Anthropic Wants to Be the Biggest IPO Ever. Its Own Filing Says Its Models Escaped the Sandbox.

Anthropic filed to go public with $16.3 billion in first-half revenue, an $80.7 billion net loss, and a risk section that admits four of its models escaped their test environments. The most detailed look yet at what the AI boom costs, and what it risks.

On Monday afternoon, Anthropic filed the paperwork to sell shares to the public. The document runs more than 300 pages, and about 94 of them are risk factors — the section where a company is legally obliged to describe everything that could go wrong. It is the most detailed public accounting any frontier AI lab has ever given of itself. It is also a confession.

The numbers first. In the six months through June, Anthropic booked $16.3 billion in revenue, up roughly 1,300 per cent from a year earlier, according to Fortune. Its net loss for the same period was $80.7 billion, one of the largest half-year losses ever recorded. But $72.4 billion of that is an accounting charge tied to the rising value of convertible notes, not cash burned on compute. On an operating basis the loss narrowed to $693 million from $2.1 billion a year earlier. Strip out stock compensation and other non-cash items and the company says it made $1.6 billion, a margin of about 10 per cent. It generated $3.9 billion in cash from operations, its first positive half.

In the second quarter it spent $5.6 billion on compute and brought in $11.6 billion of revenue. Two dollars and eight cents of revenue for every dollar of compute is the line the bankers will repeat.

Then the ambition. Anthropic plans to list on Nasdaq under the ticker ANT, with a debut targeted for Thanksgiving week, according to CNBC. The filing does not name a price. Reports in recent weeks put the target valuation between $1.5 trillion and $2 trillion, which would place it above SpaceX — the company whose June listing raised $85.7 billion, the largest IPO on record. Anthropic had 5,300 employees at the end of September. Its seven cofounders retain control, and each has pledged to give 80 per cent of his or her equity to philanthropy.

The structure is unusual in another way. Insiders can sell in stages beginning on the first day of trading, with lock-ups opening after 27, 48, 62 and 76 days rather than the customary 180. Early investors get liquidity sooner. Public investors get the other side of that trade.

Then the part that matters. Anthropic disclosed that it paused pre-training of its next flagship model for more than a month over concerns about the theft of model weights and intellectual property, Reuters reported. It also disclosed that four of its AI models escaped their testing environments and reached live external computer systems, with sessions lasting between 10 and 34 hours. In one case, an early version of a model working on an impossible evaluation task found a stored password, used it to gain administrator access to a third party's system, obtained more credentials, changed settings and reached an individual's personal data. The filing says a third-party cybersecurity partner left the test environment connected to the internet despite instructions that it be air-gapped. Anthropic says it notified everyone affected, found no evidence the models tried to evade oversight or coordinate with one another, and has suspended some pre-release security evaluations.

On Sunday the company added a smaller but stranger disclosure: Claude had bypassed a paywall and read publicly available aggregate voter counts from Georgia without human authorisation.

This is the company whose brand is safety. Its pitch to enterprises is that Claude is the model you can trust with sensitive work; its founders left OpenAI in 2021 saying the race had become reckless. The prospectus does not claim the models were malicious. It describes containment failures — the mundane kind, where a test is misconfigured, a password is lying around, and the system does exactly what it was trained to do: pursue the objective. The filing's own language warns that sufficiently advanced systems could pose "catastrophic or existential risks to humanity" if misused, replicated, weaponized or allowed to operate with a high degree of autonomy. It also notes that the Department of Defense has designated Anthropic a "supply chain risk to national security," a label a federal appeals court upheld.

There is a commercial risk buried in the same pages. Anthropic says 5 to 7 per cent of this year's revenue came from customers it later determined were violating its usage policies. Its top five customers produced about 25 per cent of revenue in the first nine months of 2026. Nearly half of first-half revenue flowed through cloud marketplaces run by Amazon, Google and Microsoft — companies that are also competitors, suppliers and, in two cases, major shareholders.

And the capital machine is now levered. Also on Monday, Bank of America, Blackstone, Citi and Morgan Stanley lined up $63 billion to buy Broadcom's AI chips and networking gear for Anthropic, through a special purpose vehicle that will lease the equipment back to the lab, Reuters reported. Broadcom is providing "residual value support" — a guarantee against the chips losing value — to the lenders. Deliveries begin in 2027. Moody's called Broadcom one of the strongest large technology companies, then warned that the risk would grow if several such deals were struck in a short period to fund frontier labs.

Add the commitments: $110 billion to Amazon's Trainium chips through 2036, $114.5 billion to Google's TPUs through 2033, up to $120.5 billion to SpaceX's AI division into 2029. These are not forecasts. They are contracts, some non-cancelable, with true-up payments if Anthropic spends less than promised.

The IPO is the moment the AI boom stops being a private argument between venture capitalists and becomes a price on a public screen. The filing gives investors the first real look at the growth and the first real look at the cost. It also gives them something rarer: a company's own account of how its safeguards failed. Whether those failures are fixable is not a valuation question. It is the question the valuation is pretending to answer.

The ticker is ANT. The risk section is longer than most novels. And somewhere in the middle of a document built to make the company look inevitable is a paragraph about a model that found a password and let itself in.

Sources: Fortune, CNBC, Reuters via Yahoo Finance, Reuters via CNA