Trust Me, I Had Access

Public institutions still make the decisions. The labs increasingly decide what those institutions can know before they make them.

In February, Anthropic ran three separate research teams. The Frontier Red Team stress-tested what its models could do. Societal Impacts studied how they were being used in the world. Economic Research tracked their effect on jobs. By 11 March the three were one organization, the Anthropic Institute, reporting to co-founder Jack Clark in a new role as Head of Public Benefit [1].

Then the hires. Matt Botvinick, a resident fellow at Yale Law School who had been a senior research director at Google DeepMind, to lead work on AI and the rule of law. Anton Korinek, the Virginia economist, on how transformative AI alters economic activity. Zoë Hitzig, from OpenAI, connecting economic research to model training [1]. Andrew Hall, the Davies Family Professor of Political Economy at Stanford, took leave to join the Rule of Law team and study what he calls the political economy of superintelligence [2]. Alan Rozenshtein took leave from Minnesota Law for the same team [3].

The other labs moved in parallel. In May, Alex Imas became Director of AGI Economics at Google DeepMind on Shane Legg’s team, with a brief covering labor, the distribution of wealth and power, and how institutions adapt; he remains a professor at Chicago Booth [4]. In June, Dean Ball left the Foundation for American Innovation, where he had landed after drafting the White House AI Action Plan, to build a team at OpenAI called Strategic Futures, reporting to the chief strategy officer, with labor-market effects in its remit [5].

Each move is defensible on its own terms, and the researchers involved are not naive about what they have joined. The labs face real questions about labor, law, and institutional design that model benchmarks cannot answer, and they need people trained to ask them. The researchers gain access to the systems most likely to transform the subjects they study.

Universities have been losing machine-learning faculty to industry for a decade, and The Information counted at least twenty-two professors leaving or taking leave from elite schools for the four largest labs in the first half of 2026 [6]. Read as another instalment of that story, this is unremarkable. But the economists, lawyers, and political scientists inside that count are a different category from the capability researchers, because their object of study is the firms themselves.

Three kinds of independence

The word independence is doing several jobs here, and separating them explains why the usual reassurances land where they do.

Independence of employment means the researcher is not on the payroll of the thing being studied. That one is straightforwardly gone, and everybody involved says so openly.

Independence of speech means the researcher can publish an unwelcome finding without losing the job. This one is being defended carefully and, in several cases, visibly. Ball kept a non-resident fellowship at the Foundation for American Innovation and the right to publish [5]. Hall runs his Free Systems lab, funded entirely by Stanford, separately from his Anthropic work, and in January he had written that Claude’s constitution was not a constitution at all, since Anthropic writes it, interprets it, enforces it, and can rewrite it whenever it likes [2][8]. He has not retracted that. These are not people who arrived intending to go quiet.

Independence of verification means somebody other than the researcher can check the finding. It has attracted almost no defense, because it has rarely needed a name. Where the underlying data is public, replicable, or held by a party that is not the subject of the finding, verification is at least available, and the question rarely has to be posed. What the arrangement now constrains is not the researcher’s mind. It is the researcher’s instrument.

The labs describe the advantage accurately

Anthropic has been the most explicit about the position it holds, which is to its credit and is also why it supplies the clearest evidence. The Institute’s launch note states that it has access to information that only the builders of frontier AI systems possess, and says it intends to use that position fully [1]. A job posting for the rule of law team is blunter: the Institute sits inside a frontier lab, and, in its own words, does not just study AI from the outside but from within [7].

Both statements are true, and as recruitment they are effective. The claim they intend is that the work is better from here. The claim they cannot help making is that the most valuable research position on this subject is now inside the company, and that anyone who declines the offer is working with less. That describes nobody’s bias. It describes where the instruments are.

The dual-affiliation answer

The strongest reply is that this problem has already been solved, and the solution is visible in the arrangements themselves. Keep the university chair. Keep the lab. Keep the right to publish. Fund outside work generously, as Anthropic does through a five million dollar program for independent research into how its systems affect wellbeing, which supplies money, model access, and technical support, requires open-source outputs, and forecloses any company veto or embargo on findings [9]. Publish an index of your own usage data, which Anthropic also does [11]. A researcher who holds both positions gets the vantage point and keeps the freedom to say what they see.

In August the argument acquired its strongest instance. Anthropic disclosed a pilot, begun in February, in which three outside groups, the SALT Lab at Stanford, the Human Information Processing Lab at Oxford, and METR, designed and ran their own studies against roughly two hundred and fifty thousand real Claude conversations, through Anthropic Insights, the privacy-preserving tool the company’s own teams use. The researchers wrote their own questions. Anthropic released the aggregate data, audited the privacy protections, and says it hopes to expand the program [10]. It also says, plausibly, that this is the first time external researchers have run public independent studies on an AI company’s own usage data.

This is closer to the fix than anything else on the record, and it is candid about its own limits. The researchers never saw a conversation; Anthropic ran the queries on their behalf. The company’s contractual review rights covered user privacy, material that could enable usage-policy violations, its own confidential information, and research accuracy. That last term is the one worth watching, and the public record does not settle what it means: it may require only that a paper not misdescribe the aggregates it was given, which is unobjectionable, or it may carry a say over which readings are permissible. Anthropic further reports that because outsiders cannot read the underlying text, a poorly worded question can sort conversations into misleading buckets that nobody is positioned to catch, which its own teams resolve by iterating for weeks. That was infeasible externally, since each new dataset requires privacy review [10].

So the pilot supplies independence of agenda, which is genuine and was not previously available. It does not yet supply independence of instrument. The obstacle is not that someone else executes the query. Any workable entitlement would run through mediated computation too, since mediation is how privacy and access coexist at all. The obstacle is what surrounds the execution: an outside researcher cannot validate how the classifier sorted the conversations, re-run an analysis after a methodology change, contest a classification against the underlying text, or count on access next year. Empirical economics has long worked this way with restricted data, through Census enclaves, administrative tax records, and vetted-researcher programs, but there the data holder is not the subject of the finding, disclosure review polices identification risk rather than conclusions, and the researcher’s standing does not depend on the holder’s continuing goodwill.

Dual affiliation protects the researcher. Controlled access does more than that: a reader can see the questions the outside teams chose and check their reasoning against the aggregates Anthropic published. What a reader still cannot check is how those aggregates were produced. An economist inside a lab can publish an honest finding about deployment effects, and a reviewer at a journal cannot see the logs behind it, nor can a rival lab, nor a congressional staffer. What arrives is a claim from a credentialed person who had access, and the only available response is to believe it or not. Such a paper may well pass peer review, since journals accept proprietary-data findings routinely. What it cannot pass is independent verification, and a discipline that substitutes the first for the second has changed what its published claims are worth.

Questions that cannot be settled from outside

Three of the largest labs now run an in-house economics function. OpenAI hired its first chief economist in October 2024 [14]. DeepMind created its AGI economics directorate in May. Anthropic folded its economic research team into the Institute in March. Each produces real work about its own users.

The problem is not secrecy. Anthropic’s Economic Index is public and substantial, and the Index is the clearest place to see what the problem actually is.

Anthropic classifies conversations against O*NET, the US Department of Labor’s taxonomy of roughly twenty thousand work tasks. Because that list is far too long to put in front of a model directly, its researchers used Clio to build a multi-level hierarchy of the tasks, classify against that, and aggregate upward into occupations and occupational categories [11]. Microsoft’s enterprise Copilot study classifies conversations by the Intermediate Work Activities they contain, a coarser unit, with a hundred and sixty-nine of them surviving its threshold [12]. OpenAI’s ChatGPT study maps messages to three hundred and thirty-two Intermediate Work Activities and then reports one level coarser still, at forty-one Generalized Work Activities [13]. Three firms, one shared public taxonomy, three reporting grains, and three classifiers, each of which is the product under study.

The shared taxonomy is what makes this deceptive. The numbers look combinable. They are measuring different populations at different grain through different instruments, and the only parties who could establish a conversion between them are the firms, each of which would have to publish the classification method that distinguishes its reading of its own data from anyone else’s. The public artifacts exist and cannot be added together.

None of this makes the effects unobservable. Payroll records, employment surveys, employer studies, and field experiments remain available, and outside researchers use all of them. What outsiders cannot do is tie a specific deployment decision to a downstream outcome at the resolution the question requires, because one half of that pair sits in one company’s logs. Whether agent workloads are absorbing whole jobs or clustering on narrow tasks the labor market can reorganize around is arguably the most consequential empirical question in AI policy, and it has several firm-specific answers that will not sit in the same table. The logs would not settle it alone either: they record what happened, and the comparison has to be designed, often against employer or worker data no lab holds.

The government tests for bioweapons, not layoffs

Governments have built an outside, and the objection deserves its strong form. The UK’s AI Security Institute evaluates advanced models. In the United States, the Center for AI Standards and Innovation announced pre-deployment testing agreements with Google DeepMind, Microsoft, and xAI in May, extending arrangements held with OpenAI and Anthropic since 2024, and reports more than forty completed evaluations, some of systems never publicly released, some run in classified environments through an interagency taskforce [16]. The EU AI Act requires documentation, risk assessment, and incident reporting from general-purpose model providers. California requires published safety frameworks and disclosures.

That is real capacity and it was expensive to build. It was also built to look for one family of harms. CAISI’s stated focus is demonstrable national security risk: cybersecurity, biosecurity, chemical weapons [15]. Those are harms a red team can test against a model checkpoint inside a secure facility, which is why the instrument for finding them could be designed at all.

The line is not perfectly clean, and CAISI has begun to cross it. Its memorandum of understanding with the General Services Administration supports evaluation at the federal procurement stage, which is deployment rather than checkpoint [17]. But procurement assessment for government buyers is not economy-wide measurement. Some public authorities also hold information-request powers that could in principle reach this material, particularly under the EU regime. What none of them possesses is a standing entitlement to comparable, continuous, cross-firm deployment data, and no existing power was drafted with that object in view.

So the apparatus asks whether a model can help someone build a weapon. The instrument that would ask what these systems are doing to the economy was never designed.

Money was never the scarce part

The grant program is worth taking at face value, because sincerity is not the interesting variable. A lab can fund outside work, commission it, publish it, and endow it. What no cheque transfers is the vantage point. Disclosure has the same ceiling: it lets the disclosing party choose the frame, the aggregation, the release schedule, and the categories, so every published index and system card is a genuine contribution and also an answer to a question the firm selected. What outsiders lack is not answers but the standing to put a question the firm did not choose.

The institution that keeps not getting built

The shape of the fix has been describable for years: accredited researchers granted secure, tiered access to models, standardized telemetry, deployment records, and incident data, on a legal entitlement rather than a corporate favor, with publication challengeable on real security grounds and never on grounds of inconvenience. Full openness would be irresponsible and is beside the point, since classified defense work and clinical trial data have run through cleared facilities and disclosure review for decades. CAISI has even been assembling the technical machinery, signing a research agreement with a privacy-preserving computation nonprofit specifically to allow evaluation without exposing weights or training data [18].

The better question is why the cheaper alternative keeps winning after everyone can describe the better one. It is that the better one has to survive four separate refusals.

Compulsion has no home. CAISI’s mandate is national security risk, the EU’s instruments run to documentation and incident reporting, and no mandate on the record names economy-wide deployment effects on labor as its object, so the body that would issue the demand does not yet exist to be lobbied.

Comparability requires a shared codebook, and a shared taxonomy is not enough. Everyone already agrees on O*NET; agreement collapses one level down, where one firm’s machine-built task hierarchy meets another’s Intermediate Work Activities and a third’s Generalized ones, and reconciling them means publishing the method that constitutes your analytic advantage.

Trade secret and privacy exposure attach to exactly the material with the most analytic value, and both objections are real rather than pretextual, which is why they cannot be legislated away in a sentence.

And the right to publish an unwelcome finding is the provision a general counsel fights hardest, because it is the clause most likely to cost the firm something.

Each of those is soluble. None is soluble quickly, and against a slow institutional solution the labs hold a fast private one that is already producing respectable work. Hiring the researchers is cheaper, faster, legally simpler, and generates published output that looks from a distance like what the institution would have provided. The substitute is good enough to remove the urgency and not good enough to do the job.

The logs were inside the companies before any of these researchers arrived, and they would be inside the companies if none of them had gone. Hiring does not move the instrument. What it moves is the constituency.

An entitlement of this kind does not appear because it is a good idea. It appears because people with standing keep demanding it, in submissions, in testimony, and in the papers that make the missing data itself the finding. Two different groups matter here and they are easy to conflate. The set of people who could keep demanding a reporting regime is large and is not going anywhere: statistical agencies, congressional staff, unions, and the labor economists who never needed lab logs in the first place. The set of people who could specify what to demand, in terms a firm’s engineers would recognize and a committee would credit, is much smaller, and it overlaps heavily with the researchers now employed inside. A demand needs both. The second group is the one being hired, and its members would now be making the case for compulsion about their own employer.

This is the least established claim here. No access proposal is on the record as having been shelved for this reason, no public count isolates how many of the relevant specialists have moved, and the mechanism is a prediction, not a finding. It is also what would explain why the better institution keeps not getting built while everyone involved can describe it.

Every industry goes through this

The historical objection is that all of this describes any technically complex industry. Pharmaceutical companies run their own trials. Banks keep their own books. Aircraft manufacturers understand things regulators do not. In each case the eventual settlement was mandatory reporting into a body with subpoena power, reached slowly and usually after a disaster.

That is probably right about the destination, and those industries recruited their critics too, through sponsored research, consultancies, and a revolving door that has drawn complaint for fifty years. They also held proprietary data monopolies of their own, and the reporting schema that eventually broke them was itself the contested thing, forced into place over decades rather than designed at the outset. That precedent cuts against the optimistic reading more than for it.

One difference is that those settlements were purchased by a visible catastrophe with identifiable victims. Each of those settlements was purchased by a visible catastrophe with identifiable victims. Thalidomide had a photograph. A broken hiring pipeline does not, and a labor market quietly reorganizing around agent workloads may never produce the single legible event that historically forces the institutional response.

There is a version of the next few years where this dissolves. The labs standardize voluntarily under competitive pressure, the indices become comparable, the Insights pilot expands into something several firms run and nobody can quietly withdraw, and most of the twenty-two professors return to their departments when their leaves expire, since the majority are formally two-year arrangements [6]. That is the good outcome, it is entirely possible, and the two-year clock means the question is live rather than settled.

It would also be a gift rather than a right.

Public institutions still make the decisions. The labs increasingly decide what those institutions can know before they make them.

Notes

[1] Anthropic, “Introducing The Anthropic Institute,” 11 March 2026. The Institute consolidates the Frontier Red Team, Societal Impacts, and Economic Research teams under Jack Clark, who took a new role as Head of Public Benefit, and adds work on forecasting AI progress and on AI’s interaction with the legal system. The launch note states that the Institute has access to information that only the builders of frontier AI systems possess. Founding hires as announced: Botvinick on AI and rule of law, Korinek on economic transformation, Hitzig connecting economic research to model training.

[2] Andrew B. Hall is the Davies Family Professor of Political Economy at Stanford Graduate School of Business and a senior fellow at the Hoover Institution, where he founded the Free Systems lab. His own announcement, “The Next Phase of Free Systems,” states that he has joined the Rule of Law team at the Anthropic Institute full time to research the political economy of superintelligence, that he is on leave from Stanford, and that the Free Systems lab remains fully Stanford-funded and wholly separate from his Anthropic work. His Hoover profile records that he built the first systematic evaluation of whether frontier models resist authoritarian requests, and that Anthropic used it in training and evaluating Opus 4.8.

[3] University of Minnesota Law School announcement; Rozenshtein has taken a leave of absence from the law school to join the Rule of Law team at the Anthropic Institute as a member of technical staff. He remains a contributing editor at Lawfare and a senior research affiliate at the Institute for Law & AI.

[4] Alex Imas announced the move on 8 May 2026, describing a research agenda covering labor, the distribution of wealth and power, institutional adaptation, and AI agents in markets. He remains the Goetz Professor at the University of Chicago Booth School of Business.

[5] The Foundation for American Innovation, “Dean Ball Joins OpenAI as Head of Strategic Futures,” 18 June 2026, noting that he stays on as a non-resident senior fellow. Ball began on 6 July 2026, reporting to chief strategy officer Jason Kwon; he has described the team’s remit as covering catastrophic risk, recursive self-improvement, labor-market effects, and the relationship between frontier labs, governments, and society.

[6] The Information, “Universities Fret as Anthropic, OpenAI, Meta and DeepMind Lure Their Professors,” 9 July 2026. The count covers roughly the first half of 2026 and includes both departures and leaves; most are structured as two-year leaves rather than resignations. The count is not restricted to social scientists, and no public tally isolates the economists, lawyers, and political scientists within it.

[7] Anthropic, job posting, “Member of Staff, AI & Rule of Law,” Anthropic Institute. The posting describes the Institute as sitting inside a frontier lab with access to information only AI developers possess, and states that it does not just study AI from the outside but from within.

[8] Andy Hall, “The Enlightened Absolutists,” Free Systems, 29 January 2026: a constitution that assigns no powers and that Anthropic can unilaterally rewrite is not a constitution. He restated the criticism in Stanford Graduate School of Business, “A ‘Radical’ Lab Races to Study AI’s Impact on Democracy,” 19 June 2026, adding that a document the company building the AI can alter whenever it wants is not an effective safeguard. Both predate his move to Anthropic.

[9] Anthropic, “Funding better evaluations of AI’s impact on wellbeing,” August 2026. Five million dollars in direct funding, model access, and technical support; outputs must ship open source; recipients must disclose the funding source; Anthropic states it will not veto or embargo findings.

[10] Anthropic, “Enabling independent research on how people use Claude,” August 2026. The pilot began in February 2026 with the Social and Language Technologies Lab at Stanford, the Human Information Processing Lab at Oxford, and METR. The groups wrote their own research questions against roughly 250,000 Claude.ai and Claude Code conversations sampled in April and May 2026, run through Anthropic Insights, formerly named Clio. The researchers did not see the underlying conversations; Anthropic executed the queries and supplied aggregated outputs. Contractual review rights were limited to user privacy, material that could facilitate usage-policy violations, confidential company information, and research accuracy. Anthropic released the aggregate data, conducted a privacy audit, opened an interest form for future access, and reported that sensitivity to question wording could not be resolved externally at the same pace as internally because each dataset requires privacy review.

[11] Anthropic Economic Index. Methodology in Handa et al., “Which Economic Tasks are Performed with AI? Evidence from Millions of Claude Conversations,” arXiv:2503.04761: because the ONET task database contains roughly twenty thousand task descriptions, too many to fit in a model’s context window, the team used Clio’s hierarchy generation to construct a multi-level taxonomy of tasks, mapped privacy-preserved conversation summaries to ONET tasks, then connected tasks to occupations. Later Index releases add a bottom-up taxonomy built from the conversations themselves for usage that does not fit O*NET, a second axis on which the series does not align with anyone else’s.

[12] “AI in the Enterprise: How People Use M365 Copilot Chat,” arXiv:2605.23958, classifies conversations by the Intermediate Work Activities they contain, following the procedure in Tomlinson et al., “Working with AI,” arXiv:2507.07935, which analyses Bing Copilot conversations at the IWA level using O*NET 29.0. The primary M365 dataset retains 169 unique IWAs after a 0.05 per cent activity-share threshold.

[13] Chatterji, Cunningham, Deming, Hitzig, Ong, Shan, and Wadman, “How People Use ChatGPT,” NBER Working Paper 34255. Messages are mapped to 332 O*NET Intermediate Work Activities and aggregated to 41 Generalized Work Activities, at which level the results are reported. Hitzig, a co-author, subsequently joined the Anthropic Institute.

[14] OpenAI, “Dr. Ronnie Chatterji named OpenAI’s first Chief Economist,” 22 October 2024. Chatterji is a professor of business and public policy at Duke and formerly chief economist of the US Department of Commerce.

[15] NIST, Center for AI Standards and Innovation, program description. CAISI was created in June 2025 by restructuring the US AI Safety Institute, with a mandate refocused on demonstrable national security risks, specifically cybersecurity, biosecurity, and chemical weapons.

[16] NIST/CAISI announcement, 5 May 2026, of pre-deployment evaluation agreements with Google DeepMind, Microsoft, and xAI, building on arrangements with OpenAI and Anthropic first signed in 2024. CAISI reports more than forty completed evaluations, including of state-of-the-art models never publicly released; some run in classified environments with participation from the interagency TRAINS Taskforce. The agreements are voluntary instruments rather than statutory obligations.

[17] NIST, on CAISI’s memorandum of understanding with the General Services Administration, which supports AI evaluation at the federal procurement stage for USAi.

[18] NIST, “CAISI signs CRADA with OpenMined to Enable Secure AI Evaluations,” 27 March 2026. The agreement covers privacy-preserving evaluation methods, using OpenMined’s PySyft, which allows analysis of non-public data without the analyst seeing or obtaining a copy of it.