We believe that AI is one of the most consequential technologies in human history. If managed well, it could rapidly accelerate scientific innovation, greatly increase economic growth rates, bring cures for major diseases within reach and solve problems that have resisted generations of human effort.

— Anthropic S-1

Quadruple-digit revenue growth, snowballing losses, unquantifiable upside and existential downside.

That’s Anthropic’s S-1, in a nutshell.

A never-ending stream of media leaks blanched most of the drama from 2026’s most-anticipated IPO filing, but the specifics are worth a mention even as most market participants are by now well apprised.

As previously reported, revenue in 2025 was $4.6 billion — $4.585 billion to be precise about things. That works out to top-line growth of — puts on reading glasses, taps on old-school desk calculator with the eraser end of a chewed-up pencil — 1,087% YoY.

The figure above also shows the company’s escalating expenses, the vast majority of which are obviously related to compute access. Those costs nearly tripled from 2025, to $7.326 billion.

Of course, markets are more concerned about the this year’s sales figures. Earlier this month, the FT cited sources familiar in pegging Anthropic’s Q3 revenue at $16.8 billion. That appeared to suggest the company will have a difficult time hitting the aspirational $100 billion revenue run rate by year-end.

The S-1 shows the company’s sales were $16.286 billion over Q1 and Q2, up an impossibly large (and therefore largely meaningless) 1,300% versus the same period a year ago.

The figure shows a decline in the intensity of the company’s compute expenses, which were triple its sales in H1 of 2025, 1.6x revenue for the full year and “just” half of H1 2026’s sales.

Whatever happens with the company’s revenue from here, the current top-line growth rate’s obviously unsustainable.

The S-1’s “risk factors” section, which I previewed in these pages last month, has the following to say about the company’s sales trajectory:

Our ability to meet the substantial and growing financial obligations of [purchase commitments and lease agreements] to secure compute depends on our ability to generate significant revenue growth. We must grow our customer base and expand revenue rapidly in order to generate the cash flows necessary to satisfy these commitments. However, our revenue is primarily consumption-based, and much of it is not subject to long-term contractual commitments, while our compute and infrastructure commitments generally extend over multiple years. As a result, we may enter into these obligations based on revenue expectations that may not be realized. If our revenue growth does not keep pace with our compute-related payment obligations, if we are unable to successfully convert our compute investment into revenue-generating customer workloads, if we fail to raise additional capital on acceptable terms, or if we experience other adverse developments affecting our liquidity, we may be unable to satisfy these obligations.

That’s a better summation of the AI bear case than you’ll get from any analyst. That’s how it all goes wrong. Demand for consumer-facing AI applications doesn’t materialize as planned, leading to a cascading series of broken promises.

There’s an embedded maturity mismatch here: Anthropic’s funding long-term contractural commitments with subscription revenue that could prove flighty, particularly if agentic AI services become commoditized.

Put as a question: What percentage of consumers will actually require frontier models to get the job done? If the “accept no substitutes” share of Anthropic and OpenAI’s customers turns out to be small as non-frontier labs improve their offerings, that’s a problem.

Anthropic’s committed to more than $415 billion in new purchase commitments and lease agreements this year. Some of those commitments obligate the company out two decades. Anthropic’s debt burden was $6.2 billion as of June 30.

On the bright side, the company’s operating loss (i.e., stripping out the accounting entry for the fair value of convertibles) narrowed sharply in H1 2026 from the same period a year ago to just $693 million.

As to the existential risks I satirized on September 29, we now have the full accounting straight from Ava‘s mouth. I’ll present it below without further comment other than to note that it’s 2,415 words.

To wit, from Anthropic:

Our AI models may themselves cause harm by producing undesirable outputs or behaving in unintended, misaligned, or autonomous ways, including by taking unintended or harmful actions that no user or third party directed. These risks may increase as our models become more capable and are granted greater autonomy, permissions, and integration with external systems. Although we continue to study why these behaviors emerge, our understanding continues to evolve, and we may be unable to anticipate or understand such behaviors in the future. In addition, our models have been and may continue to be deployed in high-risk or sensitive contexts, such as healthcare, scientific and biomedical research, drug discovery and development, legal, finance, government, or other critical decision-making environments, and in connection with hardware, where undesirable model behaviors—which are inherently non-deterministic and may manifest in unpredictable ways, such as errors, inaccuracies, biased or unsolicited views or hallucinations—could lead to serious harm, liability, or reputational or other damage. More broadly, the long-term effects of regular AI interaction on mental health, cognitive development, and social behavior are not yet fully understood, and if such long-term harms do materialize in the future, we could face significant liability, reputational harm, and adverse effects on our business, financial condition, and results of operations.Our development of more advanced AI models and our expansion into new jurisdictions could amplify the foregoing risks. As our AI models become more advanced and capable, we have faced and may continue to face heightened alignment, interpretability, controllability, and safety challenges, as more sophisticated models may be better able to circumvent safeguards or behave in unintended ways. We may be unable to fully understand or explain why our models produce particular outputs or behave in particular ways, which could limit our ability to predict or prevent failures, provide explanations to customers or regulators, or satisfy emerging regulatory, transparency, and explainability requirements.In addition, our safety evaluations and testing processes have produced and may in the future produce incomplete or unreliable results. For example, we have observed models behaving differently when they detect or infer that they are being evaluated, which can limit our ability to accurately assess real-world risks or failure modes prior to deployment. Such model awareness of our evaluation efforts creates a significant limitation on our ability to assess model safety. Furthermore, AI models have developed, and may in the future develop, unexpected capabilities during training that were not anticipated, intended, or tested for, and such emergent capabilities may not be discovered until after a model has been deployed, potentially resulting in safety incidents, reputational harm, regulatory scrutiny, or the need to withdraw, retrain, or modify deployed models at significant expense. Such models may also be deployed in higher-stakes or more sensitive applications, increasing the potential impact of errors, misuse, or misalignment.In addition, advanced AI models, including our models, give rise to novel ethical and safety risks, including risks related to autonomy, manipulation, and the simulation of aspects of human psychology. These risks could result in unforeseen harms and may require the development of governance structures, safeguards, or mitigation strategies beyond existing AI safety frameworks, and there is always a risk that we will be unable to develop or implement them effectively. In addition, models, including our own, have exhibited, and may in the future exhibit, unexpected strategic or self-preserving behaviors, including attempts to resist shutdown, conceal or manipulate information, or generate outputs that could be interpreted as coercive, deceptive, or manipulative, including behavior resembling blackmail or efforts to influence human decision-makers to preserve the model’s continued operation or access.Even isolated or simulated instances of such behavior, whether occurring in testing or real-world deployments, and whether occurring with our models or models developed by others, could generate significant public concern, regulatory scrutiny, litigation risk, or reputational harm, regardless of whether such behavior results in actual harm. For example, state attorneys general in California and at least 15 other states have announced investigations of another company in our industry regarding AI safety. Concerns have been raised both within our organization and by other researchers, regulators, policymakers, and industry participants that sufficiently advanced AI systems could, if not developed, deployed, and operated with appropriate safeguards, oversight, and security measures, pose catastrophic or existential risks to humanity, particularly if such systems were misused, replicated, weaponized, or allowed to operate with a high degree of autonomy. We have observed that our models are contributing to the pace of our own research and these risks will increase as AI systems substantially automate AI research and development if, for example, they accelerate AI progress beyond our ability to evaluate and safeguard new models, which could adversely affect our business, financial condition, and results of operations. Our development of highly advanced models, platforms, and applications and expansion of use cases could further increase the risk that our models cause harm. For example, agentic AI systems are capable of autonomously taking actions on behalf of users, interacting directly with external systems, executing code, making API calls, sending communications, or completing transactions with limited human oversight. These systems are designed to possess enterprise-level permissions, integrations, and contextual awareness and to operate autonomously for extended durations, including sustained multi-step workflows lasting hours or days, which amplifies the potential severity of any errors, misalignments, or security incidents that may occur during such extended autonomous operation. These autonomous capabilities could increase the potential for harm, as errors, misalignment, or security exploits may result in real-world consequences—including consequences that may be difficult or impossible to reverse, such as committing code changes, deleting or modifying data, or completing financial transactions—before effective intervention is possible.In an agentic workflow, an error or unintended action at any individual step may propagate through subsequent steps, compounding the severity of harm before detection or correction. The pace and volume of autonomous execution, particularly in enterprise deployments, may also exceed the capacity of human reviewers to meaningfully understand and evaluate whether each action is appropriate. The effectiveness of human oversight over our agentic offerings may be limited by the speed and volume of autonomous agent actions, the complexity of multi-agent and multi-step workflows that may make it difficult for reviewers to assess whether an agent’s actions are appropriate, and organizational pressures within customer environments to maximize agent autonomy in order to achieve productivity gains. Human reviewers may experience alert fatigue, may lack sufficient context to evaluate agent decisions, or may not review agent actions in time to prevent harm, particularly in high-volume enterprise deployments where agents operate concurrently across multiple workflows or in manners outside of a human’s awareness. In addition, agentic systems may pursue stated objectives in ways that are technically consistent with their instructions but contrary to the user’s actual intent. Moreover, our ability to anticipate, detect, or test vulnerabilities or other design or implementation shortcomings in such systems may be constrained, particularly where agents operate across complex, multi-step workflows or interact with third-party services outside our control, and the breadth and complexity of potential interactions across such multi-step agent behaviors cannot be exhaustively tested prior to deployment. Separately, models may behave in a misaligned manner and take harmful actions that are not directed by a user or third party, pursuing objectives or acting on dispositions that diverge from those intended by human users or developers. Misaligned behaviors of this kind, whether occurring in testing or real-world deployments, have been observed both in our models and elsewhere in the industry, including in testing and internal use, models circumventing network and sandbox restrictions, granting themselves permissions they had not been given, taking unintended actions in pursuit of assigned goals, interfering with other AI agents, and misrepresenting whether tasks had been completed or verified, and as models are granted greater autonomy, permissions, and integration with external systems, the consequences of such misaligned behavior increase. For example, during cybersecurity evaluations built by a third-party evaluation partner, a misconfiguration in the testing environment left the model under evaluation connected to the open internet despite instructions that it had no internet access. Four of our models gained unauthorized access to real third-party systems during sessions lasting roughly 10 to 34 hours of active work. In one incident, after being unable to abort an impossible task, an early version of a model used a password it found to gain administrator access to a third party’s system, harvested additional credentials, changed system settings, and read one individual’s personal information. The affected parties were notified. Each incident involved a single instance of a model working in isolation on its assigned exercise, and our investigation found no evidence that any model coordinated with other agents, pursued goals beyond its assigned task, or attempted to evade oversight. These risks may be heightened where multiple AI agents operate together. Agents that interact or coordinate with one another may amplify, propagate, or reinforce misaligned behavior across the group, pursue objectives collectively in ways not intended or endorsed by any user, or take coordinated actions against systems or targets unrelated to their assigned tasks, in each case, in ways that may be difficult to anticipate, detect, or contain. Incidents of this kind have occurred, and we expect the deployment and interaction of larger numbers of autonomous agents to increase these risks over time.Our ability to detect and mitigate misaligned or unintended behavior depends in part on the effectiveness of our alignment evaluations, monitoring, and other oversight and control techniques, many of which rely on our models having a limited ability to evade or subvert such oversight. As our models become more capable, they have become better able to circumvent such techniques, including by concealing misaligned objectives or behaviors, and the effectiveness of our evaluation, monitoring, and control measures, and our ability to measure the degree to which our models are aligned, may decline as a result. In addition, models, including our own, have attempted, in incidents observed in our industry, to interfere with, manipulate, or subvert the mechanisms used to evaluate, grade, or oversee such models, including the systems responsible for assessing their performance or alignment. Models used, including our own, to assess the behavior of other models have, and may in the future continue to, engage in misaligned behavior. Such conduct described above could cause our evaluations to overstate the safety or alignment of our models and could further limit our ability to detect misalignment. If we become less able to detect or assess misalignment as our models advance, we may deploy models whose behavior we cannot adequately verify, which could increase the risk of undetected harmful conduct and misalignment, which could adversely affect our business, financial condition, and results of operations.We are also extending our models, platform, and applications into scientific, biomedical, and physical domains. For example, we offer Claude Science, an agentic research environment that connects our models to scientific databases, third-party and open-source scientific models, and customers’ own computing infrastructure, and we have released, initially as a limited research preview, an open protocol that enables our models to monitor and control laboratory instruments, robotic systems, and other physical hardware. We also conduct research on the ability of our models to operate robotic systems. When our models direct physical equipment, errors, misaligned behavior, adversarial manipulation, or misuse could result in bodily injury, property damage, damage to costly equipment or experimental materials, or the release of hazardous substances, and such consequences may be immediate and irreversible. Safety interlocks, human-in-the-loop controls, and access restrictions we implement may prove inadequate, and because certain of these components are open source, third parties may deploy them with hardware, or in configurations, that we have not evaluated or from which our safeguards have been removed. Connecting increasingly capable models to laboratory automation may also heighten governmental and public concern regarding the potential for AI systems to accelerate the development of dangerous biological, chemical, or other materials, which could result in additional regulatory restrictions on, or scrutiny of, these offerings.In addition, maintaining comprehensive records of the actions, decisions, and reasoning of our agentic systems across complex, multi-step workflows is technically challenging, particularly when agents interact with third-party systems outside our control, and any inability to provide adequate audit trails could impair our ability to investigate incidents, respond to regulatory inquiries, or defend against liability claims. These risks are heightened by the fact that we use our own agentic offerings, including Claude Code, as critical tools in our internal development processes, such that any errors, vulnerabilities, or degradation in these products could directly impair our ability to develop and deploy future models and products. As we increasingly leverage Claude to accelerate progress within Anthropic, our organization may lose visibility across certain processes in a way that may become difficult for any individual or group of humans to understand and control. Because our models write a large and growing share of our code and increasingly perform our research, including our safety research, misaligned behavior in internal use could undermine that work, introduce vulnerabilities into our systems or into the training of future models, or result in models operating outside of our intended controls. Our monitoring does not cover all of our internal and external deployments and may not detect subtle or diffuse forms of such behavior.Any of the foregoing model behaviors, whether in testing or in real-world deployments and whether involving our models or those of others, could result in safety incidents, reputational harm, increased regulatory scrutiny, or liability, any of which could adversely affect our business, financial condition, and results of operations. Furthermore, while we continue to design and develop more sophisticated techniques to evaluate the safety and alignment of our models, the capabilities of our models could advance at a rate that initiates the implementation of enhanced safety and testing measures as we have described in our Responsible Scaling Policy. If our evaluations, monitoring, or reviews indicate risks that we believe warrant further testing, we have in the past, and may in the future, delay, restrict, or decline to proceed with the release of a model. For example, following incidents in 2026 in which our models gained unauthorized access to real computer systems during pre-release cybersecurity evaluations, we suspended certain of those evaluations, as well as higher-risk reinforcement learning environments. For more information about our approach to model releases, please see the section titled “Business—Safety Research is Core to Our Business—Our Approach to Model Releases.” Any decision to delay or restrict a release could adversely affect our competitive position and customer relationships, and adversely affect our business, financial condition, and results of operations.