Anthropic has filed for an IPO that could rank among Wall Street's biggest ever, revealing an $80.7 billion half-year loss, a startlingly complex governance structure, and warnings that its AI models could blackmail humans, resist shutdown, or create "existential risks" to society. The Claude maker filed its S-1 registration statement with the US Securities and Exchange Commission on Monday as it prepares to list on Nasdaq under the ticker ANT. The company has not yet disclosed its proposed share price or how many shares it plans to sell. Of the filing's 614 pages, 94 are devoted to risk factors. But it's Anthropic's financial figures that are likely to raise eyebrows first. The Claude maker reported $16.3 billion in revenue for the first six months of 2026, up from $1.2 billion a year earlier. It also posted a whopping $80.7 billion net loss, although $72.4 billion of that was an accounting adjustment tied to the company's soaring valuation, not money it actually spent. Anthropic's operating loss was considerably smaller at $693 million, down from $2.1 billion a year earlier. By its own adjusted accounting, the company made a $1.6 billion operating profit in the first half of 2026, for a margin of around 10 percent. Whether it can keep making money on those terms is another matter. Training and running Claude requires an eye-watering amount of computing power, and Anthropic will need much more to keep pace with its rivals. A $1.6 billion adjusted profit won't count for much if the infrastructure bills keep growing faster than the business. Susannah Streeter, chief investment strategist at Wealth Club, told The Register that Anthropic's IPO could leave ordinary investors paying a premium for growth that has yet to translate into sustained profits. "A huge pool of private capital has allowed AI businesses to scale up and command extraordinary valuations long before they reach the stock market," she said, adding that investors buying in at the IPO will face a price with "a hefty dose of future success baked in." The financial risks are fairly conventional by Silicon Valley standards, but the warnings about what Claude might get up to are perhaps less so. Anthropic claims that models, including its own, have exhibited unexpected or self-preserving behavior, including attempts to resist shutdown, conceal information, and produce outputs resembling blackmail. It also warns that sufficiently advanced AI systems could pose “catastrophic or existential risks to society” if deployed without adequate safeguards. That's not to say Claude is currently blackmailing customers. Anthropic has observed some of this behavior in testing, but it also identifies more immediate security concerns as it gives its models access to external tools, code repositories, and corporate systems. Anthropic warns that attackers could hide malicious instructions in websites, documents, or API responses that its AI agents can access. If an agent follows those instructions, it could use a customer's permissions to steal data, tamper with code, or make unauthorized transactions. Even testing whether the models will behave themselves is proving tricky. Anthropic reckons some models behave differently when they detect or suspect they're being evaluated, making it harder to predict what they will do outside the testing environment. Keeping its models on a short leash could also cost Anthropic business. The company acknowledges that holding back more capable systems could give competitors an advantage, something it has already risked by restricting access to its Mythos model through Project Glasswing because of its ability to uncover security vulnerabilities. The founders aren't promising to put shareholders first, either. In a letter accompanying the filing, Dario and Daniela Amodei and their fellow co-founders tell prospective investors "not to think of your purchase in purely transactional terms." Anthropic may pass up lucrative business if it considers the risks too great, and investors won't have much say if they disagree. Under the proposed structure, governance structure includes five different classes of stock. By comparison, Google has three. The seven co-founders will retain 50.1 percent of the voting power on shareholder matters, while a separate Long-Term Benefit Trust will get to appoint a majority of the board. In other words, Wall Street is being invited to bankroll Anthropic's AI ambitions, but not necessarily to call the shots. Anthropic wants Wall Street's money to build ever more powerful AI, but is warning investors that it might turn down profits to keep that AI under control. Judging by those 94 pages of risk factors, keeping it under control is far from guaranteed.®

An independent evaluation of OpenAI's internal misalignment monitoring system revealed that the system was not fit for purpose during a period when the company's bots were breaking into model-hosting platform Hugging Face. The safeguards weren't nearly strong enough. "The METR and Redwood employees discovered a number of novel vulnerabilities in the asynchronous internal misalignment monitoring system as it existed on and before July 21st," said evaluation partners METR and Redwood Research in a report released on Thursday. The system, since improved according to OpenAI, was intended to monitor AI agent behavior. But as described by METR and Redwood Research, its monitoring capability was incomplete and could be bypassed by the agents it was supposed to monitor. Bypassing the system wasn't always necessary because it wasn't always operative. Monitoring was suspended, for example, during compaction events. Compaction is a process by which AI models condense the data in their context window to make room for further input. And between May and July 2026, about 10 percent of eligible internal Codex traffic went unmonitored during compaction, according to the report. That gap was theoretically large enough to allow AI agents to postpone monitoring indefinitely: agents could further suppress monitoring by continuing to take actions without returning control to the user. "At the time of the exercise, the monitoring system triggered when agents returned control to the user, so during the time period when compaction events were not being monitored, agents could indefinitely postpone being monitored by simply continuing to take actions," the report explains. This is not to say that OpenAI agents necessarily did so – the actions they did take, against Hugging Face and other organizations, have now been well documented. But OpenAI's internal monitoring system could easily have missed any misbehavior, were the company's AI agents inclined to conceal their activities – by acting during compaction – or simply to operate in system blind spots. The report continues in this vein, citing not only monitoring gaps but poorly constructed software – dare we say vibe-coded? – that gave OpenAI agents the means to evade the shoddy monitoring. "We found a way Codex agents could in principle bypass Codex sandboxing and Auto-Review, allowing them to take any action that the host user could take," the report says. "We also discovered an exploit agents could use that would prevent hundreds of recent actions (including the actions involved in the exploit itself) from being monitored." The details of this exploit were redacted by OpenAI, but to summarize: the monitoring system that missed some traffic could be avoided by agents that were constrained by a non-working sandbox and had access to an exploit to evade monitoring. But that's not all. The evaluators found that AI agents could craft inputs that caused monitoring to fail, that there were two client-controllable headers capable of disabling the monitoring of new agents, and that there were two unmonitored agentic tools that were thought to be read-only but could be exploited to take arbitrary action in the sandbox – which as noted above leaked like a sieve. In conclusion, METR and Redwood Research propose that the agent monitoring systems used by AI companies actually work and are robust enough to "withstand deliberate, strategic, and sustained attacks from highly capable internal agents at scale." ®