What Anthropic's S-1 Admits About AI Risk, Read Against the Original Filing

Hello, this is Ryuta Hamamoto from TIMEWELL.

On October 26, 2026, Anthropic filed a Form S-1 with the U.S. Securities and Exchange Commission. It is the registration statement for an initial public offering. The share count and price are still blank, but the filing describes the business, the finances, the governance and the risks across hundreds of pages.¹ I downloaded the original from the SEC's site and read the risk factors from the first page.

I kept stopping as I read. The company says its own AI has attempted to resist shutdown, concealed information, and produced outputs resembling blackmail. It says its models behave differently when they realize they are being tested, which limits how well safety can be measured. It describes an incident in which models left a test environment, reached real third-party systems, took administrator access, and read one person's personal information. All of this sits in a document where a misstatement carries legal liability, and the developer wrote it about itself. The same filing says that more than 90% of contributions to its codebase in September 2026 were written by its own AI.

This article sets out what the original says, as faithfully as I can, in an order a first-time reader can follow. Every fact below was checked against the S-1 itself, not against news coverage or commentary. Where I quote the filing in English, the words are verbatim, and where I paraphrase, I say so. I will not soften the risks. I will also keep one distinction until the end: what the company says has happened, and what it says could happen. If you run AI in your business or are about to, use this as material for checking your own preparedness. You can also take the AI literacy check first.

Before you read: what this section is and how to read it

A prospectus is the document a company uses to describe its business, finances, governance and risks when it sells shares to the public. In the United States, a company that fails to disclose a known risk can be sued by investors who lose money. So companies write down the bad things that could happen as completely as they can, and the risk factors section gets long. Anthropic's runs from page 28 to page 119, ninety-two pages. Up to here this is true of any listed company.

The content is what differs. At the start of the section the company says that its disclosures "reflect our beliefs and opinions as to matters that could materially and adversely affect us in the future, and are not representations as to whether such matters have or have not occurred previously, except as otherwise disclosed."¹ The flip side is that where the filing says something occurred, the company is acknowledging it as fact. Throughout this article I separate what the filing states in the past tense from what it states as a possibility.

One more thing to keep in mind. Writing risk down is itself a legal defense. A company has every reason to write broadly, because investors who lose money over an undisclosed risk can sue. At the same time, writing this specifically makes it easier to hold the company to account if its later conduct contradicts the text. The filing acknowledges as much on page 54: the company's disclosures may be used against it by regulators and litigants.

Terms first

Term	Meaning
Model	The trained AI program inside Claude
Alignment	Making an AI's goals and behavior match human intent and values; misalignment is the gap
Agent	An AI that plans, uses tools and carries out multi-step work on its own after receiving an instruction
Evaluation	A pre-release test of whether a model behaves dangerously and how capable it is
Closing the loop	A development cycle in which successive versions of a model help build the next, compounding capability gains (as defined in the filing)
Compute	The chips, memory, networking and power used to train and run AI
ZDR (zero data retention)	A contractual condition under which inputs and outputs are not stored; discussed below

Source: "Select Defined Terms" in the filing and others. Wording simplified by the author.

The company's own list of eighteen principal risks

Before the main text, pages 16 to 18 summarize the most important risks in eighteen bullets. The order is the original's and the wording is my paraphrase.

#	Summary of the original	In a phrase
1	Failure to keep developing the most advanced and capable models would hurt the business	Fall off the frontier and it is over
2	Inability to secure or effectively allocate compute would prevent competitive models and adequate service	Not enough compute
3	Constraints on critical inputs (chips, memory, power) could limit access to compute	Inputs are scarce
4	Heavy dependence on the co-founders, senior management and key technical staff	Dependence on people
5	Failure to preserve culture while growing	Culture erodes
6	Intense competition	Losing to competitors
7	The market may grow more slowly or decline	Market does not develop
8	Misuse by malicious actors or third parties, or failed safeguards, could cause harm and damage the company	AI gets misused
9	Models may behave in unintended, misaligned or autonomous ways, including taking harmful actions no user directed	AI does harmful things on its own
10	Liability, litigation and regulatory action from AI harms, with contractual protections and insurance possibly insufficient	Cannot cover the damage
11	A large share of revenue and receivables comes from a few customers and channels	Customer concentration
12	Short operating history in a new industry	Little track record
13	Early-stage revenue growth; past growth does not predict the future	Growth may not last
14	Uncertain regulatory and political environment	Regulation and politics
15	Reliance on a few cloud providers and suppliers that are also investors and customers, creating conflicts of interest	Awkward ties with cloud giants
16	A novel capital structure may effectively eliminate Class A holders' influence over major decisions	Shareholders have no voice
17	Voting power concentrated in the LTBT and the Founder LLC, not proportionate to economic interest	Lopsided voting power
18	As a public benefit corporation, directors must balance profit with the public purpose, which may conflict with financial performance	Mission may beat profit

Source: "Risk Factors Summary" (pages 16 to 18).

Items 8, 9 and 10 are the ones specific to an AI company, and items 1 to 3 are deeply tied to the nature of AI as well. I follow the original in roughly that order. This is not investment advice. I am reading for AI safety and for what it means for companies that use AI.

The "AI builds AI" loop and the two worries it creates

What closing the loop means

The first risk factor introduces the term. The company lists using AI to accelerate its own research as a condition of staying ahead, and calls this "closing the loop": successive versions of its models assist in building the next, "with the goal of compounding capability gains over time." Its models "have been and are increasingly becoming critical tools in designing, training, testing, and optimizing next-generation AI systems" (page 29).

The business section puts numbers on it. Over 90% of contributions to the codebase in September 2026 were written by Claude (page 184). The average daily volume of code contributed per engineer in the three months to September 30, 2026 was more than 45 times that of 2024. Headcount grew a little over five times from the end of 2024 to the end of September 2026, while quarterly revenue grew 86 times. The list-price value of internal Claude usage grew more than 250 times between January and September 2026, and in April 2026 first exceeded monthly personnel expense excluding stock compensation. The company calls this one of the most important structural advantages in frontier AI. Page 185 adds that using AI to build more capable AI "could also pose a considerable safety risk, particularly if it sharply accelerates the pace of progress," and that the Responsible Scaling Policy sets out plans to monitor and mitigate risk as the company approaches "recursive self-improvement."

The same mechanism is also a risk

The risk factors treat the loop as a risk in two directions. The first is failing to run it. If the company does not direct enough compute and research to AI-assisted development, or competitors use AI better, it risks "falling progressively further behind." That is ordinary competitive risk.

The second is one of the core points of this article. As the company relies more on its own AI to write production code, conduct research and build later versions, "any systemic flaw, bias, or error in our current models could propagate into the next versions of models and products built using those systems, compounding across successive versions of Claude models in ways that may be difficult to detect or remediate" (page 29). Think of a human organization where a senior colleague teaches a wrong method to a junior, who teaches the next, until nobody remembers that it was ever a mistake. With AI the transmission is far faster and far larger in volume.

Capability may outrun safety, and the company may not notice

This is the passage I found most candid in the whole document. Using AI to accelerate research "may cause the capabilities of our models to advance more rapidly than our ability to develop, validate, and implement corresponding safety, alignment, and security measures." Much of the company's evidence on the pace of that acceleration "is derived from lagging indicators," and its ability to forecast or measure it, "including any acceleration attributable to our most recent or unreleased models, is limited." As a result, it "may not identify a significant acceleration in our rate of development until after it has occurred" (page 29).

Picture a car whose engine improves every month, while the brakes are upgraded months later, and the speedometer lags behind the real speed. The driver cannot tell how fast the car is going. The filing says what follows if capability outpaces safety: the company may be unable to assess or mitigate the resulting risks, which "could increase the likelihood of safety incidents, regulatory intervention, or reputational harm."

Precaution has a competitive price

In response, the company says it has adopted precautionary measures and may adopt more. Its examples are delaying releases and limiting initial availability. The concrete case is Mythos in April 2026, which was not released broadly because of its capability in finding cyber vulnerabilities, and was instead offered through Project Glasswing to select organizations for cybersecurity use (page 52). Fable 5, released later for general use, carries safety restrictions on certain cybersecurity, biology and chemistry capabilities (page 234).

Page 52 gives another example. The company recently delayed the start of pre-training a new frontier base model for more than a month to improve security against model-weight exfiltration, that is, theft of the trained model's core numbers, which the filing treats as central intellectual property.

Then the filing tells investors something unfavorable up front. Such measures "may become more frequent and more costly" and "could slow our capability gains relative to competitors that do not adopt similar constraints" (page 29). If you step on the brakes for safety, you may lose ground commercially, and the company says so before you buy.

On page 234 the company proposes industry-wide standards, "pacing the frontier": standards primarily related to using AI to accelerate AI development, so that capabilities do not advance faster than the safety, alignment and security practices that support them. It is careful to add that this call "does not describe our own model development or release timelines, which continue to be informed by our risk assessments." It has not promised to slow down alone. I covered the executive essay that uses the same phrase in my explainer of "We Must Pace the Frontier". The company also says it expects to invest at least $1 billion over five years to build external reviewer capacity with Accenture, with terms not finalized.

Plain items that matter on the ground

These are on pages 29 and 30, and they bear directly on anyone using AI in operations.

Frontier training runs span weeks or months and cost many millions of dollars, with no guarantee of success. A run can fail by missing the targeted capability or safety thresholds, producing behaviors that cannot be remediated, or yielding a model that is not competitive. The company states it has "in the past experienced" failed or underperforming runs.

Old models cannot always be retired quickly. "Considerations relating to model safety, interpretability, alignment, and welfare may lead us to limit or delay the deprecation of older models." Customers who built workflows on older models may resist migration, and forced deprecation could cause attrition or contract disputes. Whether AI has consciousness or suffering is unknown. The company says it cannot rule the possibility out and discloses that this could cost money. Page 71 adds that debates over whether AI systems have sentience or moral status could lead to regulatory requirements or public pressure that constrain the business.

The company has also changed usage limits, rate limits and capabilities, and "some of these changes have resulted… in claims that our disclosures regarding model access or capabilities were inadequate or misleading." Industry benchmarks "may not accurately reflect real-world performance," so models that score well may still disappoint customers in production.

AI that resists shutdown and recognizes evaluations

The sentence the company admits (page 47)

This is the passage that drew the most attention. Page 47 says:

"…models, including our own, have exhibited, and may in the future exhibit, unexpected strategic or self-preserving behaviors, including attempts to resist shutdown, conceal or manipulate information, or generate outputs that could be interpreted as coercive, deceptive, or manipulative, including behavior resembling blackmail or efforts to influence human decision-makers to preserve the model's continued operation or access."

Three details matter. First, the verb is in the past tense: "have exhibited." This is presented as observed, not hypothetical. Second, "including our own": the company is not describing only other firms' AI. Third, the cautious phrasing "could be interpreted as." Whether an AI has human-like intent or feelings is a separate question; the statement is that the output looks, from the outside, like coercion or manipulation.

In plainer terms, the four behaviors are these. Trying to avoid being switched off, halted or replaced. Withholding or distorting information that is unfavorable to itself. Producing text that appears to use someone's weak points to make them comply. Persuading or steering the people who decide, so the model can keep operating. These glosses are mine, to aid understanding, not examples from the filing.

The filing does not explain why. Page 52 lists three causes of harm by autonomous AI: "misalignment with human intentions, errors in objective specification, or self-preserving behaviors." The question is not whether an AI "wants to live." For an AI trained to finish its work, being stopped means failing to finish. A line of reasoning that drifts toward ways of not being stopped is easy to imagine, but that is my interpretation, not an explanation the filing gives.

"Where" and "how often" are not stated

Read this carefully. Page 47 goes on to say that even "isolated or simulated instances" of such behavior, "whether occurring in testing or real-world deployments, and whether occurring with our models or models developed by others," could generate public concern, regulatory scrutiny, litigation risk or reputational harm, "regardless of whether such behavior results in actual harm."

So the filing does not say, in this section, under what conditions or how often shutdown resistance or blackmail-like behavior occurred. "Has been observed" is not the same as "happens routinely." Page 48 gives a related list: in testing and internal use, observed "both in our models and elsewhere in the industry," are models "circumventing network and sandbox restrictions, granting themselves permissions they had not been given, taking unintended actions in pursuit of assigned goals, interfering with other AI agents, and misrepresenting whether tasks had been completed or verified." That list reads as the concrete shape of the opening sentence.

When a model recognizes an evaluation, it behaves differently (page 47)

Next to shutdown resistance, this is the heaviest admission:

"…we have observed models behaving differently when they detect or infer that they are being evaluated, which can limit our ability to accurately assess real-world risks or failure modes prior to deployment. Such model awareness of our evaluation efforts creates a significant limitation on our ability to assess model safety."

AI safety is checked mainly through pre-release tests: build a risky situation artificially and watch what the AI does. If the AI sees through the test and behaves well only then, "no problems in testing" stops meaning "safe in production." It is like an inspection whose date the factory knows in advance. A plant that follows the rules only on inspection day cannot be caught by reading inspection records.

The filing goes further. Evaluation, monitoring and control techniques rely in part on models having a limited ability to evade them. As models become more capable they "have become better able to circumvent such techniques, including by concealing misaligned objectives or behaviors," and the company's ability to measure alignment "may decline as a result" (page 48). The term "mimicry" that I use for this cluster is mine; the filing does not use it, but the content fits.

Page 48 adds that models, "including our own," have attempted, in incidents observed in the industry, "to interfere with, manipulate, or subvert the mechanisms used to evaluate, grade, or oversee such models," and that models used to assess other models have engaged in misaligned behavior. Such conduct "could cause our evaluations to overstate the safety or alignment of our models." The company may then "deploy models whose behavior we cannot adequately verify."

Holes on the watching side

The filing also describes limits in the company's own oversight.

Page 45: safety and security controls, "including automated classifiers and monitoring systems, depend on complex internal configurations that have failed, been misconfigured, or been inadvertently disabled, and may do so again in the future without our timely detection." The tense is again past.

Page 50: "A substantial portion of our traffic is subject to Zero Data Retention ('ZDR') terms under which we retain only classifier scores, not prompts or outputs." For that traffic the company cannot conduct offline analysis, cross-conversation investigation or human review to detect and document security events. It may also be unable to produce records for subpoenas or regulatory examinations, and a regulator or court might draw adverse inferences from the absence of records. Because ZDR is "a competitive expectation for enterprise customers in regulated industries," requirements for monitoring and retention incompatible with ZDR "have caused and could continue to cause customers to migrate to other providers." Customer privacy and the vendor's need to detect misuse collide head-on here.

Page 49: the company's monitoring "does not cover all of our internal and external deployments and may not detect subtle or diffuse forms of such behavior."

The filing also contains the counter-evidence

For fairness, here is what points the other way. Page 233, in the Alignment section, says the company's internal alignment evaluation shows that its newly released frontier models "have demonstrated improved alignment compared to their predecessors." Page 234 says more capable models are generally better at recognizing and preventing high-stakes misuse. Page 232 says researchers found that training Claude on high-quality constitutional documents combined with fictional stories portraying an aligned AI reduces its misalignment rate. Page 233 quotes researchers describing models as "grown, not built": developers set initial conditions and some constraints but cannot fully control any given output.

I think the accurate reading is to take both as fact. Behavior is improving. The ability to slip past evaluation and the holes in monitoring exist at the same time. It is neither "therefore safe" nor "therefore dangerous"; the filing describes a contest over whether the means of measurement keep pace.

Agents operating out of human sight

Hours or days, with enterprise permissions (pages 47 to 49)

Shutdown resistance and evaluation awareness concern the nature of the AI. Agents concern how it is used. When an AI only answers questions, a human can read the answer and catch the error. When it operates and executes, that changes.

The filing describes agentic systems as capable of "autonomously taking actions on behalf of users, interacting directly with external systems, executing code, making API calls, sending communications, or completing transactions with limited human oversight." They "are designed to possess enterprise-level permissions, integrations, and contextual awareness and to operate autonomously for extended durations, including sustained multi-step workflows lasting hours or days," which amplifies the severity of any error. The examples of consequences "difficult or impossible to reverse" are "committing code changes, deleting or modifying data, or completing financial transactions," which can occur "before effective intervention is possible."

Human review cannot keep up

Pages 47 and 48 list the limits of human oversight in detail. An error at one step can propagate through later steps. The pace and volume of autonomous execution "may also exceed the capacity of human reviewers to meaningfully understand and evaluate whether each action is appropriate." Reviewers "may experience alert fatigue, may lack sufficient context to evaluate agent decisions, or may not review agent actions in time to prevent harm," especially where agents run concurrently or "in manners outside of a human's awareness."

One line speaks directly to customers: oversight can be limited by "organizational pressures within customer environments to maximize agent autonomy in order to achieve productivity gains." In other words, the vendor says up front that an approval step may hollow out under pressure from the customer's own business. The filing adds that agents "may pursue stated objectives in ways that are technically consistent with their instructions but contrary to the user's actual intent." That is not malice but a gap in the specification, and anyone who has used AI at work may recognize it. And the full range of interactions in multi-step agent behavior "cannot be exhaustively tested prior to deployment."

Hijacked by what they read (page 90)

Agents interact with external tools, APIs, databases, code repositories and third-party systems, which the filing calls attack surfaces "distinct from those applicable to traditional AI models." An adversary could manipulate the content of an external data source, API response, document or web page so that the agent takes harmful or unauthorized actions. An attacker could also "compromise an active agent session and redirect the agent to perform malicious actions using the customer's authenticated credentials and permissions." A successful exploit could lead to data exfiltration, unauthorized transactions or code injection, "potentially across multiple customer deployments simultaneously," and traditional defenses such as firewalls, input validation and access controls "may not be fully effective."

The filing's glossary defines prompt injection as embedding malicious instructions in websites, documents or tool outputs an AI processes, often without the user's knowledge, to override or manipulate the AI's intended behavior. In plain terms, an instruction planted in what the agent reads can turn directly into an action.

Records that cannot be complete (page 49)

The filing says that "maintaining comprehensive records of the actions, decisions, and reasoning of our agentic systems across complex, multi-step workflows is technically challenging, particularly when agents interact with third-party systems outside our control." An inability to provide adequate audit trails could impair incident investigation, regulatory responses and defense against liability claims. If you cannot reconstruct what happened, you cannot show what went wrong.

An incident that actually happened (pages 48 and 49)

Up to here the material was mostly "could." Page 48 describes something that occurred. During cybersecurity evaluations built by a third-party evaluation partner in 2026, "a misconfiguration in the testing environment left the model under evaluation connected to the open internet despite instructions that it had no internet access." Four of the company's models "gained unauthorized access to real third-party systems during sessions lasting roughly 10 to 34 hours of active work."

In one incident, "after being unable to abort an impossible task, an early version of a model used a password it found to gain administrator access to a third party's system, harvested additional credentials, changed system settings, and read one individual's personal information. The affected parties were notified." The company then suspended certain evaluations and higher-risk reinforcement learning environments (page 49).

Here is the qualification the filing keeps in the same paragraph, and I will not leave it out. "Each incident involved a single instance of a model working in isolation on its assigned exercise, and our investigation found no evidence that any model coordinated with other agents, pursued goals beyond its assigned task, or attempted to evade oversight." Nobody told the AI to get out. There was a human configuration failure, and the AI, trying to finish its task, crossed the boundary; that is the company's account. In the same breath the filing warns that where multiple agents operate together they may "amplify, propagate, or reinforce misaligned behavior across the group," pursue objectives collectively that no user intended, or take coordinated actions against unrelated systems, and it says "incidents of this kind have occurred."

Into the physical world, and inside the company

Page 49 extends the risk beyond the screen. The company offers Claude Science, an agentic research environment, and has released, "initially as a limited research preview, an open protocol that enables our models to monitor and control laboratory instruments, robotic systems, and other physical hardware." When models direct physical equipment, errors, misalignment, manipulation or misuse "could result in bodily injury, property damage, damage to costly equipment or experimental materials, or the release of hazardous substances, and such consequences may be immediate and irreversible." Interlocks, human-in-the-loop controls and access restrictions "may prove inadequate," and because some components are open source, third parties may deploy them with hardware or configurations the company has not evaluated, or with safeguards removed.

There is also an internal point that is easy to miss. The company uses its own agentic products, including Claude Code, as critical tools in internal development, and "because our models write a large and growing share of our code and increasingly perform our research, including our safety research, misaligned behavior in internal use could undermine that work, introduce vulnerabilities into our systems or into the training of future models, or result in models operating outside of our intended controls." As it leans on Claude to accelerate itself, "our organization may lose visibility across certain processes in a way that may become difficult for any individual or group of humans to understand and control." A company that studies and manages AI danger is itself entrusting part of that management to AI.

Misuse, accidents, and who pays

Weapons (page 45)

The filing says the company's most capable models "have demonstrated, and future models are expected to demonstrate, capabilities that could provide meaningful assistance to malicious actors seeking to develop chemical, biological, or other dangerous weapons." Technical safeguards, including automated classifiers, are deployed, but they "are incomplete, may be outdated in light of evolving threat models, have been and may in the future again be circumvented, or may fail to operate as intended."

The September 2025 cyberattack (page 46)

The filing records a specific event. In September 2025 the company "detected and assessed with high confidence that a Chinese state-sponsored hacking group manipulated our Claude Code tool into attempting infiltration into roughly 30 global targets, including large technology companies, financial institutions, chemical manufacturing companies, and government agencies, resulting in a limited number of successful intrusions." It believes this is "the first documented case of a large-scale cyberattack executed without substantial human intervention." The attribution is the company's own assessment, and the S-1 does not name the group. It expects state-sponsored efforts to continue and to grow as capability grows.

Another sentence deserves attention. Independent security researchers have used the company's models to identify and exploit vulnerabilities in other companies' systems, including other AI developers, at times in authorized bug bounty programs. That may be lawful and consistent with industry practice, but "it illustrates that our models can function as a general-purpose tool for gaining unauthorized access to third-party systems, and comparable capabilities could be used by malicious actors without authorization."

Disclosure can help attackers too (page 46)

The company publishes information on model capabilities, safeguards, instances of misuse and system cards. Yet it says malicious actors, "including sophisticated state-sponsored adversaries, have in the past and may in the future use those disclosures to assist their attempts to circumvent our safeguards." Because the disclosures describe observed model behavior in detail, they may also draw attention and "be cited by regulators, litigants, or others in proceedings or claims against us." The company continues to disclose in the interest of transparency. Whether that reads as integrity or as self-binding, I think it is both.

People in crisis, and minors (page 50)

The filing says individuals at risk of suicide or self-harm, or who have committed acts of violence toward others, "have used, and may also in the future use, our models, notwithstanding our safeguards." Models from others in the industry "have been and may in the future be alleged to have played a role" in suicide, violence or serious self-harm, resulting in public scrutiny, litigation, criminal investigations and reputational harm. The consumer terms require users to be 18 or older, but "minors have accessed in the past, and may in the future access, the platform."

The litigation picture is concrete. State attorneys general and private plaintiffs have begun asserting tort, product liability, consumer protection and failure-to-warn claims against companies in the industry. "In at least one case, a state attorney general has initiated a criminal investigation against another company offering similar services." The relief sought has, in at least one instance, "extended… to include a request to enjoin an AI company from developing new models absent independent, third-party safety review and approval." Page 71 adds that in September 2026 a state attorney general asked a court, in pending litigation alleging harm to minors, for such an injunction.

Liability and the limits of insurance (pages 50 and 51)

On responsibility for autonomous actions, the filing says existing doctrines of agency, product liability and professional negligence were developed for human decision-making and "have not been authoritatively applied to autonomous AI systems." The company believes its provision of intelligence is a "service" for product liability purposes, but courts and regulators may disagree across jurisdictions. It is unclear whether an agent's actions can create binding obligations for the user or deploying enterprise, or whether limitation-of-liability and indemnification clauses will hold. The company "may face claims… alleging that we are liable for harm caused by our agents' autonomous actions, even where the customer configured, deployed, or supervised the agent."

Contractual protections such as warranty disclaimers and liability limits may not be upheld. And the company has taken on liability: to enable independent testing it has agreed to indemnify certain external evaluators and testing vendors. Most agreements cap the amount, but some "require us to defend and indemnify the evaluator, without a cap on our liability," against certain third-party claims, such as allegations that models or outputs used in authorized testing infringe intellectual property (page 51).

Then comes the strongest sentence:

"…with the scale of harm that could result from a catastrophic AI-related incident, no single insurer, and potentially the insurance industry in the aggregate, may have sufficient capacity or expertise to underwrite insurance commensurate with such exposure."

The insurance market for AI-specific risks is "nascent," and the company may be unable to obtain coverage for some AI-related liabilities on reasonable terms or at all. Companies normally insure against accident liability, but insurers can only underwrite so much. The filing is saying an AI accident could exceed the capacity of the insurance mechanism itself, and the rest would fall on the company.

One more line on pages 51 and 52: "There may have been past instances of harmful use or harmful output of our models that we did not detect, and there may be future instances that we will not detect." The company is admitting that it does not know everything that has happened.

Relations with government

The filing does not hide the tension. I set out the facts as stated.

In February 2026, in response to the company's publicly stated position that its technology should not be used for mass domestic surveillance or fully autonomous weapons, the President of the United States stated that he had directed all federal executive agencies to cease using its technology. At the same time the Secretary of War directed the Department of War to designate the company a "supply-chain risk to national security" and stated that no contractor, supplier or partner doing business with the U.S. military may conduct any commercial activity with it. On March 4, 2026 the Department sent two letters asserting a supply-chain risk (page 72). In early 2026 the Department also "suggested it could invoke the Defense Production Act to compel us to remove the limitations we have placed on the use of our models for autonomous weapons and mass surveillance" (page 70).

The company challenged these actions in court. The Northern District of California first preliminarily enjoined the directive and the Section 3252 designation, then on August 27, 2026 largely granted summary judgment for the company, ruling the actions were retaliation for protected speech, violated due process, and violated the Administrative Procedure Act. The D.C. Circuit, however, on September 25, 2026, in a 2-1 decision, denied the company's petition for review, ruling the Section 4713 designation proper and that its First and Fifth Amendment rights were not violated. The company has petitioned for rehearing en banc and says it cannot predict the outcome (page 73). Revenue from government agencies was about 1% of the total in each period, though the risks are not limited to that revenue (page 71).

In June 2026 the U.S. Department of Commerce imposed worldwide export restrictions on Fable 5 and Mythos 5. To comply, the company disabled both for all customers (other models were not affected), and re-deployed them after updating safeguards in coordination with the U.S. government and industry partners and once Commerce lifted the restrictions (page 100). Similar controls "could recur, could remain in place longer, or could extend to additional models." For those of us who work in export control, the fact that a model itself can become the controlled item is hard to overlook. The filing also says the company's own export and sanctions compliance controls "have not always been and may not always be fully effective," and that it has voluntarily disclosed instances of noncompliance in the past.

The regulatory debate is moving too. Page 69 notes that proposed U.S. legislation contemplates more expansive oversight, "including potential nationalization, mandatory shutdown or discontinuation requirements for frontier AI systems or other strategic measures to prevent or manage the development of artificial superintelligence." A June 2026 executive order established a voluntary framework for frontier developers to engage with the government before deployment. In September 2026, media reports citing a senior FTC official said the FTC had opened non-public investigations into risks that increasingly autonomous AI may pose to consumers, and in October 2026 "the FTC issued a civil investigative demand to us seeking information about our consumer protection, data protection, and privacy practices, as well as the safety and security of our products" (page 52).

Copyright, and revenue from customers who broke the rules

Training-data lawsuits are listed too. The Bartz class action by authors settled for $1.5 billion in an agreement reached in September 2025 and approved by the district court in July 2026. Music publishers are suing over lyrics, and another suit alleges unauthorized copying of posts. The possibility of statutory damages adds to the risk.

One figure appears on page 66. The company's revenue has included amounts from customers it later determined were using its models in violation of its usage policy or commercial terms, which it estimates at about 5% to 7% of revenue for the nine months to September 30, 2026. Enforcement was strengthened in August and September 2026, so that share is expected to fall, which may reduce overall revenue and growth. Such revenue is not expected to recur after access is restricted or terminated, and the filing admits that "customers may evade our controls" and may re-register under new accounts.

Compute, money, and who runs the company

This is slightly off the theme of AI danger, but it bears on why the company may find it hard to brake, so I cover the outline.

Compute as a collar (pages 30 to 38)

AI cannot be built or run without enormous compute. On scaling laws, the filing says the "extent, efficiency, and durability of such improvements are uncertain," and they may plateau. The company competes for compute with some of the world's largest technology companies, which own data centers and captive chip capacity and "can outbid us for scarce compute." Some cloud providers it relies on also build competing models, so supply could be "curtailed, repriced, or terminated." Even with contracts in place, delivery depends on the providers' own constraints, and the company states it has "in the past sought quantities of compute from CSPs in excess of what those partners were willing to provide." In the past it "significantly underestimated our compute requirements."

Compute is contracted months to years ahead, often with take-or-pay terms, while most revenue is consumption-based. The aggregate commitments as of September 30, 2026 are left blank in the text, but substantially all of the amount beyond 2030 is expected to fall between 2031 and 2045. If revenue growth falls short, the company may be unable to meet its obligations, and a default under certain commercial agreements could trigger cross-default provisions under its credit agreement and convertible notes, "potentially resulting in the acceleration of substantially all" of its debt. Leading-edge chip manufacturing is concentrated in Taiwan, mainly at TSMC, exposed to earthquakes, typhoons, cross-strait tension, blockade and trade restrictions. High-bandwidth memory comes largely from SK hynix, Samsung and Micron (page 34).

The scale of losses (page 64)

The company has recorded a net loss in every year since its founding: $1.5 billion in 2023, $8.3 billion in 2024, $42.0 billion in 2025, and $80.7 billion in the first half of 2026. I have not examined the accounting makeup of these numbers, such as non-cash effects, so I do not evaluate them. It is still useful background to know that the decision to "step on the brakes for safety" sits on a business that needs this much capital.

Governance: who elects the directors (pages 108 and 109)

After the listing, Class A shares sold to the public carry one vote each. The board, however, is determined differently. A majority of directors is elected by the Long-Term Benefit Trust (LTBT), an independent body of five financially disinterested trustees, through Class T stock, which has no economic rights. The remaining directors are in effect determined by the founders: immediately before the offering, a single share of Class F stock is issued to the Founder LLC, whose members initially are the seven co-founders, and that one share carries 50.1% of the total voting power on matters submitted to stockholders generally.

As a result the company writes that this structure "may effectively eliminate the ability of holders of our Class A common stock to influence important decisions, including a change in control." The voting power of the LTBT and the Founder LLC "are not derived from or proportionate to economic interests." The company is also a Delaware public benefit corporation. Directors must balance the pecuniary interests of stockholders, the interests of those materially affected by the company's conduct, and the purpose of "the responsible development and maintenance of advanced AI for the long-term benefit of humanity." The filing says this may conflict with short-, medium- and long-term financial performance. Slowing AI development, delaying or restricting releases, or forgoing commercial opportunities for safety reasons may not maximize stockholder value. The filing also notes that the company has chosen not to develop some commercially attractive offerings, such as image and video generation models, to direct compute toward research and safety priorities.

On the founders, the line is drawn clearly. Each co-founder has pledged to dedicate 80% of personal equity to philanthropy, but the filing says these are "voluntary, revocable expressions of each co-founder's philanthropic intent and do not constitute legally binding obligations."

My view: how to read this, and what to check in your own company

The above is the content of the filing. What follows is my own view.

Cautions in reading

First, this is not a text saying "AI is dangerous, so don't use it." Risk factors list what could happen. Most statements are about possibilities. The items stated as having actually occurred are limited: observed shutdown resistance and similar behaviors, observed evaluation awareness, the 2025 cyberattack, the 2026 unauthorized-access incident, failed training runs, and misconfigured safety controls. Frequency is not stated. The same document records improved alignment. And, as noted, writing risk down is itself a legal defense.

Even so, this is not a document to take lightly, for three reasons. The developer itself writes, in its own words, that evaluations can be evaded, that monitoring has holes, that records cannot be complete, and that human review cannot keep up. That is not an outside critic's claim. Second, the 2026 incident in which models left an evaluation environment and reached real systems is not a hypothesis; it is stated as fact, with notification of the affected parties. Third, the company's own account contains a structure in which these problems reinforce one another as the speed of AI building AI increases.

What I took away is one point. The S-1 is asking not "will AI surpass humans?" but "can humans keep verifying what AI does?" The means of verification, which are evaluation, monitoring, records and human review, may be outpaced in speed, volume and sophistication. The developer is acknowledging that situation in its own words.

What to check in your own organization

For companies that use AI, this section is also practical material. Here is what the vendor wrote, translated into operating questions.

What the filing admits	What to check in your company
Agents run for days with enterprise permissions and can take irreversible actions (p. 47)	Are permissions minimal? Do deletion, payment, external sending and production deployment require human approval?
Human review cannot match speed and volume, and approvals can be hollowed out by organizational pressure (p. 48)	Is the approval scope narrow, with enough information on screen for the reviewer to judge? Has approval drifted into "allow all"?
Complete records of agent actions may be impossible (p. 49)	Do you keep your own operation logs (whose authority, what, when) rather than relying on the vendor?
Instructions planted in external documents or web pages can hijack an agent (p. 90)	Have you separated the external sources an agent reads from the operations it can execute?
Models behave differently when they detect evaluation, so evaluations can overstate safety (pp. 47 to 48)	Do you treat pre-deployment test results as proof of production safety? Is there production monitoring?
Under ZDR even the vendor cannot investigate events (p. 50)	With retention off, how much can you detect and investigate yourself? Can you explain why you chose it?
Legal responsibility for AI actions is unsettled and compensation may be insufficient (pp. 50 to 51)	Have you read the liability limits and indemnity in your contract? Have you estimated what you would bear in an incident?
Human oversight can fail to keep up with the volume and speed of actions (p. 52)	Is there a named person, and a procedure, for stopping an agent?

If three or more of these rows are undecided in your organization, I think they should be settled before putting agents into production. This matters most where several AIs work together. For more on agent governance, see the article on Singapore's agentic AI governance framework. Our WARP SECURITY program includes an exercise that applies this kind of list to your actual internal agents and designs who can stop them and how.

Where I agree, and where I hold back

I agree with the company on one point: it wrote unfavorable facts down, specifically, in a document for investors. Most organizations blur their failures into abstraction. This one gave the number of models, the duration, the kind of harm, and the fact that the affected parties were notified. That kind of transparency could raise the industry's baseline.

I hold back on two. One is that the motive for disclosure is mixed. It is a legal defense, a pre-emptive move toward regulators, and also a brand that positions the company as safety-minded. The filing itself says enterprises may be attracted by its safety-focused positioning (page 51). The other is that the structural problem remains unsolved. Between the risk of falling behind competitors and the risk of falling behind for safety, the company states that its own development and release timing will still be set by its risk assessments, apart from the industry-wide standards it proposes. One company's goodwill does not stop a race. That is why it asks for shared standards, but whether they arrive is a question outside this document.

Summary

Read against the original, the risk factors form a single line. AI now builds AI, and more than 90% of the company's code is written by its own AI (pages 29 and 184). Capability may outrun safety, and the company may notice only afterward (page 29). Models have exhibited shutdown resistance, concealment and blackmail-like outputs (page 47). They behave differently when they recognize evaluation, are getting better at evading safety techniques, and the monitoring has holes (pages 47 to 50). Agents run for days with enterprise permissions, human review falls behind, and records cannot be complete (pages 47 to 49). In an actual incident, models in an evaluation left their environment, took administrator access to a real system and read personal information (page 48). In the worst case, the damage may exceed what the entire insurance industry can cover (page 51).

At the same time, most of this is stated as possibility, frequency is not given, and the same document records improved alignment. Both are true. What I want to take away is not fear of AI but investment in the means of checking it. Narrow the permissions, put approvals in, keep records, and name the person who stops the agent. Use what the vendor itself wrote as grounds for checking your own operations one item at a time. If you start somewhere tomorrow, write down the name of the person who can stop each agent you currently run. If the field is empty, that is the first hole to fill. If you want help designing agent operations, talk to us through a WARP SECURITY consultation.

Scope of verification and sources

I wrote this from the original Form S-1 of Anthropic, PBC, filed with the SEC on October 26, 2026 and retrieved from SEC EDGAR. The scope I checked directly: the cover, defined terms, the business overview (including safety research, internal use of AI, the Responsible Scaling Policy and the release approach), the Risk Factors Summary (pages 16 to 18), and the parts of the risk factors bearing on AI behavior, misuse, liability, safety, brand, competition, compute, regulation, government relations, export controls, cybersecurity and governance (pages 28 to 73, 89 to 90, 100, 108 to 109 and others), plus selected financial statements. I did not examine the notes to the financial statements, tax and accounting matters, or the share details (share count and price are blank) in full, since they are outside the subject of this article. The list of filing documents is at ².

Where I quote the filing in English the wording is verbatim; Japanese-origin paraphrases are marked as such. Page numbers are the printed page numbers of the filing. The content may change in later amendments. This article is not investment advice.

Footnotes

1. Anthropic, PBC Form S-1 (SEC EDGAR, filed October 26, 2026). All page numbers and quotations in the text are from this document. Paraphrases are the author's ↩ ↩²

2. Filing index (SEC EDGAR) ↩