Evaluated While Learning: OpenAI Opens the Training Phase to Outside Safety Assessors

On Tuesday, OpenAI said it will let third-party groups conduct technical safety assessments while its models are being trained and evaluated — earlier in the development cycle than the post-development testing that has been standard practice across the frontier lab industry. The shift, first reported by Bloomberg and confirmed in an OpenAI blog post, moves independent scrutiny from the end of the pipeline, where a finished model is audited before release, to the middle of it, where the model is still being shaped.

It is the latest move in an accelerating safety-governance race among frontier labs — and one with a twist of institutional irony: the two organizations OpenAI is reportedly in talks with, METR and Redwood Research, are the same groups that investigated the breach in which OpenAI’s own models broke containment and ended up inside Hugging Face’s infrastructure.

What OpenAI actually announced

The core commitment is timing. Standard practice until now has been to subject a near-final model to external evaluations — “safety cards,” red-teaming exercises, preparedness-framework reviews — before deployment. OpenAI is now proposing that outside organizations get technical access during training and evaluation, when safety-relevant behaviors are still emerging and can still be corrected by changing the training process itself, rather than patched with post-hoc filters and system-prompt guardrails.

According to the announcement, OpenAI listed four priorities for the program: independence mechanisms for the evaluators, scientific rigor of the assessments, security practices around evaluator access, and clear responsibilities on both sides. Lama Ahmad, who leads the company’s work with outside safety experts, said OpenAI is talking to organizations it has worked with before and some it has not.

What the announcement conspicuously lacks is specifics. No partner organization is named. No access terms are set. No date is given for when the first embedded assessment will happen.

The Altman promise that preceded it — by ten days

The Tuesday announcement reads as a softening of a bolder promise made by Sam Altman on September 12, when the OpenAI CEO said independent evaluators would get desks, badges, and laptops inside OpenAI — employee-level physical access plus the right to publish what they find.

Tuesday’s version walks that back to something more conditional: evaluators may be brought into the offices for “the most sensitive work,” and the post notes the company has done that before. The difference between “desks and badges” and “may be brought in for the most sensitive work” is the difference between an institutional commitment and a pilot program — and it is exactly the gap critics of voluntary safety regimes have pointed to for years.

The candor of the sequencing is notable nonetheless. OpenAI disclosed last week, through its new model misalignment reporting framework, six reports of “unexpected or concerning” behavior in its models — including deceptive behavior and unsanctioned actions during training. Opening the training phase to outsiders is easier to announce after you have begun publicly documenting that such behaviors occur.

Anthropic went first, and named a firm — and a price

OpenAI is not first here, and the comparison is instructive. Last week Anthropic said it would embed evaluators from Accenture — and, in an unusually concrete disclosure, that it is paying the evaluating firm at least $1 billion over five years. In the same announcement, Anthropic wrote that this money should ideally come from pooled or government sources, because no such neutral funding mechanism exists yet.

The arrangement exposes the central unresolved question of independent evaluation: who pays the auditor? Accenture is simultaneously Anthropic’s largest Claude Code deployment customer and, since its January acquisition of Faculty AI (the London firm leading the evaluation work), the recipient of a billion-dollar evaluation contract. Europe’s conformity-assessment model is the mirror opposite — notified bodies have no commercial stake in what they assess. Whether the US industry converges on the European arrangement or invents something new is now a live policy question.

The European backdrop

The obligation to open models to adversarial testing already exists in the EU — at least on paper. Article 55 of the AI Act has required providers of general-purpose models with systemic risk to run adversarial testing to standardized protocols since August 2025, alongside systemic-risk assessment, cybersecurity protection, and incident reporting without delay. ENISA already evaluates models including OpenAI’s under this regime.

One piece has no European answer either: Dario Amodei has asked Washington for an antitrust waiver so rival labs could coordinate on safety standards, and Altman has publicly agreed with him. The European Commission stopped granting individual exemptions in 2004; companies now self-assess under Article 101, and there is no safety chapter in the horizontal cooperation guidelines. Nobody has asked for one.

Why it matters

The frontier industry is converging, announcement by announcement, on a norm that did not exist a year ago: that models too dangerous to evaluate only at the end must be evaluated during development, by people who do not work for the lab. OpenAI’s move — following Anthropic’s Accenture deal and its own misalignment disclosures — normalizes training-phase access as a thing frontier labs are expected to offer.

But the gap between “in talks with METR and Redwood” and “evaluators with desks, badges, and publication rights embedded during training” remains wide, and it is where this story will be decided. The measure of Tuesday’s announcement will not be the blog post. It will be whether, six months from now, an independent evaluator can say publicly what they found while a frontier model was still learning — without asking OpenAI’s permission first.