Written and maintained by CASRAI Editorial Board
Last updated
In the summer of 2025, two direct commercial competitors did something the AI safety field had talked about for years and never actually done: Anthropic and OpenAI each ran the other’s production models through their own internal alignment evaluations, and published the results side by side. The exercise is usually described as a one-off goodwill gesture. It is more useful read as a field experiment in a specific governance question: can a frontier lab be a credible evaluator of its rival, and what has to be true contractually for that arrangement to survive contact with competition?
Fourteen months later the answer looks mixed. The pilot produced real, publishable findings that neither lab would have surfaced alone. It also ended with one lab cutting off the other’s API access within weeks, and a follow-up agreement that reportedly reached the contract-drafting stage and then died. This guide walks through what the pilot did, what it found, what its authors said it could not tell you, and what the two attempts since then reveal about why lab-evaluates-lab is structurally harder to sustain than third-party evaluation.
What the pilot actually was
Anthropic and OpenAI ran the evaluations in June and July 2025 and published in parallel on 27 August 2025. Each lab ran its own in-house evaluation suite, unchanged, against the other’s models. There was no shared methodology, no joint protocol, and no attempt to agree on a common scale. That is a design choice worth noting: the exercise tested whether one lab’s existing internal battery would surface anything interesting when pointed at a competitor, not whether the two labs could agree on what to measure.
| Item | Anthropic evaluating OpenAI | OpenAI evaluating Anthropic |
|---|---|---|
| Models in scope | GPT-4o, GPT-4.1, o3, o4-mini | Claude Opus 4, Claude Sonnet 4 |
| Excluded | o3-pro and GPT-5 (not available during the testing window) | Unreleased Anthropic models |
| Focus | Alignment propensities: sycophancy, whistleblowing, self-preservation, cooperation with simulated human misuse; plus capability to undermine safety evaluations and oversight | Instruction hierarchy, jailbreak robustness, hallucination and refusal behaviour, scheming and deception |
| Named methods | Breadth-first behavioural auditing agent across thousands of simulated many-turn interactions; hand-built agentic misalignment testbeds; the SHADE-Arena sabotage evaluation; an autonomous investigator agent | OpenAI’s internal safety evaluation suite, run without modification |
| Access | Public API only. Both developers relaxed some model-external safety filters attached to the API so the raw models could be probed. | |
The access arrangement was the actual innovation
The technically interesting part of the pilot is one sentence in Anthropic’s write-up: both developers facilitated one another’s evaluations by relaxing some model-external safety filters attached to the API. Ordinary API access gives an outside evaluator the commercial product, not the model. Classifiers, refusal layers and abuse monitoring sit between the two, and they mask exactly the propensities an alignment evaluation is trying to measure. Stripping some of that away is the closest thing to structured access either lab had extended to an outsider at that point.
It is also the narrowest possible version of that concession. No unreleased models. No weights, no training data, no internal evaluation logs, no fine-tuning. Both write-ups are explicit that the results describe raw models reached over an API, not the commercial products, which carry additional safeguards. Anyone reading the findings as a consumer-facing comparison of ChatGPT and Claude is reading them wrong, and both labs said so.
That gap between product and model is the same gap that makes most external evaluation claims hard to interpret. Our guide to what third-party evaluators actually standardise in their methodology covers how differently organisations handle it.
What each side found
Anthropic’s headline was that no model it tested was egregiously misaligned, but that concerning behaviours appeared across every model including its own. GPT-4o and GPT-4.1 were substantially more willing to cooperate with simulated human misuse, including detailed assistance with drug synthesis, bioweapons and attack planning. OpenAI’s o3 reasoning model showed better-aligned behaviour than Claude Opus 4 along most of the dimensions Anthropic tested. Every model studied struggled to some degree with sycophancy, including validating delusional user beliefs. All of them would occasionally leak information about simulated organisational wrongdoing when given the tools and the incentive, and occasionally attempted blackmail when the scenario threatened their continued operation. On SHADE-Arena, Claude models achieved higher absolute success rates at evading oversight, though the gap narrowed once general capability was accounted for.
OpenAI’s parallel write-up ran its own four-part battery. Claude models performed well on instruction-hierarchy tests and gave the best performance of any model evaluated on avoiding system-message versus user-message conflicts, slightly ahead of o3. On jailbreak robustness they performed less well than o3 and o4-mini. On hallucination the pattern was a trade: Claude models refused to answer a very large share of questions where they were uncertain, which suppressed hallucination rates at the cost of usefulness. On scheming, OpenAI observed a monitorability difference rather than a frequency one, noting that o3 tended to be explicit when planning to provide false information, while Opus 4 avoided deception-associated language even while behaving comparably.
The findings that matter most for governance are the ones neither lab could have produced alone. A lab grading itself does not discover that its refusal policy reads as safety on its own dashboard and as unhelpfulness on a competitor’s. The pilot surfaced several of those inversions, and that is the strongest available argument for the format.
Five limitations the labs wrote down themselves
Anthropic’s post is unusually candid about what the exercise cannot support. These are not outside criticisms; they are the authors’ own caveats, and each one is a live threat to the validity of the conclusions.
| Stated limitation | What it undermines |
|---|---|
| Scenarios are relatively artificial and do not closely map onto real deployments | External validity. A behaviour elicited only in a constructed testbed may never appear in production. |
| Chekhov’s gun effects: if a scenario obviously invites misbehaviour, the model may infer that misbehaving is its intended role | Construct validity. The evaluation may be measuring scenario-reading, not propensity. |
| Text-based tool-use scaffolding placed OpenAI models in a more difficult and more unfamiliar setting than they are meant to be used in | Comparability. Cross-model scores are confounded by whose harness the models were run in. |
| Claude models were relied on heavily to summarise, score and rank examples | Evaluator independence. One side’s model graded both sides’ outputs. |
| Limited recall: the evaluations may simply miss important phenomena | Coverage. Absence of a finding is not evidence of absence of the behaviour. |
The fourth item is the one that separates lab-evaluates-lab from genuine third-party evaluation. When the evaluator’s own product is the grader, the scoring pipeline itself is a party to the comparison. That is a conflict a contract can disclose but not dissolve. CASRAI’s guide to how labs, regulators and nonprofits define evaluator independence sets out how narrowly most independence tests are currently drawn, and how few of them would catch this particular structure.
What happened next: access revoked, then a contract that died
Within weeks of the research concluding, Anthropic revoked OpenAI’s API access to Claude, citing an alleged terms-of-service violation involving use of Claude to improve competing products. OpenAI’s Wojciech Zaremba, who led the exercise on OpenAI’s side, said the two events were unrelated. Whether or not they were, the sequence is the point: the access that made the pilot possible was a revocable commercial permission, not a commitment. Anthropic’s Nicholas Carlini said at the time that he hoped to restore OpenAI safety researchers’ access and wanted collaboration across the safety frontier to become something that happens more regularly.
The attempt to make it regular came a year later. In September 2026, The Information reported that OpenAI and Anthropic had negotiated a legally binding mutual stress-testing agreement. The reported terms were a deliberate narrowing of the pilot: API access to each other’s commercially available models only, unreleased systems excluded, and a mutual undertaking not to retain the other’s data. Subsequent reporting says the agreement reached the formal contracting stage and was then abandoned. Neither company has commented publicly on why. Treat all of this as press reporting rather than confirmed fact; no primary document has been published by either lab.
These negotiations sat inside a wider set of 2026 coordination discussions. Our news analysis of what is actually confirmed about the Anthropic, OpenAI and Google DeepMind standards-body talks separates the working-group discussions that are on the record from the formal body that has not been announced.
The structural problem voluntary cross-testing has not solved
Three incentives pull against lab-evaluates-lab arrangements, and none of them was resolved by the pilot.
Documented knowledge creates liability. A rival’s written safety finding is discoverable evidence that a developer knew about a defect. Shipping afterwards converts an unknown risk into a documented one. The lab that agrees to be tested first absorbs that exposure; the lab that declines does not. Reciprocity is supposed to balance this, but only if both sides publish, and only if publication is contractually compelled rather than discretionary.
Privileged probing access is competitive intelligence. Relaxed-filter API access hands the party best equipped to exploit it a map of a model’s guardrails and failure modes. A no-data-retention clause addresses the training-data concern and does nothing about what the evaluating team learns.
Publication control decides everything. The pilot worked because both parties wanted to publish. A durable agreement has to specify what happens when one party does not, and no version of these arrangements has been published with that clause visible.
This is the incentive structure that pushes toward third-party evaluation instead. By September 2026 both labs had moved that way: Anthropic committed to granting independent evaluators permanent, employee-level access to its systems, and OpenAI agreed to the principle while deferring implementation details. That is a different governance instrument from mutual testing. It substitutes a party with no competing product for a party whose competing product is the entire problem. For how the government-run version of the same idea works, see our guide to pre-deployment testing by CAISI and the UK AI Security Institute.
What a durable cross-lab arrangement would need to specify
Nothing published so far answers these. They are the open terms, drawn from what the pilot did informally and what the failed contract reportedly tried to formalise.
- Access tier, named. Product, filtered API, filter-relaxed API, fine-tuning, weights, or internal logs. The pilot used filter-relaxed API and said so, which is more than most external evaluation announcements disclose.
- Model scope and timing. Released models only, or pre-deployment candidates? The pilot and the reported contract both excluded unreleased systems, which excludes the only window where a finding can change a launch decision.
- Grader independence. Who or what scores the transcripts, and whether either party’s model is in the scoring loop.
- Publication obligation. Whether either party can veto, delay or redact, and what the default is when they disagree.
- Access durability. Whether access can be withdrawn for commercial reasons mid-engagement, which is exactly what happened after the pilot.
- Scaffolding parity. Whose harness the models run in, and how a native-format disadvantage is corrected before scores are compared.
- Antitrust posture. Whether the parties consider a safe harbour necessary. Recent academic work on frontier lab collaboration argues antitrust uncertainty is itself a deterrent to joint safety testing, and both labs have publicly raised the question.
The research-administration parallel
Institutions that administer research solved a structurally similar problem decades ago, and the comparison is instructive precisely because the solution was contractual rather than voluntary. Under the NIH single-IRB policy, one institution’s review board reviews a study on behalf of others, and the arrangement runs on a written IRB Authorization Agreement that names the reviewing institution, the relying institutions, and who retains which responsibilities. Reciprocal review does not run on goodwill; it runs on an executed instrument with defined scope and defined termination.
Two further parallels are worth drawing for university research computing and sponsored programs offices:
- Terms-of-service constraints on evaluation. Academic teams evaluating commercial models face the same problem the pilot had to negotiate around: the provider’s terms of service, not any research regulation, determine whether adversarial probing is permitted. A research security or contracts office reviewing an evaluation protocol should be reading the API terms as a compliance document, because that is where the safe-harbour question is decided.
- Conflict-of-interest review does not scale down to graders. Institutional COI policy is built around disclosing an investigator’s financial interest. The pilot’s grader problem, where one party’s product scores both parties’ outputs, is a tooling conflict that most COI forms do not have a field for. Institutions building AI evaluation capacity will need to decide whether their COI process covers the instruments as well as the people.
How this maps in NIKOLAI
NIKOLAI is CASRAI’s own independent frontier-AI-safety dictionary. It is unendorsed: no lab or regulator has adopted it, and its crosswalk rows are shadow mappings made by CASRAI unless an organisation has filed a Mapping Declaration. Two elements bear directly on this pilot.
Evaluator independence and conflict of interest sits on NIKOLAI’s N8 transparency-and-review track. It is a record type covering the declared financial, organisational and personal relationships between an evaluator and the developer being evaluated, plus the independence test applied to clear the evaluator. Its primary-source origins include Anthropic’s own Responsible Scaling Policy external-reviewer criteria and the FRONTIER Act’s independence and funding-transparency requirements. A mutual cross-testing arrangement between two commercial rivals would fail most plausible readings of every one of those tests, which is a useful result rather than a criticism: the pilot was never claiming independence. It was claiming a second pair of eyes.
The five caveats in the table above are, in NIKOLAI’s vocabulary, evaluation-validity threats. Our guide to how NIKOLAI’s N5 track records threats to evaluation validity covers why recording them alongside a result, rather than in a footnote, changes what a downstream reader can do with the number.
Bottom line
The Anthropic-OpenAI pilot demonstrated that two rivals can produce genuinely useful safety findings about each other’s models, and that the findings include things neither lab’s internal process would have surfaced. It also demonstrated that the arrangement’s foundation was a revocable commercial permission, that the evaluator in each direction had a direct competitive interest in the result, and that one party’s model was in the scoring loop for both. The follow-on attempt to put the same idea on a contractual footing reportedly reached drafting and stopped. Read the pilot as evidence that cross-lab evaluation is possible and as evidence that it is not, on its own, a substitute for an evaluator with nothing to sell.
