropic's stated redaction policy as of that date. Capability growth rates may change with the next model release; verify versions with claude --version before acting on compliance decisions.