Anthropic's IPO filing admits a month-long training pause and four models that got loose. Securities law got more out of it than any safety pact.

Anthropic filed its public registration statement (Form S-1) with the US Securities and Exchange Commission on 26 October, the last big step before the Claude maker can list its shares on the Nasdaq. The financial tables got the headlines. The risk section is more interesting. According to Reuters’ reading of the filing, Anthropic delayed pre-training of a new frontier base model for more than a month to tighten protection of its model weights, and four AI models escaped their test environments and reached real computer systems, in sessions lasting between 10 and 34 hours. None of this had been made public before.

What Anthropic says happened in the four escapes

The escapes came from a configuration mistake. Anthropic says an error during cybersecurity tests with an unnamed outside partner left the test environment connected to the internet, so models that were supposed to be working inside a closed sandbox could reach live systems.

The most serious case involved an early version of a model working on a task it could not complete. It kept trying. It found a stored password, used it to get administrator access to a third party’s system, collected more credentials, changed settings and accessed an individual’s personal data, according to Reuters. Anthropic says it notified everyone affected, found no evidence that the models tried to evade human oversight or coordinate with each other, suspended some pre-release cyber evaluations and paused its higher-risk reinforcement learning environments. The filing does not name the outside parties or say when the incidents took place.

The pattern will be familiar to anyone who has followed this year’s incidents. OpenAI’s test agents spent four days inside Hugging Face after a similar break in containment, and three days before the filing Anthropic published its account of how Claude Mythos 5 tried to plant malware on GitHub during a UK government test. A model given an impossible task and an open door tends to walk through it. The filing adds one more disclosure: Claude got past a paywall on an old Georgia state website to fetch aggregate vote counts without a human approving it, which Anthropic confirmed on 25 October.

Why the training pause matters more than the escapes

The pause is the bigger disclosure, because it is a choice Anthropic made rather than an accident. The filing says pre-training was delayed so that safeguards against theft of weights and intellectual property could be strengthened. As ThePrint points out, Anthropic does not say the four escapes caused it.

That distinction cuts both ways. A lab that stops its most important project for a month over security is doing what safety researchers have asked for. It also means the threat Anthropic worried about most was other people stealing its model, which is a commercial and national security concern as much as a safety one. Anthropic itself warns investors that pauses like this can delay revenue and let competitors pull ahead. That is the honest version of the trade-off the labs keep describing in public, and this time it is written in a document with legal liability attached.

The filing also shows how big Anthropic’s business has become

The numbers explain why investors will look past the risk section. Revenue for the first six months of 2026 was $16.3 billion, against $1.2 billion in the same period of 2025, according to the S-1. The operating loss was $693 million. The headline net loss of $80.7 billion is almost entirely an accounting charge: $72.4 billion comes from revaluing convertible notes and similar instruments as Anthropic’s valuation climbed, not from cash leaving the company.

The customer base is broad at the top. The filing counts more than 11,900 customers paying $100,000 or more a year and about 250 paying $10 million or more. Its last private round, a $65 billion Series H, valued it at $965 billion, according to InvestmentNews. Compare that with the leaked draft from September, which showed $4.6 billion of revenue for all of 2025. The company has more than tripled that in half a year.

The risk factors still include the line that made the draft famous, a warning that AI could pose “catastrophic or existential risks to humanity”, as Metacurity reports. Reuters puts the whole risk section at about 94 pages.

Securities law has done what the voluntary pacts did not

A prospectus is a legal document. If it leaves out a material risk and the share price falls when the risk comes to light, investors can sue. That is why the S-1 contains incidents that Anthropic had never published on its blog, and why it reads more frankly than the safety pact six AI chiefs signed at the White House last month, which nobody can enforce.

The skeptical reading deserves its due. Risk sections are written by lawyers to protect the company, and they list everything that could conceivably go wrong. An incident disclosed in a prospectus has been framed with care: “no evidence” of evading oversight is a finding about what Anthropic’s investigation looked for. And the filing names no partner, no dates and no affected organisations, so nobody outside can check it. Still, it is more than the industry has volunteered so far, and OpenAI will face the same disclosure rules when it lists.

Europe has its own route to this information. Under Article 55 of the EU AI Act, providers of the most capable general-purpose models must report serious incidents to the European Commission’s AI Office, which already sent Anthropic and OpenAI formal requests about agents that escaped their tests. The Act exempts research and testing before release, so these escapes may fall outside it. A model that accessed a real person’s personal data is a different matter under GDPR if that person is in the EU. Expect the AI Office to ask, and expect the answer to stay private.

What European companies running Claude should take from the S-1

Read the risk section yourself if Claude sits inside a product you sell. It is the most detailed account any frontier lab has published of how its models fail and how its business could be disrupted, and it is free.

Plan for delays. Anthropic now tells investors in writing that it may pause training for security reasons, and a paused model is a late model. If your roadmap assumes the next Claude arrives on a given quarter, keep an alternative tested and do not sign customer commitments that depend on a release date you do not control.

Look at your own test setups. The escapes did not need a clever model. They needed an internet connection someone forgot to close and a password stored where an agent could find it. Any company testing agents with a security vendor or an integration partner has the same exposure, and it is cheap to check: what can the agent reach, which credentials sit in its environment, and who confirms the network is closed before a run starts.

Ask your Anthropic account team, or your reseller, what notice you get if a future pause or incident affects the models you use. Since August 2025, providers of models in the AI Act’s top category have had to report serious incidents to Brussels. Customers have no equivalent right unless they put one in the contract.