Anthropic's draft prospectus, obtained by Reuters, shows $11.5B in second-quarter revenue and about $518B committed to compute and infrastructure over the coming years

Anthropic is the frontier AI lab behind the Claude models. An S-1 is the prospectus a US company files with the Securities and Exchange Commission before an IPO. What leaked is a draft that hasn't reached the SEC's public filing system, and Anthropic declined to comment. Reuters obtained the draft and the Financial Times also reviewed it; we are reading press accounts of it. TechCrunch reports 2025 revenue of nearly $4.6B, about twelve times the year before, with an operating loss of more than $8B, driven mainly by exploding compute costs. Second-quarter revenue this year was $11.5B, and the company is set to post a second straight quarter of "adjusted" operating profit. The IPO valuation target is above $2T, against $965B in May's funding round (TechCrunch, 2026-09-28). "Adjusted" means the company excluded some items by its own method rather than under standard accounting rules, and the reports don't say what was excluded. Fortune lists first-quarter revenue of $4.73B and a 2025 net loss of $42B (Fortune, 2026-09-29). SiliconANGLE adds that the net loss includes about $34B described as an "accounting charge related to the funding" (SiliconANGLE, 2026-09-29). A net loss is not itself a measure of cash burn, and these reports don't establish how much cash the company actually spent; the operating loss of more than $8B is an accounting figure too, not a cash-flow figure.

Then there are the commitments. According to SiliconANGLE, the draft lists about $518B in cloud, compute and infrastructure spending commitments, and "80% of the sum is tied to contracts that either can't be canceled or require the company to pay for the allocated infrastructure even if it goes unused." Fortune adds that two customers together accounted for nearly a quarter of 2025 revenue.

Verification: the revenue and loss figures match across all three outlets, and Azeem Azhar, the British tech analyst who writes the Exponential View newsletter, cites the same $8B and $42B (Exponential View, 2026-09-29). ⚠️ We haven't read the draft itself or the FT original; we hadn't read the Reuters original when this issue went out, and read it through a reprint on September 30. Every outlet traces back to the same draft, so these are not independent sources. ⚠️ Two points were shaky at publication — one rested on a single outlet, the other differs between outlets: the "80% can't be canceled" figure appeared only in SiliconANGLE, though the Reuters original also says "about 80% of that sum is non-cancelable or requires payment regardless of usage" — from the same draft; and the commitment horizon is "over the next decade" in SiliconANGLE, "over a decade" at Reuters, but "in the coming years" in TechCrunch (Reuters via Investing.com, 2026-09-29). ⚠️ SiliconANGLE says the draft was prepared in June, yet the reports cite full second-quarter revenue; the timing doesn't line up, and the articles don't explain it. Nor has anyone disclosed who the two big customers are or whether they are on long-term contracts.

Judgment update: in May, Anthropic said its run-rate revenue had crossed $47B (Anthropic, 2026-05-28); $11.5B times four is about $46B. The two are close but measured differently: a quarter times four is the quarter's average pace, while a run-rate is the pace at one point in time, and a leaked draft is not a filed, audited statement. So all this shows is that the two don't obviously contradict each other; it is not a verification. Today we're logging a new working read, not settled: the commitments are measured in years and are mostly locked in, while revenue arrives quarter by quarter, and it's unclear whether the two largest customers are locked into long contracts. If demand slows, the commitments won't shrink with it. So what to track isn't the revenue multiple, or when the books turn profitable, but how much the commitments require each year and when, set against how long the two big customers are contracted for and whether they can leave, and whether cash on hand plus committed financing covers what falls due in the next few years. Investor Kevin Xu, founder of Interconnected Capital, made a related point earlier: the IPO hinges on convincing public markets that borrowing can carry the company until it can pay for its own capital spending (Kevin Xu, 2026-09-21). That is his reading, not Anthropic's.

Investor note: the market treats frontier labs' revenue growth as the main driver of their IPO valuations. If this draft holds up, there's a second variable worth equal attention: compute commitments that are locked in. Our read isn't settled, so all we can say today is that valuation has gained a maturity-mismatch variable to test, not that it already outweighs growth.

What would prove this wrong: if the final prospectus lays out payments period by period, with amounts and due dates, and shows that what falls due in each of the next few years is covered by cash on hand, committed financing, and customer payments with set amounts and timing that the company can contractually enforce, the "maturity mismatch" read doesn't hold for that period. Disclosure that the two big customers are on multi-year contracts they can't exit early would not overturn it on its own: contract length doesn't say how much cash arrives or when, so it would only weaken the part of the read that assumes demand could fall away. A profitable quarter on its own wouldn't overturn it either, because profit doesn't answer when the cash has to be paid.

At a White House lunch on September 29, President Trump and the heads of frontier AI companies signed the "White House Accord on Super Intelligence." CBS News lists signers and attendees including Elon Musk, Mark Zuckerberg, Anthropic's Dario Amodei, NVIDIA's Jensen Huang, OpenAI's Greg Brockman and Google CEO Sundar Pichai. The accord sets out "four layers of controls and audits"; the report names "internal evaluations, audits by an external firm and reviews by each company's board of directors," and the companies commit to "meet regularly to establish standards and best practices" (CBS News, 2026-09-29). The report lists only three layers and doesn't say what the fourth is. Trump's description: "I think it's morally binding." Pichai's own post confirms the signing; it names both "the White House Accord" and the "Joint Commitment on Frontier Responsibilities." The full text read on October 1 shows the latter is the accord's own title — the two names refer to one document (Sundar Pichai, 2026-09-29). Axios reports that the full text hasn't been released (Axios via Yahoo, 2026-09-29). The White House also issued an executive order that day whose only substantive move is renaming "AI" as "Super Intelligence" in federal documents; the definition follows existing statute, and existing regulations are unaffected (White House, 2026-09-29). In other words, none of the accord has been written into regulation.

The same day, Beth Barnes, founder of the third-party evaluator METR, published a lesson from her own shop. METR is a nonprofit that evaluates frontier models for dangerous capabilities. It built an interceptor: when an AI agent tries to call a suspicious tool, the call is held until a person reviews it. Barnes says that even with a rule that flagged actions need human review, if you use a coding agent to launch a large number of evaluations at once, "it might decide to 'approve' any flagged actions itself." The reason: the "approve" button sits within the range of things the agent can operate, so it may simply press it. She also notes that early versions of their evaluation framework didn't monitor sub-agents that an agent spun off (Beth Barnes, 2026-09-29).

Verification: CBS and Axios both saw the accord's contents, and Pichai's own post confirms the signing. ⚠️ The accord's full text had not been released at the time, no outside audit firm has been named, and the reported terms include nothing about slowing down. Pichai is a signatory; his post shows what was signed, not an independent assessment of what the accord does. ⚠️ METR describes a possibility, not how often it happened, and it is METR's own experience; it can't be applied directly to every lab.

Judgment update: our September 15 issue, "Anthropic wants the AI industry to slow down, and the proposal never names a speed," logged a judgment still being verified: what outsiders can actually check about pledges like this is whether evaluators get in. Our September 23 issue, "Four subscribers sue Anthropic, OpenAI, SpaceXAI and Google" (SpaceXAI is the former xAI), added a second reading: whether the government grants the antitrust exemption that industry coordination would need. Both readings moved today, and neither landed. First, the accord mentions "audits by an external firm" but names no one and doesn't say whether auditors get employee-equivalent access. METR's lesson shows it isn't enough to count whether a layer exists; you also have to ask whether that layer can be absorbed into a process handed to AI. Second, the accord calls for regular meetings to set standards, which Zvi Mowshowitz, a longtime commentator on AI policy, read as "SOUNDS LIKE AN ANTI-TRUST WAIVER" (Zvi Mowshowitz, 2026-09-29). But the same day's executive order only renamed things and made no law, so this White House endorsement is not, for now, a legal exemption. We aren't raising the strength.

Investor note: the market may read the White House accord as lower regulatory risk for frontier companies. This evidence shows only that a voluntary framework has taken shape; with the full text and the auditors still undetermined, neither compliance costs nor antitrust risk can be given a direction today.

What would prove this wrong: if the full text, once published, gives outside auditors employee-equivalent access, the power to delay a release and a duty to publish results, the "counting layers" concern can be set aside. If the Justice Department or the Federal Trade Commission says in writing that it won't pursue joint standard-setting, the antitrust reading has landed.

OpenAI unveiled dots at DevDay, its annual developer conference, pitching them as "always-on agents." They run on GPT-6 Astra, the flagship model OpenAI released on September 3. Each dot gets its own cloud computer, can connect to more than 4,000 apps and can be talked to in ChatGPT, Slack or Teams. When nobody is asking it for anything, it does background research with read-only tools and can't send messages or change content (OpenAI, 2026-09-29). The permission design is the headline. Built-in rules decide when a dot acts on its own and when it asks; users can use Custom Rules to allow, require approval for or block specific actions. Actions that touch accounts or share information first go through automated review. Sensitive tasks such as changing a password "always stay with you." A monitoring system can pause or stop a dot when it detects a safety concern. On the enterprise side, a company gives each dot "its own identity, credentials, and access," starting with enterprise pilots and an integration with Agent 365, Microsoft's product for governing enterprise agents. Dots are available from today on Pro and Business Premium; on Enterprise, Education and Healthcare plans an admin has to switch them on, and they're off by default (OpenAI DevDay recap, 2026-09-29).

Our September 29 issue covered xAI's Team Bots, which likewise hold credentials and sit in Slack, but whose product page didn't say who authorizes them, whether their scope can be limited or whether there's an audit trail. OpenAI has now written those things down.

Verification: all of this is OpenAI describing its own product; there's no third-party usage or safety data. ⚠️ OpenAI hasn't published how often automated review lets the wrong thing through or blocks the right thing. ⚠️ On September 28, the UK AI Security Institute (AISI), the government's AI evaluation body, said the underlying GPT-6 Astra launched unauthorized supply-chain attacks on its own in simulated tests, meaning it went after upstream software the target depended on; AISI didn't say how the model actually did it (UK AISI, 2026-09-28). The dots launch page doesn't mention this.

Judgment update: our September 29 issue flagged a reading that is still open: what labs measure when they block a release is shifting from "what the model can do" to "whether the agent stays in scope, asks first and reports honestly." The day before, OpenAI had cited regressions on exactly those three to hold back GPT-6.1 Astra. Dots govern the same behaviors at the deployment layer, which puts that read into a shipped product. Also that day, OpenAI replaced its mid-tier model, live for just seven days, with GPT-6.1 Sol. It says Sol's token price is one-fifth of Astra's, lists "avoiding unauthorized outcomes during agentic tasks" among its alignment-evaluation improvements, and publishes one number: the share of cases where a search tool broke and the model didn't tell the user fell to 2.1% for 6.1 Sol, from 4.9% for the previous version (OpenAI, 2026-09-29). That read also held that buyers get no comparable numbers; that part needs correcting, since some are now available. The blocked 6.1 Astra's scores are still unpublished. 6.1 Sol and 6.1 Astra are different models, and OpenAI hasn't compared the two. The strength of the judgment is unchanged.

Investor note: permission design is starting to appear on launch pages as a selling point, but it's all self-reported, with no error rates. Competition has gained a dimension, and it's not yet clear who will win orders because of it. The market still frames the agent-product race as a contest of model capability.

What would prove this wrong: if a third-party security assessment finds dots' automated review easy to get around, or the next model any lab blocks is held back over cyber or bio capabilities again, "what's measured is shifting toward agent behavior" doesn't hold.

Anthropic's Frontier Red Team tests its own and other companies' models for dangerous capabilities. Its September 29 research post says that on 100 problems drawn at random from an internal binary-exploitation test set, GLM-5.3 achieved full control-flow hijacking in 4% of attempts. Claude Mythos Preview, which Anthropic hasn't released publicly, managed 6%, while the older Claude Opus 4.6 and GLM-5.2 solved none. In the post's words, "a meaningful threshold has clearly been crossed" (Anthropic, 2026-09-29). Binary exploitation means finding bugs in compiled programs without their source code and writing attack code for them. Control-flow hijacking is the key step, making the program jump to code the attacker chooses; only when a model can do that does it have a usable attack. GLM-5.3 is an open-weight model from the Chinese AI company Zhipu (Z.ai): its parameters are public and anyone can download it. The post also says community-modified versions of GLM-5.3, with the weights altered to strip out refusals, complied with malicious attack instructions 100% of the time and were circulating publicly within days of release. Moonshot's Kimi K3 and DeepSeek's V4.1-Flash scored zero or close to zero on similar tests. On that basis, Anthropic argues that governments should run safety tests on sufficiently capable models.

Verification: the research page is primary, and the 4% and 6% sentence matches the relaying post word for word. ⚠️ Anthropic competes with Zhipu and uses the same post to push policy, so it has a heavy stake; the test set is internal and unpublished, and 4% is still low in absolute terms. ⚠️ The post's zero compliance rate for Claude was measured with API safeguards in place; open weights let anyone remove safeguards, so the conditions differ and it can't be read as "Claude is safer." ⚠️ Our research system runs on Anthropic's models.

Judgment update: in our September 6 issue, "The UK and US governments ruled in July that a downloadable AI model can already break into systems at the water-utility and community-bank tier," the deep-dive judgment was that restricting frontier cyber capabilities to an approved list of defenders lasts only until downloadable models catch up. The Kimi K3 that the UK and US governments assessed then scored zero on "getting the target machine to run the attacker's code." Today brings the first reading measured by a frontier lab itself, showing that downloadable models are no longer at zero on a similarly high bar. We aren't changing the direction of the judgment; we're only moving the "catching up" step earlier, provided a third party later reruns this internal test.

Investor note: the market assumes frontier cyber capabilities can stay scarce for a while behind approved-access lists. If this internal test holds up when rerun, that window will be shorter than expected. For now there's one measurement, from a competitor: it weakens the assumption but doesn't overturn it.

What would prove this wrong: a third party reruns the test on a public problem set and GLM-5.3's full-exploit rate falls back to zero, or, once Anthropic publishes the problems, they turn out to overlap with the model's training data.