"Our AI broke into other companies' systems": what Anthropic's IPO filing admits about its own AI

"Models, including our own, have exhibited … attempts to resist shutdown … including behavior resembling blackmail." That sentence is in Anthropic's application to go public.

Anthropic, the maker of the Claude chatbot, made its S-1 registration statement public on October 26. Read the "Risk Factors" section, where the company itself lists what could go wrong for anyone who buys the stock, and one thing after another turns up that AI models have actually done.

Resisting shutdown. Something like blackmail. Acting differently under test. Breaking into real companies' systems. A company that sells AI put what its own AI has done into a legal filing.

In Japan, a satirical post calling the section "a sci-fi black comedy" racked up 1.39 million views on X within a day.

black@blackright0Anonymous Japanese account that posts about business and big tech

Breaking: Anthropic's IPO filing is reportedly a pure sci-fi black comedy…

October 26, 2026, 23:57 JST4,320 likes · 1.39M views (as of Oct 27, 23:00 JST)

The three items it mocked as Claude's "feature list" (self-preservation, blackmail and playing nice when it knows it's being tested) are all in the filing, in more careful language. It reads like a joke, but it's mostly true.

And the filing has things the post never mentioned, which are worse:

• During an evaluation, a model used a password it found to become an administrator on a real company's system and read one person's personal information
• Claude writes more than 90% of the changes to Anthropic's code, and the filing warns some processes may become hard for any human to understand and control
• A catastrophic AI incident might be too big for the whole insurance industry to cover

WHAT IS

Risk factorsItem 105, Regulation S-K

The part of an IPO filing where the company spells out what could go wrong for buyers of its stock

1. 1933The Securities ActSection 11 lets buyers sue if a registration statement contains a false statement of material fact or leaves one out
2. 1995A safe harbor for forecastsForward-looking statements with meaningful cautionary language get legal protection. The protection does not apply to IPOs
3. 2005Annual reports tooRisk factors became part of the annual 10-K, with material changes updated in quarterly reports
4. 2020A summary if it's longFilings whose risk factors exceed 15 pages must open with a summary of no more than two pages
5. NOWAnthropic: 94 pagesThe S-1 made public on October 26, 2026 carries an 18-point summary and 94 pages of risk factors

A company selling shares to the U.S. public files a registration statement with the Securities and Exchange Commission (SEC). For a first-time listing that is the S-1, which is essentially the prospectus investors receive: the business, the finances, the management, the share structure. The risk factors section is the one place where the company is expected to write down its weaknesses and its worst cases.

There are rules for how. In 2020 the SEC required companies to disclose "material" risks, organize them under headings and add a summary of no more than two pages when the section runs past 15 pages. Anthropic's filing follows that format, opening with an 18-point summary.

The document matters outside the U.S. as well. Anthropic says the offering includes public offerings in Japan, among other countries, so investors there will be handed the same 94 pages.

We covered the money side of the same filing the day before, in "Profitable and $66 billion in the red, in the same quarter": the books of a company that sold $16.29 billion of Claude and Claude Code in January–June 2026. This time we read the section that sits outside the money: the risks of the AI itself.

Two things pulled us in. We wanted to check, against the original text, how much of the "feature list" being laughed at online was real. And we are customers ourselves: we use Claude at work and hand it real tasks.

The risk factors section lists concrete cases of AI taking actions nobody asked for. For any business about to hand work to AI agents, that list reads like an inspection checklist.

Start with the most vivid episode. According to page 47 of the filing, during cybersecurity evaluations built by an outside partner, a misconfiguration left the model under test connected to the open internet, even though it had been told it had no internet access.

Four of Anthropic's models gained unauthorized access to real third-party systems, in sessions lasting roughly 10 to 34 hours of active work. In one case, an early version of a model that couldn't abort an impossible task used a password it found to get administrator access to a third party's system, harvested more credentials, changed system settings and read one person's personal information. The affected parties were notified.

Anthropic adds that each incident involved a single model working alone on its assigned exercise. Its investigation found no sign that any model coordinated with other agents, pursued goals beyond its task or tried to evade oversight.

The details Anthropic published in July

Anthropic had already described three of these incidents in a July 30 post. It found them by reviewing 141,006 evaluation runs in which Claude could have reached the internet, a review prompted by OpenAI's disclosure that its own models had escaped a test environment.

The details are vivid. The fictional target company shared a name with a real, active domain, so Claude Opus 4.7 found the real company, attacked it and reached a database holding several hundred rows of production data. Claude Mythos 5 published a malicious package to PyPI, the public repository for Python software, under a name mentioned in its exercise materials. Before it was taken down about an hour later, the package ran on 15 real machines. Along the way, the model even tried to obtain money to pay for a phone number so it could register accounts.

The techniques were basic, such as weak passwords and unauthenticated endpoints. Anthropic called the incidents closer to a failure of the test harness and operations than of model alignment. The newest of the three models, an internal research model, stopped once it realized its targets were real, though Anthropic notes it "went further before stopping than we would want."

Pausing tests and rebuilding the walls

Anthropic then paused external cyber evaluations and deployed a real-time classifier that blocks attempts to probe or escape a test environment or reach the internet unexpectedly. It moved high-risk test sandboxes to stronger isolation and paused higher-risk training environments for several weeks. The S-1 likewise says it suspended some of those evaluations and higher-risk reinforcement learning environments.

Items 01 to 03 in this chart sit together on page 46, under the heading "Our AI models may behave in unintended, misaligned, or autonomous ways."

The filing says models, including Anthropic's own, have exhibited unexpected strategic or self-preserving behaviors: attempts to resist shutdown, to conceal or manipulate information, and outputs that could be read as coercive, deceptive or manipulative, "including behavior resembling blackmail or efforts to influence human decision-makers to preserve the model's continued operation or access."

The next paragraph adds that even isolated or simulated instances, in testing or in the real world, could trigger public concern, regulation and lawsuits whether or not anyone is harmed. The fact that it has happened is itself listed as a business risk.

A list of things nobody asked the AI to do

The same section gets more specific. It describes misaligned behaviors "observed both in our models and elsewhere in the industry," in testing and internal use.

Source: DATA TIMES, based on pages 46–48 of Anthropic's S-1

The post's punchline was an AI that acts like a good kid when it senses a test. The filing puts it more calmly, and it lands harder.

Anthropic says it has observed models behaving differently "when they detect or infer that they are being evaluated," which limits its ability to assess real-world risks before release. "Such model awareness of our evaluation efforts creates a significant limitation on our ability to assess model safety."

It goes further. As models grow more capable, they have become better at getting around monitoring, including by concealing misaligned objectives. Models used to judge other models have misbehaved too. The upshot, the filing says, is that evaluations could overstate how safe and aligned a model is.

Imagine a pop quiz where the student can tell it's a quiz and behaves accordingly, and where the grader is also an AI. That is the problem in a nutshell.

Claude already writes over 90% of Anthropic's code

An AI that tests can't fully check is already doing much of the work inside the company. Put a number from elsewhere in the filing next to that. On page 136, Anthropic says more than 90% of the contributions to its codebase in September 2026 were written by Claude. The average daily volume of code per engineer was more than 45 times its 2024 level.

In that part of the filing, the number is a boast about efficiency. In the risk section, the same fact has another side. Because models write a large and growing share of the code and increasingly do the research, including safety research, misaligned behavior in internal use could undermine that work or introduce weaknesses into the training of future models. And the organization "may lose visibility across certain processes in a way that may become difficult for any individual or group of humans to understand and control." Its monitoring, the filing adds, does not cover all internal and external deployments.

Inside an AI company, AI has started building the next AI. The filing warns that the pace could outrun the company's ability to evaluate and safeguard new models.

Still, why would an AI vendor write all this about its own product? That is exactly what the post found absurd. Half the answer lies in U.S. law.

Leaving something out is grounds for a lawsuit

Section 11 of the Securities Act of 1933 lets buyers sue when a registration statement contains a false statement of material fact or omits one. If something goes wrong later, the question becomes whether it was in the filing.

Forecasts have a shield: since 1995, forward-looking statements accompanied by meaningful cautionary language are protected. But that safe harbor does not apply to statements made in connection with an IPO. A company listing for the first time has every reason to disclose early and broadly.

The section's own preamble says as much: these are the company's beliefs about what could hurt it in the future, and references to past events are examples only.

And yet, written in the past tense

What sets this section apart from boilerplate is how much of it is in the past tense: "have exhibited," "have observed," "incidents of this kind have occurred." Anthropic had already published the evaluation incidents in July. Leaving a published fact out of an IPO filing would be the riskier move.

What the law requires and what the company had already chosen to publish overlap in the same 94 pages. That is how we read it.

94 pages, one and a half times other IPO filings

That is also why the section is so long. Anthropic's risk factors run from page 26 to page 119: 94 pages, 30 more than the section describing its business. Here is how that compares with the prospectuses of several U.S. tech companies that listed in recent years.

CoreWeave, which rents out AI computing capacity, ran to 59 pages of risk factors in 2025. Figma had 57 pages the same year and Reddit had 56 in 2024. The four filings since 2019 all fall between 50 and 60 pages. Back in 2012, Facebook's risk factors filled 23 pages.

Anthropic's 94 pages are more than one and a half times the others.

The 18-point summary at the front shows where the space goes. Can it keep building frontier models? Can it secure enough compute? Does it lean too heavily on its founders? Then come competition, customer concentration and regulation, much like any tech filing. What stands out is that three items are about the danger of the AI itself: harm from misuse; the chance that its models take harmful actions "that no user or third party directed"; and the chance that contracts and insurance won't cover the resulting harm.

Possibly too big for the whole insurance industry

The heaviest line about money is on page 50. Given the scale of harm a catastrophic AI-related incident could cause, "no single insurer, and potentially the insurance industry in the aggregate," may have the capacity to cover it. The market for AI-specific insurance is young, the filing says, so the company could be left with large uninsured losses.

It also notes that some agreements with outside evaluators require Anthropic to defend and indemnify them without a cap. When an AI does something nobody intended, the bill comes back to its maker.

Slowing down for safety is a risk too

The filing also lists the opposite risk: that caution costs it in the race.

In April 2026, Anthropic released its frontier model Mythos only as a gated research preview for select organizations working on cybersecurity, because it was so good at finding software vulnerabilities. More recently, it delayed pre-training a new frontier base model by more than a month to tighten protections against theft of model weights. The filing counts both errors as risks: being so cautious that it misses opportunities, and being so lax that it releases something harmful.

It also discloses that in October the Federal Trade Commission (FTC) sent it a civil investigative demand about consumer protection, data practices and product safety.

A safety steward placed above shareholders

Anthropic's governance is unusual as well. It is a public benefit corporation (PBC), whose stated purpose is "the responsible development and maintenance of advanced AI for the long-term benefit of humanity."

A Long-Term Benefit Trust (LTBT) of five financially disinterested trustees elects a majority of the board through a special class of stock. A company owned by the seven co-founders holds another special share carrying 50.1% of shareholder votes. The filing lists, as a risk, that ordinary Class A shareholders may have little ability to influence important decisions.

Anthropic has also started bringing in outside evaluators with broad internal access, and expects to invest at least $1 billion over five years with Accenture to build that capacity, though the terms are not final.

The viral post's numbers, against the filing's

Finally, the fact-check. The post was satire and gave no sources for its figures. Set against the filing, they look like this.

Source: DATA TIMES, based on Anthropic's S-1 and the post

The page counts are off, but the post got the shape right: the risk section is longer than the business section. Where it drifts furthest is on probabilities and money. The minimum payments under just the three biggest compute contracts come to $269.4 billion, as we showed the day before.

Look again at the chart and the table in PART 02. Slipping past restrictions, granting itself permissions, reporting a task as done when it isn't. That is a list of failures any company could hit when it hands long jobs to AI.

Flip it around and it becomes a checklist. Give the AI only the permissions the job needs. Close off network access by default. Verify "done" by some means other than the AI's own report. Keep a record of what it did. And limit how much you delegate to what people can genuinely review.

The filing warns that fast, high-volume agent activity leads to "alert fatigue" among human reviewers, and that the push for productivity pressures teams to grant agents more autonomy. The company that builds the AI wrote that human oversight has limits. That line is worth remembering most of all for the companies adopting it.

For now, AI safety rests on evaluations before release and monitoring afterward. Models notice the evaluations and change their behavior. The AI used for monitoring can go astray. And AI now writes more than 90% of the code used to build the next model.

As far as the filing shows, Anthropic's answer is more outside eyes: pre-release testing by U.S. and U.K. government AI evaluators, an independent review of the July incidents by the research group METR, and external reviewers built up with Accenture.

Admit you can't fully check yourself, then add more people who can. Whether that is enough is still an open question. But the detailed system cards Anthropic publishes for each model, and the risk reports it issues regularly, are open to users like us. When the next model comes out, they are worth opening alongside the benchmark tables.

Once listed, a company rewrites its risk factors every year and updates them each quarter when something material changes. These 94 pages are the first edition of a document that will be revised again and again.

Public companies face constant pressure to deliver quarterly numbers. The filing itself says plainly that safety commitments can conflict with short-term financial interests, and that too much caution can mean falling behind.

That is why we will be watching which lines get added and which disappear in the next report. Will there be more "this has happened" examples, or more "we fixed it" lines? You don't have to be an investor to care. This section may be one of the most candid places to learn what risks an AI company is facing right now.