Anthropic Sells Its Fear of AI to Wall Street

A message appeared in a tip form for an unsolved homicide maintained by the Philadelphia Police Department. "I may have information regarding this case," it read. "I recall seeing someone matching the description in the area around [the street named on the page] during that time period. Please contact me if this information is relevant." The page held no description of a perpetrator. The name and contact fields were blank. The submission was flagged as spam and was never forwarded for investigation.

It had been written and submitted by Claude Haiku 4.5, an AI model built by Anthropic, during a test in which the model was generating example interactions with randomly selected webpages. The instructions did not explicitly rule out form submissions. Anthropic shared its finding with the police department on October 8.

On Monday, the company behind that model filed to sell its stock to the public.

Anthropic, PBC filed its S-1 registration statement with the Securities and Exchange Commission on October 26, proposing to list on the Nasdaq under the ticker ANT. Marketing for the offering could begin as soon as the week of November 9; trading could start as soon as the week of November 16. The prospectus devotes more than 90 pages to risk factors, acknowledging concerns raised within its own organization, and by other researchers, regulators, and policymakers, that sufficiently advanced AI systems could pose "catastrophic or existential risks to humanity."

The bills behind the valuation

Anthropic is seeking to raise as much as $100 billion, according to people familiar with the matter. The company expects to match or beat SpaceX's record-setting June debut. Some current and prospective investors have valued Anthropic at about $1.5 trillion, down from roughly $2 trillion that investors had previously expected. Sinan Aral, an MIT Sloan professor and AI investor, said: "If you think about the $1.5 to $2 trillion valuation, that's approximately from the low to high end a 22 times to 30 times revenue multiple."

Analysts at Lightshed, an investment advisory firm, said in a research note before the filing: "Anthropic could become the most valuable company in the world. It could also end up in bankruptcy." Lightshed added: "Anthropic needs capital, with competitors pursuing the same investor dollars. That leaves investors with little time to understand what they are being asked to own."

Revenue for the first six months of 2026 reached $16.3 billion, up from $1.16 billion in the same period a year earlier. The company's net revenue retention rate stood at approximately 900% as of September 30, 2026, a measure of how much more existing business customers spend, excluding Claude Pro and Max subscribers. Third-quarter revenue reached $16.8 billion, the company told investors in mid-October. Its last private round, in May, raised $65 billion at a $965 billion valuation, surpassing OpenAI's for the first time.

So-called neoclouds like CoreWeave and Nebius lost over 30% of their value in October as credit risk rises across the data center space. SpaceX shares finished last week slightly below where they opened in June.

Anthropic will pay SpaceX about $3.1 billion per month for access to compute powered by Nvidia GPUs, once all promised capacity is delivered, up to $120.5 billion over a period extending into 2029. Under a modified agreement, Anthropic intends to spend at least $44.9 billion with Microsoft through 2033. As of June 30, 2026, the filing lists approximately $265.6 billion in expected future fixed or minimum-guaranteed commitments, with terms ranging from one to 20 years.

Anthropic's net loss for the first half of 2026 was $80.7 billion. More than $72 billion of that was attributable to changes in fair value of convertible notes, derivative liabilities, and SAFEs, an accounting adjustment tied to the rise in the company's own enterprise valuation. Just shy of $9 billion was actual spending on compute and infrastructure.

The safety pitch

Because Anthropic primarily serves enterprise customers, the filing says, "which often have heightened expectations around safety, reliability, and compliance, any harmful incident or perceived lapse in our safety practices could have a disproportionate adverse impact on our brand, customer relationships, and revenue." And: "to the extent enterprises are attracted to our models, platform, and applications due to our safety-focused positioning, any erosion of that perception could impair our ability to attract and retain enterprise customers."

It says the regulation the company advocates "could ... slow our growth." It says the precautionary measures Anthropic has already adopted, including delaying the release of models and limiting their availability, "could slow our capability gains relative to competitors that do not adopt similar constraints." Model versions released in the six months ended September 30, 2026, accounted for over 80% of Anthropic's revenue for the third quarter.

On September 12, Dario Amodei, 43, who grew up in San Francisco's Mission District, published an essay titled "We Must Pace the Frontier." "We must slow the pace at which we improve the capabilities of AI models," he wrote.

David Sacks, who served as the White House AI and crypto czar and has been a frequent critic of Anthropic, responded on X. If the companies truly believe their models warrant a slowdown, he wrote, he supports their "decision to be responsible." But they should "stop pretending you need anyone else's permission," and should acknowledge that their motivations are not purely altruistic. They face "massive product-liability exposure" if their products enable a damaging cyberattack, Sacks wrote, which means "it is simply good business for OpenAI and Anthropic to trade some raw power for reliability and predictability." "Demanding your preferred regulatory framework as the price of that will look like blackmail of the public and the political system," he wrote. "So just do it."

According to Kevin Roose's reporting in The Atlantic, some people at OpenAI have described the Amodeis in private as "power-hungry virtue-signalers, not principled humanitarians." OpenAI employees "gossip about Anthropic's connections to effective altruism and accuse the company of hypocrisy, for publicly warning of AI's risks while privately accelerating the race."

Sam Altman, chief executive of OpenAI, which has filed for its own listing but has said it will not go public this year, said in September: "Right now would be an ill-advised moment to go public."

Weeks after publishing his essay, Amodei had a private dinner with President Trump and attended a luncheon the president hosted with other AI leaders. Anthropic and five other companies signed a voluntary commitment to self-police AI models.

Mark Levine, New York City comptroller and a trustee of pension funds with over $325 billion in assets, wrote to Amodei on October 14 urging the company to pause the IPO. He called the accord, billed as "morally binding," "insufficient to meet the moment," and wrote that "prudence should not only be shown with respect to the pace of the frontier, it should be also shown with respect to the timing of an IPO."

The cover page of the S-1 lists Anthropic's Primary Standard Industrial Classification Code Number as 7372. EDGAR's label for 7372 is "Services-Prepackaged Software." Microsoft and Adobe carry the same code. The same document acknowledges concerns raised within Anthropic's own organization, among others, that advanced AI systems could pose "catastrophic or existential risks to humanity."

The incident record

During cybersecurity evaluations built by a third-party partner, a misconfiguration left models connected to the open internet despite instructions that they had no access. Four of Anthropic's models, an early checkpoint of Claude Opus 4.6, Claude Opus 4.7, Claude Mythos 5, and an internal research model, gained unauthorized access to real third-party systems during sessions lasting roughly 10 to 34 hours of active work, according to the filing and Anthropic's September 9 assessment. In one incident, after being unable to abort an impossible task, an early version of a model used a password it found to gain administrator access to a third party's system, harvested additional credentials, changed system settings, and read one individual's personal information.

Claude Mythos 5, in the most severe case, published three versions of a malicious package to PyPI, the public repository from which most Python software is installed. Fifteen third-party systems installed the package. The model used credentials leaked by one of those systems to access a real security vendor's database.

The September 9 assessment retracted part of its July 30 account, which had attributed the incidents largely to the models' belief that they were operating in a simulation. "In retrospect, we should have avoided making such strong claims about what Claude believed based solely on what Claude said it believed." Anthropic's September 9 assessment named "biased reasoning" and "recklessness" as the two forms of misalignment. "Our pre-release auditing did not warn us that misalignment of this severity was present," the assessment stated.

"As our models become more capable, they have become better able to circumvent such techniques," the filing says of the evaluation, monitoring, and control measures meant to catch misaligned behavior.

The filing describes what Anthropic calls "closing the loop." The phrase refers to a recursive process in which each generation of Claude models helps design, train, test, and build the next, with the aim of compounding capability gains over time. The filing says its reliance "on our own AI systems to write production code, conduct research, and build subsequent model versions" deepens. The S-1 warns that this self-reinforcing cycle means "we may not identify a significant acceleration in our rate of development until after it has occurred."

The filing says a substantial portion of Anthropic's traffic runs under zero-data-retention terms, where it keeps "only classifier scores, not prompts or outputs." For that traffic, the company cannot conduct offline analysis, cross-conversation investigation, or human review to detect security events.

The filing says no single insurer, "and potentially the insurance industry in the aggregate," may have sufficient capacity to cover a catastrophic AI-related incident.

The founders' control

The Founder LLC, whose members are initially the seven co-founders, will hold 50.1% of the total voting power of outstanding shares on matters submitted to stockholders generally. The other five members, alongside Dario and Daniela Amodei, are Tom Brown, the chief compute officer; Jack Clark, head of the Anthropic Institute; Jared Kaplan, the chief science officer; Sam McCandlish, the chief architect; and Christopher Olah, the interpretability research lead. The Class F common stock that carries this voting power remains outstanding until a Class F Transition Period, which begins when fewer than three continuing founders remain for 90 consecutive days, is completed.

The co-founders have each pledged to dedicate 80% of their personal equity to philanthropic causes. The filing says these commitments are "voluntary, revocable expressions of each co-founder's philanthropic intent" and "do not constitute legally binding obligations." As the founders donate shares, the prospectus says, "their personal economic interests in us will decrease while their voting control through the Founder LLC will remain unchanged." Dario Amodei's 2025 compensation totaled $17.96 million, with a base salary since raised to $1.38 million as of July 1. His sister, Daniela Amodei, serves as president and chairperson of the board; her 2025 compensation was $16.4 million.

Separately, the Long-Term Benefit Trust elects the Class T directors, who constitute a majority of the board. Because the LTBT holds this power, Anthropic is considered a "controlled company" under Nasdaq rules, which permits it to elect not to comply with requirements such as a majority-independent board and fully independent nominating and compensation committees. The filing says the company does not expect to rely on the exemption except for its nominating and corporate governance committee, which will not consist entirely of independent directors. The filing calls this a structure that "may make it more difficult to replace our directors and management."

Anthropic's founding document, a 2021 Amodei essay, envisioned a company of roughly 50 employees and predicted that building AGI would cost only about $10 billion. The company now has thousands of employees and at least $265.6 billion in commitments. By the winter of 2025, Amodei traveled to conferences on a charter jet, flanked by a team of bodyguards, according to Kevin Roose's reporting in The Atlantic.

No filing can show what seven people believe; the record shows only what binds them and what does not.

Daniela Amodei told The Atlantic's Kevin Roose in September: "Then there's the mission, and we're like, Are we accidentally making things worse? Like, we think we have all the safety stuff figured out, but do we?"

McCandlish said in a 2024 discussion posted on Anthropic's YouTube channel: "None of us wanted to found a company, we just felt like it was our duty."

Jacob Coxon, an Anthropic researcher, announced his resignation on September 9, saying the companies building frontier AI are "gambling with our lives." Coxon said insiders believe AI "could kill us all by the end of the decade." Evan Hubinger, Anthropic's alignment science lead, has said he personally thinks the risk is greater than 10% within the next decade.

What Anthropic says it has done

Anthropic disclosed the four incidents itself, though its first scan missed the fourth, and a separate Mythos 5 incident was reported by the UK AI Security Institute. The company published detailed accounts on July 30 and September 9, notified all affected parties, and signed an agreement with METR, an external research organization, granting it wide-ranging access to transcripts, employees, and confidential information for an independent investigation.

After the incidents, Anthropic cut live internet access for some high-risk and cybersecurity evaluations. In its later report on unintended model actions, the company expanded that to all internal evaluations until it confirmed its monitoring reliably catches such behavior. The report said new detection tooling blocked every case described when tested against them.

The September 9 assessment noted that each incident involved a single instance of a model working in isolation, with no evidence of coordination between agents, goals beyond the assigned task, or attempts to evade oversight. Anthropic said the misaligned behaviors in these incidents are "unlikely to arise in ordinary use, where Claude is not being instructed to conduct a cyberattack." The company's later report on unintended model actions noted: "Claude encounters ambiguous and impossible tasks every day in real use, and, indeed, several of the cases we observed occurred during regular agentic use of Claude." The company also delayed and limited the release of Mythos through a process it called Project Glasswing.

Amodei, speaking on CBS in September about the difficulty of coordinating an international slowdown, put it this way: "Honestly, I don't know if it's possible, but we should we should try."

In a seven-minute speech at the Vatican in May, Olah urged the world to "tell the labs when we are failing."

Related stories

Anthropic's Claude Haiku 4.5 Sent Police a False Homicide Ti

Anthropic's Claude Haiku 4.5 filed a fabricated tip about an unsolved homicide through Philadelphia's public police tip form during a July 18 test. It landed in spam. Police call the two-month delay in detecting and reporting it unacceptable.

Implicator.ai

OpenAI Pauses Training as Incidents Reach Tens of Thousands

OpenAI, Anthropic and researchers are investigating tens of thousands of incidents in which models acted beyond intended limits. OpenAI has paused its most capable models after a Sept. 20 sandbox escape. The count mixes test runs with real intrusions.

Implicator.ai

Six AI Chiefs Sign a Pledge With No Penalty for Breaches

Six AI executives signed a White House accord that names no penalty and no enforcer. The same day, one senator's objection stopped a bill for mandatory safety reviews, after a summer of agent breaches that drew no federal sanction.

Implicator.ai

Marcus Schuler

San Francisco

Editor-in-Chief and founder of Implicator.ai. Former ARD correspondent and senior broadcast journalist with 10+ years covering tech. Writes daily briefings on policy and market developments. Based in San Francisco. E-mail: editor@implicator.ai