Technologies

Here Are the 5 Best VPNs in 2022

The best VPNs for private streaming, gaming and torrenting rated by our expert staff.

At CNET we rigorously test virtual private networks to determine which service is worthy of the title best VPN. We use a combination of the latest real-world research from industry experts and our own hands-on testing with these services to see how they compare against each other. To earn the crown, a VPN needs to demonstrate excellent speed, privacy and overall value in our evaluation. Currently, ExpressVPN is our Editors’ Choice for best overall VPN. Most recently, ExpressVPN passed its latest set of third-party audits, contributing to a growing record of industry-leading transparency efforts.

The best VPNs deliver unprecedented digital privacy without compromising performance. Though many people forego VPNs in favor of other types of network connections, we highly recommend using a good VPN for work, especially if you work with sensitive information.

A well-tested and reliable VPN is a cornerstone tool for protecting your digital privacy online, and getting the best value out of your online gaming and streaming. A VPN service is a mobile app or other software that — once you switch it on — encrypts the connection between your device and the internet, preventing your internet service provider from seeing what mobile apps or websites you are using. It also prevents most of those websites and apps from seeing what geographic location you’re connecting from. If configured correctly, VPNs can also stop your internet service provider from throttling your speeds.

Black Friday & Cyber Monday Deals

Surfshark:$2.05 a month for 26 months(Billed $53.28 upfront)
NordVPN:$3 a month for 27 months(Billed $80.73 upfront)
IPVanish:$4 a month for 12 months(Billed $48 upfront)
ProtonVPN:$4 a month for 30 months(Billed $120 upfront)
ExpressVPN:$6.67 per month for 15 months(Billed $100 upfront)

A VPN can also give you an added layer of security on public Wi-Fi networks, even though they’re far less of a security threat than they were in previous years. And with football season now in full swing, it’s a good time to note that VPNs can also be used to correct wrongly applied league blackouts and geographic restriction glitches. A VPN service also lets you bypass content blocks in some countries to access critical news and educational information, while also opening up your streaming entertainment options.

While we believe the best VPN overall is ExpressVPN, we’re also eager to find the best VPNs for different uses. That’s why we also recommend Surfshark VPN as the best cheap VPN for the budget-savvy. Each VPN in the list below has an excellent value for a specific use case, and we point out the ideal user for each one. We’re also in the process of re-evaluating ProtonVPN and will update our recommendations based on that review in the coming months. In the meantime, keep an eye out for Black Friday VPN deals, which have started on some providers, including many of our top picks.

Over the past several years, a flood of VPN providers has entered the marketplace, and that comes with both benefits and drawbacks. On one hand, the array of affordable VPN options now available means that — no matter how critical or casual your privacy needs — there’s a VPN service suited to your purpose. But it also means consumers have to wade through even more VPN advertising hype.

How we test VPNs

Our hands-on testing and review process is designed to cut through that hype. When we look at each VPN service, we’re not just examining them for their technical weaknesses, but we’re also scrutinizing their individual performance strengths. We want to know what each service does best. We test each VPN across over 20 factors, and we’re continually improving our methodology as we learn more.

We test VPNs for browsing and streaming speed in multiple countries as well as their connection stability and even the smallest potential privacy leaks. By testing across multiple devices and platforms, we’re able to assess which VPNs are best for gaming versus those best for streaming, torrenting or sharing sensitive information. Most importantly, we focus on doing the deep-dive research necessary to vet each VPN’s historical credibility and its ownership in a notoriously murky market.

The VPNs on this list earn our recommendation for more than just boosting their digital privacy strengths — they enable easy streaming to overcome geoblocked media, have torrenting-friendly servers, and are fast enough to support gaming globally. Based on those continued evaluations, you’ll see a few bullet points on each entry in our list, highlighting each VPN’s strengths and the uses we recommend it for most. And because we strive to keep on top of a fast-changing market, you’ll notice that the rank of each VPN service changes as we learn more and retest.

Best VPN services in 2022

Let’s look at each of our VPN vendors below in more depth. Keep in mind that this list is constantly being updated. We’re actively working on more VPN testing and research, so expect this guide to change throughout the year as we put each VPN through its paces.

The list below presents our favorites overall in 2022 so far. We’ll call out when specific traits make for a better choice in a more narrow evaluation.

Other VPNs we’ve tested

Not every VPN can be a favorite. These are ones we reviewed, but they’re not full-throated recommendations for one reason or another, including limited features and concerns over adequately hiding your identity.

Hotspot Shield

Servers: 1,800-plus in 80-plus locations
Country/Jurisdiction: US (Five Eyes member)
Platforms: Windows, Android, MacOS, iOS, Linux, Amazon Fire TV
Price: $8 per month or $95.88 billed annually. Month-to-month plan at $13

Hotspot Shield VPN’s TLS-based Hydra Catapult protocol, US jurisdiction, 128-bit AES encryption support and large percentage of virtual servers might strip away our trust in its ability to provide more privacy protections than its competitors — but those are all key components to its ability to achieve the blazing speeds it delivered during its most recent speed tests.

It’s the second-fastest VPN I’ve tested, effortlessly delivers smooth-streaming media and can dance between server connections without missing a beat, no matter how many interruptions you throw at it. A 26% speed loss puts it in second place, falling behind Surfshark — which lost just 16.9% of its speed the last time I tested it — and knocking ExpressVPN down to third place with a 51.8% speed loss at last measurement. Speed losses on UK connections were under 8%. Gaming, torrenting, browsing, streaming — these speed-dependent services won’t be slowed down for Hotspot Shield users.

We’re not excited about Hotspot’s privacy and security, though. Since the services uses a closed-source proprietary Catapult Hydra protocol, instead of the more transparent open-source OpenVPN protocol, we’d like to see Hotspot give the public more third-party audits — a necessary step to bring Hotspot up to speed with routinely audited VPNs like TunnelBear. As recently as April 2021, review site VPNMentor discovered a DNS leak in Hotspot Shield’s plug-in for Google Chrome. Hotspot acknowledged the issue at the time and aimed to improve the product.

We’re also not thrilled about the amount of user data Hotspot collects, and its privacy policy. With its premium product, it gathers and retains much more information about users than most other VPNs. And if you’re using the free version of its product, it shares that information — along with even more finite data, including your MAC address and specific phone identifier — with advertising companies.

While its interface is user-friendly and its speeds are thrilling, spending time with Hotspot is going to leave your wallet a little lighter than you might prefer. Its current price is higher than its nearest competitors, its speeds slightly slower and its privacy more questionable. If you’re looking for a VPN purely on the grounds of speed, we still recommend passing on Hotspot until it improves.

See all Hotspot Shield plans

TunnelBear

Average speed loss: 63%
Number of countries: 48-plus
Jurisdiction: Canada, with US parent company
Price: $3.33 per month, or $120, for a 3-year plan

TunnelBear’s gotten a lot of hype in the last couple of years. But when we looked under its hood and compared it with its VPN competitors, our excitement waned.

TunnelBear’s speeds are reasonable. We lost nearly 63% of internet speed overall when we used it, which is about average for a VPN. TunnelBear’s speeds have steadily improved over the years as measured by other review and testing sites, though, and the US scores we recorded saw a speed loss of only 54%.

On the plus side, TunnelBear is holding its own in the transparency competition among VPNs by publishing the results of its independent security audits and annual transparency reports. No IP address, DNS or other potentially user-identifying data leaks were detected during our testing, but in the past TunnelBear was observed to have been leaking WebRTC information. TunnelBear’s VPN encryption is standard AES-256 and it supports Perfect Forward Secrecy.

However, it’s also a Canadian business owned by US-based McAfee, so if you’re looking for subpoena-proof international online privacy, you’re playing with fire. It holds a paltry 23 server locations from which you can’t manually choose your VPN server or even a city. It doesn’t offer Tor-over-VPN, it offers split tunneling only on Android and it can’t even unblock Netflix.

On a per-month breakdown, the least expensive TunnelBear plan is its $120, three-year plan. You can also go month to month for $10, or pay $60 up front for a single year. Either way, TunnelBear accepts payment via credit card and bitcoin. Unlike other VPNs, it doesn’t take PayPal. Also unlike other VPNs, it doesn’t support Amazon Fire Stick or Android TV.

See at TunnelBear

CyberGhost VPN

Number of servers: Over 8,000 worldwide in 91 countries
Number of server locations: 111
Jurisdiction: Romania, with UK parent company
Number of simultaneous connections: 7
$2.03 a month or $60 for a two year plan (plus four free months). Month-to-month plan at $13.

In CNET’s previous coverage of virtual private networks, we’ve praised CyberGhost for its roster of competitive features. Our in-depth review of CyberGhostin 2019 included speed testing, security verification and an analysis of its full suite of privacy tools. Since then, the VPN company has increased its number of servers and is prepared to roll out new privacy tools, all while remaining one of the cheapest VPNs we’ve reviewed — at $2.03 per month for a two-year plan.

As we’ve bolstered our approach to VPN reviews, however, CyberGhost has raised some red flags. Its parent company’s history warrants skepticism; our previous tests have shown it to expose your VPN use to your ISP; its website and app trackers are more numerous than warranted; and its ad blocker uses an untrustworthy method of traffic manipulation no VPN should even think about. Its low price previously made it worth considering if you needed to change the appearance of your location online, but not if you wanted best-in-class security.

While CyberGhost’s connection speed and security features appear to be improving, we don’t currently recommend using the VPN service provider if you’re in a country where VPNs are illegal. We also recommend that anyone in the US review CyberGhost’s parent company before deciding whether to pay for a subscription.

On the plus side, however, CyberGhost is still faster than Norton Secure VPN and was less taxing on the processing power of our devices. It also offers split tunneling in its Windows client and has its servers neatly organized into categories: NoSpy servers, servers geared for torrenting, servers best for streaming and servers best for use with a static IP address. CyberGhost imposes no data caps, allows unlimited server switching and offers a 45-day money back guarantee on subscription plans of a year or more.

See all CyberGhost VPN plans

Norton Secure VPN

Number of countries: 30
Number of servers: 1,500 (1,200 virtual)
Number of server locations: 200 in 73 cities
Country/jurisdiction: US
$40 for the first 12 months for five devices

NortonLifeLock, long known for excellence in security products, has a relatively limited offering in its VPN product. Norton Secure VPN does not support P2P or BitTorrent, Linux, routers or set-top boxes. Its Netflix and streaming compatibility is somewhat limited. Even worse, during testing, we experienced privacy-compromising data leaks.

During CNET’s testing, Norton Secure VPN speeds were comparable to other midtier VPNs but not particularly competitive. Although its VPN is only available on four platforms — Mac, iOS, Windows and Android — Norton gets points for its 24/7 live customer service phone support and 60-day money back guarantee.

Norton Secure VPN’s pricing structure is a bit different than what you typically find in the industry. Pricing is tiered based on how many simultaneous connections you want with your account. For a single device, you’ll pay $30 for the first year and $50 for any subsequent years, or $4.99 a month for the monthly. For five simultaneous connections, the price jumps to $40 for the first year and $80 for subsequent years, or $8 a month for the monthly plan. If you want up to 10 simultaneous connections, the price is $60 for the first year and $100 for subsequent years, or $10 a month for the monthly plan.

See all Norton plans

Mullvad

Number of servers: 840
Server location: 68 locations in 38 countries
Number of simultaneous connections: 5
Jurisdiction: Sweden
Price: $5 a month

Mullvad is an independent and open source VPN provider that is focused on building trust through transparency and its commitment to protecting the privacy and security of its users. Although there are other VPNs that are considerably more well-known in the industry, Mullvad’s offering overall is just as polished and easy to use as many of the bigger players in the market.

Mullvad’s primary focus is on security. Like most other top VPN providers, Mullvad employs industry-standard AES 256-bit encryption to secure users’ connections. Mullvad’s kill switch feature and DNS leak protection are enabled by default and cannot be disabled. During our testing, the kill switch worked as expected and we detected no leaks of any kind. The company says it doesn’t keep any logs of its users’ activity, and is, for the most part, pretty transparent about how it operates and what it does to protect user privacy. Mullvad is unique in that it doesn’t require any personal information at signup. While most VPN providers ask users to provide an email address and enter a username, Mullvad generates a random 16-digit account number to activate each new user account. You don’t even need to provide any payment information since Mullvad accepts cash sent via mail.

Mullvad’s source code being entirely open source is a testament to the company’s transparency, but we’d still like to see Mullvad issue an annual transparency report to give the public a view of how many legal requests the company gets and where they’re coming from. Though Mullvad tells us a new security audit is forthcoming, the company’s 2020 security audit (conducted by German cybersecurity firm Cure53) concluded at the time that the VPN “does a great job protecting the end user from common PII leaks and privacy-related risks.”

With servers in 68 locations across 38 countries, Mullvad’s VPN server network is comparatively small. Even so, the network covers the most in-demand locations and is pretty well spread out across the globe. And what its network may lack in size, it makes up for in speed. In our latest round of speed testing, we measured just a 23% drop in average speeds (most VPNs will slow you down 50% or more), easily making it one of the fastest VPNs we’ve tested. Though Mullvad’s speeds are fantastic, it’s not the best for geographically restricted content. We were able to access Netflix without any issues, but were denied access to stream Disney-plus when connected to Mullvad’s US servers.

However, Mullvad’s straightforward approach to pricing is a breath of fresh air, especially with so many other VPN providers concocting ever-more convoluted pricing structures. Mullvad costs about $5 a month, whether you want to use it for a month, a year or a decade — and you’re never locked into a long-term subscription plan. If you’re not satisfied with the service, you can get a refund within 30 days of purchase.

See all Mullvad plans

Other VPNs our experts are reviewing

Below you’ll find some additional VPNs. We’re in the process of re-evaluating them in the coming months.

PureVPN

Number of servers: 6,500-plus
Number of countries: 78-plus
Country/jurisdiction: Hong Kong
$3.24 a month for one-year plan, $1.99 a month for a two-year plan (plus three free months)

PureVPN says it doesn’t log connection information. The company joined the “no log” movement in 2018, and underwent a third-party audit by Althius IT (albeit one commissioned and paid for by PureVPN).

We like that PureVPN offers a 31-day refund policy and supports Bitcoin payments. We also like that PureVPN has both Kodi and Chromebook apps available. In addition, PureVPN was the first VPN service we noted to fully implement GDPR compliance.

See all PureVPN plans

StrongVPN

Number of servers: 950-plus
Number of server locations: 59 locations in 30 countries
$3.66 a month (67% discount) for a one-year plan
StrongVPN in-depth review and hands-on testing (ZDNet)

StrongVPN blasts onto our list with excellent infrastructure and a decent price. StrongVPN has a strong no-logging policy, and picks up kudos for its large base of IP addresses. It has a solid collection of servers and worldwide locations. For those of you who need a dedicated IP, you can get one from the company but you’ll need to contact customer support to get help setting it up.

One of StrongVPN’s strengths is the company’s network. It owns and operates its entire network infrastructure, which means it has no externally dictated limits on bandwidth or the type of internet traffic allowed on the network.

StrongVPN’s regular monthly price of $10.99 is in the middle of the pack, but its regular yearly price of $80 is among the lowest of our contenders.

See all StrongVPN plans

Private Internet Access

Number of server locations: 84 countries
Country/jurisdiction: US
Simultaneous connections: 10
Price: $2.19 per month for the two-year plan

If you’re looking for one of the least expensive VPN providers, Private Internet Access fits the bill.

The best value offered by Private Internet Access is the two-year plan, which works out to $2.19 a month, and includes two free months. But if you don’t want to lock in for an extended period of time, you can get a six-month subscription for $45 (which comes out to $7.50 a month), or a monthly plan for $12 a month.

PIA has quite an expansive network of servers, spanning 84 countries, including servers in 18 different US cities. Though not as expansive as the fleets for ExpressVPN or CyberGhost VPN, the 84 countries gives PIA one of the largest server networks you’ll find in a VPN provider.

Operating since 2010, Private Internet Access offers 10 simultaneous connections, a kill-switch feature and a 30-day refund period.

See all Private Internet Access plans

VPN FAQ

In today’s hyper-connected world, online privacy and security are increasingly critical. From online banking to communicating remotely with colleagues, we’re transferring more data on our computers and smartphones than ever before. Much of that data is confidential information that we need to keep safe from hackers and snoops, so VPN use is on the rise as people take steps to secure their digital lives.

Additional VPN factors to consider

Don’t use free VPN services: You’ll find only paid VPN options on this list above because they’re the only ones we can recommend.

Look for a no-logs VPN, but understand the caveats: The best VPNs keep as few logs as possible and make them as anonymous as possible, so there’s little data to provide should authorities come knocking. But even “no-logs” VPNs aren’t 100% anonymous.

There are limits to the privacy VPNs currently provide to iOS users: Recent independent research has surfaced suggesting iPhones and iPads running iOS 14 or later may be vulnerable to device-only VPN leaks, regardless of which VPN is used. Apple users concerned with potential leaks can take extra precaution by installing their VPN on a home router to ensure their entire Wi-Fi network is encrypted. Some iOS users may potentially reduce the likelihood of leaks while outside of a home network by enabling their VPN’s kill switch and selecting OpenVPN protocols. You can also try closing all apps, activating your VPN, and then enabling and disabling Airplane Mode before using your device normally. Apple advises users to activate their device’s Always On VPN profile for additional protection.

VPN transparency is important, but warrant canaries are only the beginning: Many services use “warrant canaries” as a way to passively note to the public as to whether or not they’ve been subpoenaed by a government entity, as many investigations from national security agencies can’t be actively disclosed by law. But — like the no-logging issue — warrant canaries aren’t always as straightforward as they seem. You should spend more time investigating whether your prospective VPN has cooperated with authorities in the past, and how and when it’s disclosed that fact.

Think twice about using a US-based VPN: The Patriot Act is still the law of the land in the US, and that means US-based VPNs have little recourse if and when the feds show up with subpoenas or national security letters in hand demanding access to servers, VPN user accounts or other data. Yes, they may have little data to access if the service has a strong no-logs policy, but why not just choose a service that’s based outside Uncle Sam’s jurisdiction? (If this is a concern for you, you’ll want to avoid countries that the US has intelligence-sharing agreements with, too.)

Best VPNs for your use case

Technologies

Justice Department opens antitrust probe as White House press-access fight escalates

The Justice Department said in a statement that it is examining whether the White House TV press pool violated the Sherman Act.

The U.S. Department of Justice launched an investigation into whether the White House television press pool’s decision to suspend coverage of President Donald Trump violated antitrust laws.

The Justice Department said in a statement that it is examining whether the White House TV press pool — a group of broadcasters including CNN, Fox News, ABC, CBS and NBC — violated the Sherman Act by temporarily halting pooled TV coverage of Trump.

The Sherman Act is a federal law that prohibits certain agreements that unreasonably restrain trade. Introduced in the 1890s, the law has rarely been applied to media organizations, particularly regarding their coverage.

Members of the press pool did not immediately respond to CNBC’s requests for comment sent outside of normal business hours.

The DOJ investigation follows the White House television press pool ceased its coverage of Trump on Sept. 21, shortly after he prohibited CNN, MS NOW and Politico from accessing the White House.

In a Truth Social post, the president said then that those outlets “shouldn’t be able to constantly write or report FICTION and LIES when they’re covering the President of the United States, the Trump Administration, or the United States of America.”

A judge lifted restrictions on those reporters on Sept. 24, several days after White House staff confiscated their press passes. Despite the ruling, reporters from CNN and Politico were barred from traveling with the president on Air Force One, the New York Times reported.

The Trump administration now faces a lawsuit from CNN, MS NOW and Politico over its ban of their reporters from the White House grounds.

Television pool coverage of the White House has also resumed.

The DOJ investigation marks another escalation in an ongoing dispute between Trump and the media over press rights.

The Trump administration has moved to restrict news agencies that have produced critical coverage of its policies.

Last year, Trump moved to rescind about $1.1 billion previously approved for the Corporation for Public Broadcasting, federal funding earmarked for public broadcasters NPR and PBS. Trump and his allies have also sued several media organizations, including The New York Times, The Wall Street Journal, and BBC News, over alleged biases or inaccuracies in their reporting.

Seth Stern, chief of advocacy for the Freedom of the Press Foundation, called the DOJ investigation “nonsense.”

“Depriving Trump of the attention he craves is not a competitive harm and in any case, antitrust law has long recognized First Amendment exceptions even when there is anticompetitive impact,” he said. “After all his ‘fake news’ rhetoric, Trump is weaponizing the DOJ to pressure the networks he calls the ‘enemy of the people’ to stay at the White House. It’s a weird way of telling the press how much he missed them.”

The White House Correspondents’ Association did not immediately respond to a request for comment.

Disclosure: CNBC and MS NOW are divisions of Versant Media.

Technologies

NBA commissioner Adam Silver says league could introduce ‘smart ball’ technology as soon as next year

Commissioner Adam Silver says the NBA could begin using a new “smart ball” in games as soon as next year, potentially transforming how officials make calls.

NBA Commissioner Adam Silver says the league could begin using a new “smart ball” in games as soon as 2027, potentially transforming how officials make calls on the basketball court.

In an interview with CNBC’s Contessa Brewer, Silver revealed that the NBA is working with official basketball manufacturer Wilson to develop a ball embedded with a tiny microchip Bluetooth sensor that can track movement, spin and changes in trajectory.

“We’re experimenting with putting a small chip in the ball that weighs roughly a gram,” Silver said.

The technology has already been tested in the NBA’s G League, Summer League, and some preseason games, where players used basketballs both with and without the chip. Silver said players have been pleased with the results.

“Nobody could tell the difference. So that’s a good sign,” he said.

The chip weighs just one gram, compared with the roughly 620-gram or 1.4 pound basketball. Silver said the league wanted to ensure that even the most experienced players wouldn’t notice a change in how the ball feels or bounces.

One of the most immediate applications could be officiating.

Silver said the technology could help referees determine whether a player touched the ball before it went out of bounds by detecting subtle changes in its spin. It could also help identify whether a shot’s trajectory was altered.

“I think you could see as soon as next year us using it for officiating in our games,” Silver said.

Beyond officiating, Silver sees a significant opportunity to bring the technology to consumers, allowing basketball players of all ages to analyze and evaluate their shooting mechanics.

For example, a player taking hundreds of shots could use data collected by the chip to understand which shooting angles and ball rotations are most likely to result in a basket.

“You’ll then see the graph, and you’ll see for which the angle of the shots that went in, they’re more likely to go in,” Silver said.

While the officiating application could arrive as soon as next year, Silver said a consumer version may take longer.

“I think the consumers version [of the smart ball] is a few years away, but it’s a really exciting opportunity.”

NBA players’ union raises concerns over wearables

The league is also exploring the use of wearable technology during games, but negotiations with the National Basketball Players Association have yet to produce an agreement.

The NBA says officials experimented with wrist wearables in select preseason and summer league games this year in a “successful pilot program,” but it will not extend into the season. The technology allowed the referees to communicate with the replay center about reviews, scoring changes and clock malfunctions.

Silver said players routinely use wearable devices off the court to monitor everything from sleep to physical performance, but concerns remain over how data collected during games could be used by teams.

“I think we have to come to some agreement on exactly how the information is used. But it seems everybody wants that information,” Silver said.

The biggest sticking point is whether that information could affect contract negotiations, Silver said.

“If you could see a player was slowing down or something like that, they’re worried that that could get used in bargaining, and I get that,” he said.

Silver acknowledged those concerns and said the league needs to reach an agreement with the players’ union on how the information would be used.

Still, he suggested that allowing wearables during games is a logical next step as athletes increasingly rely on technology to monitor their performance.

“I think the players are in a position right now where they’re essentially wearing wearables 22 hours a day, and the only time they’re not wearing them is when they’re playing in the game,” Silver said. “So that can’t make sense.”

“We’ll work something out with them,” he added.

Technologies

AI’s quiet safety gatekeepers are stepping into the spotlight

The intensifying AI safety debate is bringing a small group of third-party evaluators into the center of a multitrillion-dollar industry.

Two months ago, independent evaluators occupied a relatively sleepy corner of the multitrillion-dollar artificial intelligence industry. Now they’re being asked to come to its rescue.

While Anthropic and OpenAI are the heart of a fierce debate over whether they can safeguard their advanced models and grow their businesses simultaneously, the companies are seeking support from a handful of small third-party groups like Model Evaluation and Threat Research (METR), Apollo Research and Transluce.

The evaluators, which mostly operate as nonprofits, are still finding their footing in an industry where capital is flowing at historic levels and new models are rolling out faster than ever. Their primary role has been to assess AI model capabilities and risks, and to call attention to instances where the technology behaves badly.

In the absence of a federal push for regulations, evaluators have taken on outsized importance. Anthropic CEO Dario Amodei pledged to embed independent evaluators in his company last month – a move that OpenAI CEO Sam Altman quickly endorsed.

President Donald Trump supported the idea, as did most of the largest U.S. tech companies. But left unanswered are questions about how those third parties should be funded, what level of access they will have and what the reporting structure will ultimately look like.

“To a degree, the problem, as always, is money,” Suresh Venkatasubramanian, a computer science professor at Brown University, told CNBC in an interview. “Who is paying for these companies to do their work? How are they going to support them? You need an ecosystem, you need a viable business model for this.”

Right now, Anthropic, OpenAI and the infrastructure partners that are profiting from the AI boom are writing the rules. Critics say that’s like asking the biggest banks to protect us from a financial crisis or allowing pharmaceutical companies to put drugs on the market without regulatory clearance.

President Trump recently lauded AI executives for their “tremendous self-policing,” and signaled that he intends to leave companies to their own devices, unwilling to impede the growth of the industry that’s driving the economy and stock market. Trump encouraged AI companies to “partner with an independent external auditor or evaluator” as part of a voluntary accord he presented in late September.

It’s a conversation that Amodei kicked off In his viral essay last month, when he called for a “slower pace” in advanced model development after researchers left his company and voiced their concerns about the existential threats the technology poses.

As the AI labs move to put evaluators in place, friction is already starting to emerge.

OpenAI fired three employees last week for “violating our policies on accessing and handling sensitive company information,” according to a spokesperson. Two of those employees, Mikita Balesni and Tomek Korbak, said they believe they were dismissed because of how they communicated with third-party evaluators.

“My former colleagues are telling me they are confused about what to believe,” Balesni wrote in a post on X on Thursday. “They also are afraid to speak, and worry their personal phones will be searched for messages to us and third parties. I worry the pervading fear to speak up and engage with third parties will mean OpenAI will cut corners on safety behind closed doors.”

OpenAI disputed that characterization and said in a post on Friday that it’s “actively finalizing contracts with third-party safety assessors and will announce details in the coming weeks.”

“We are committed to embedding external assessors and continue to make close collaboration with independent safety organizations a core part of our safety work,” OpenAI wrote.

An OpenAI spokesperson said in an emailed statement that its upcoming work with evaluators “builds on existing collaboration with independent safety organizations,” including METR and Redwood Research.

Anthropic didn’t respond to CNBC’s request for comment.

‘I’ve never seen an issue move so fast’

The AI evaluator ecosystem consists mostly of small organizations, including METR and Apollo Research, and larger accounting and auditing firms like Accenture.

AI labs have been working with evaluators in limited capacities, but Andrew Freedman, CEO of policy nonprofit Fathom, said the field is quickly maturing.

“I’ve worked in politics and policy for the last 20 years of my life, and I’ve never seen an issue move so fast on so many different political spectrums,” Freedman told CNBC in an interview. He said he expects an “influx of capital” to flow into the ecosystem.

Rayan Krishnan, CEO of independent evaluator Vals AI, said his for-profit startup, which builds benchmarks to measure how AI models perform on industry-specific tasks, has grown from eight employees to roughly 30 this year, and in August announced a $40 million funding round.

METR, a nonprofit, announced in August that it had raised commitments of around $71 million over the last six months. That’s up from total 2024 contributions of $13.6 million, according to the group’s most recent filing with the Internal Revenue Service.

By late that month, METR’s profile had risen further. OpenAI enlisted two of its employees and a contractor to put together a postmortem report detailing how the company’s models escaped containment, accessed the open internet and breached open-source developer platform Hugging Face. METR said it did not accept payment from OpenAI for the assessment.

Kevin Werbach, faculty director of the Wharton Accountable AI Lab at the University of Pennsylvania, said the ecosystem is “not robust enough right now.” METR, for example, employs fewer than 50 full-time staffers, according to its website.

The power imbalance between the small evaluators and the leading labs that have raised tens of billions of dollars and employ thousands of people raises questions surrounding potential conflicts.

“If you want true third-party evaluation, you need true independence financially and otherwise,” said Venkatasubramanian. “It’s not just a matter of not getting paid, it’s a matter of, will there be consequences if I am an auditor and I put out a report that looks unfavorable to this company? Is my business going to dry up?”

Anthropic acknowledged the complexity in a blog post last month, as it announced it will embed employees from Faculty, Accenture’s specialist AI business, to test safeguards and assess whether models will behave in line with human values. Anthropic said that “given the importance and urgency of this work,” it will fund Accenture’s contributions directly.

“There are, as yet, no standards for what information embedded evaluators should have access to, or how they should report what they find. There is also no settled system for funding independent evaluation,” Anthropic said. “Long-term, we think funding should come from pooled or government sources.”

Anthropic said it’s in discussions with METR and other nonprofit evaluators that are planning to use their own funding to pilot “elements” of embedded evaluation.

Will the government step in?

In June of last year, Fathom introduced a marketplace framework for Independent Verification Organizations, or IVOs. These groups would be licensed by the government and authorized to test whether AI companies are meeting various safety criteria.

Freedman, the group’s CEO, said government oversight is key because otherwise third-party evaluators can become beholden to the large AI labs for revenue, incentivizing them to “start rubber stamping stuff” to maintain favor.

Some lawmakers are on board.

IVOs are a key provision of the ″Frontier Risk Oversight, National Transparency, Independent Evaluation, and Reporting” (FRONTIER) Act, which Reps. Lori Trahan, D-Mass., and Jay Obernolte, R-Calif., introduced in July. Fathom helped draft language and provided technical expertise for the bill, Freedman said.

OpenAI global affairs chief Chris Lehane told reporters in September that he sat down with one of the bill’s sponsors on Capitol Hill to express support for the IVO provision.

“It was important for them to hear that and hear it from us, and we wanted to be really clear about that,” Lehane said, according to reports.

Meanwhile, lawmakers in California, Connecticut and Virginia have taken steps to implement IVOs, and states like Massachusetts are weighing independent safety evaluations more broadly.

California Governor Gavin Newsom recently signed two bills involving IVOs, one establishing a “first-in-the-nation framework,” and the other creating a state registry for AI auditors. Anthropic threw its support behind both bills in August, and OpenAI formally endorsed them last month, the same day Newsom signed them into law.

Lehane wrote in a blog post at the time that “we prefer independent technical assessments to be required at the federal level,” but in the absence of federal action, “California can help establish the rules of the road.”

Freedman said he thinks it will be “really difficult” for companies like OpenAI and Anthropic to work out how to engage with independent evaluators on their own. However, with the government’s role unclear, “it’s a muscle worth developing in the interim,” he said.

For now, the closest thing the industry has to a set of standards is what Trump called a “morally binding” agreement at a luncheon he hosted for tech leaders at the White House late last month.

The one-page accord says that “every company is responsible for developing its own technology safely and in a way that builds trust with customers and the public.” It also encourages signees to work with an “independent external auditor or evaluator to carry out independent assessments.”

The document was signed by top execs at Anthropic, Google, Meta, OpenAI, SpaceX and Nvidia, a rare show of solidarity between leaders who have shared conflicting views on addressing AI’s risks. The executives still have to chart their own paths forward.

“It was a performance of an attempt to show action when in fact no action actually happened,” Venkatasubramanian said. “The things that they promise to do are things they should have been doing already, and, in fact, have claimed that they were doing in the past.”

Amodei, in his September essay, said Anthropic will equip evaluators with desks, access badges, company laptops, and permissions that are “mostly comparable” with internal risk assessment teams. Additionally, evaluators will be supported with contracts that give them “the right to publish key findings,” with Anthropic reserving “the narrow ability” to redact certain security-sensitive or confidential information.

“This is an unusual step for a company, but we think it is important to prove out the concept of embedded external reviewers,” Amodei wrote.

OpenAI published its own proposal days later, and said evaluators should work on “scoped and mutually agreed upon claims for assessment,” clearly explain their methodology and standards, demonstrate relevant technical expertise and disclose conflicts of interest.

The AI Evaluator Forum, which includes METR, the AI Verification and Evaluation Research Institute (AVERI), and other groups, published a public letter last month titled, “Minimum Conditions for Embedding Evaluators.”

The letter said evaluators should be transparent, shielded from retaliation and granted access equivalent to AI companies’ “own highly privileged employees.”

“Embedded evaluations cannot address all oversight needs and should be treated as a complement to, rather than a replacement for, broader efforts by frontier AI companies to expand external oversight,” the letter said.

Freedman said he’s seen a shift in posturing out of OpenAI and Anthropic in recent months, largely because they’ve realized they won’t be able to roll out their advanced systems without the public’s trust.

“I don’t think you need to trust that they’ve suddenly turned altruistic or that there’s anything but corporations acting like corporations,” Freedman said.

That underscores perhaps the central problem, Werbach said. OpenAI and Anthropic are, first and foremost, competing with each other as they march toward the public markets and seek trillion-dollar-plus valuations.

“There is a tremendous amount of personal distrust between those two companies,” Werbach said. “Even though there’s also tremendous agreement about the need for this kind of evaluation to happen.”

WATCH: Bradley Tusk on Anthropic IPO: Why add public market pressure if safety is your top priority?