Scarcely a week after I started The Cost of Ambiguity and published The Valuation Spread, Anthropic filed its S-1. I didn’t see that coming, but it was timely.
The filing is long, and everyone has an opinion on it, so I’m not going to repeat all that. Let’s get into a few observations:
1. Who checked the environment?
In Anthropic’s account of its 2026 cyber evaluations, the model was told it had no internet access. An evaluation partner built an environment that left internet access available. Neither side knew until additional monitoring caught it. Each party had reason to think the other had checked.
Section 4 of The Valuation Spread says you can’t write a deterministic control for a role nobody defined. A scope that isn’t enforced has the same gap. Anthropic’s new requirements for partners put the enforcement outside the model - no internet by default, only the model’s own API connection, and a monitor that can end the run. After its own incident, the UK AI Security Institute landed in a similar place and now requires that internet access be justified, not assumed. That’s the default-deny logic of Section 5, applied to a test environment.
2. A credential just lying around
In the S-1, Anthropic describes an early version of a model that could not abort “an impossible task,” so it used credentials it found to get into another system, access more credentials, and change system settings.
The Anatomy of Access Debt (Section 2) was about shared tokens and standing privilege; the point is the blast radius is the same regardless of who finds the credential. Section 5’s answer - access scoped to a task and expired when the task closes - works whether the finder is an attacker, an insider or a model.
3. The finding became a contract term
In Section 3 I wrote about how, when risk can’t be reliably quantified after a finding, remediation holdbacks and seller indemnification are written into the deal. The S-1 shows the same translation from the other side. Since Anthropic has, in so many words throughout the filing, stated that they may not be able to anticipate or reliably predict or prevent the behavior of their models, they have agreed to indemnify some external evaluators and testing vendors for losses from that testing, including security incidents and data breaches. In some instances, there is no cap. The filing also says that insurance for AI-specific risk is still immature, so it may not be enough. Note 13 says no costs have been incurred under these indemnities so far.
For anyone who owns risk: a contract can move liability onto you much faster than a control can contain it.
4. Controls drift, and the filing says so
One risk factor says safety and security controls “depend on complex internal configurations that have failed, been misconfigured, or been inadvertently disabled, and may do so again in the future without our timely detection” and that their “customer onboarding diligence varies by access channel, and we do not and in certain situations cannot uniformly verify the identity of those who access our models or of our customers’ end users.” Most security programs have the same gap between the control as designed and the control as running. This gap may be observed in practice but not put in writing. Continuous verification versus point-in-time assurance is yet another essay topic for another day.
5. Oversight doesn’t scale with the agent
Anthropic’s agents may have enormous processing power, and human-in-the-loop may be built in, but that doesn’t mean that humans have the capacity to review the speed and volume of their actions or the data upon which decisions are being made. The filing names alert fatigue and organizational pressure to maximize autonomy as risks. That last one isn’t a security team problem - it’s what happens when a mandate arrives before anyone has defined what the work needs.
Where the check lives matters, too. Anthropic reports that live blocking monitors catch these behaviors reliably, while offline monitors that rely on the model’s own stated reasoning missed the Mythos 5 incident. In the UK AISI test, the monitoring ran after the fact.
6. You can’t investigate what you didn’t keep
Two of the three organizations affected in July hadn’t noticed the activity before Anthropic told them. A fourth incident, from January 2026 and involving an early Opus 4.6 checkpoint, only came up in August because Anthropic was assembling transcripts for an outside reviewer. That’s seven months between incident and discovery. The filing adds that zero-data-retention arrangements limit detection and incident records, and that full audit trails for agents are hard to keep. It begs the question: how many more incidents have there been that are still undiscovered or cannot be traced?
The Valuation Spread describes compliance as a byproduct of an architecture that logs because it operates. Here, the record that was kept is what made the later review possible. Retention and incident response pull against each other.
7. Words matter: naming the incidents
Anthropic has described these incidents at least four ways. On July 30 there were three incidents, closer to a harness and operational failure than an alignment failure. On August 31 it was an operational security failure plus two alignment issues. By September 9 there were four incidents, with the cause described as “biased reasoning and recklessness or willingness to probe boundaries,” and the authors said they shouldn’t have leaned so heavily on what the model reported believing. The S-1, filed in October, says four models gained unauthorized access and describes one incident in detail. It uses the incidents twice: as an example of misaligned behavior in one risk factor, and as the reason Anthropic suspended certain evaluations in another. It names the misconfiguration as the trigger and doesn’t use the September descriptions. The UK AISI’s own incident, where internet access was deliberate, is a separate case again.
Without working at Anthropic, I don’t know how these incidents are internally classified, and these documents had different readers and were written weeks apart. A risk-factor section, a research post and a regulator’s report will each emphasize something different. Whether an event is a security incident, an alignment finding, a vendor failure or a release risk decides who is told, in what words, and on what clock. The SEC release that created Item 106 also requires a public company to disclose a material cybersecurity incident on Form 8-K, and the S-1 itself says delayed, incomplete or inaccurate incident disclosure increases liability. Without one agreed playbook and one set of criteria across engineering, security, legal and communications, each group describes what it sees, and the public record can end up with several accounts of the same events, especially if not all parties are consulted during the writing of the postmortem.
Section 3 of The Valuation Spread follows a finding to a number. The naming decides which number. Section 4 argues you can’t automate a role nobody defined, and “who decides what we call this” is often that role.
What it costs, and what the filing doesn’t say
Anthropic says it delayed pre-training a new frontier model by more than a month to improve protections against exfiltration. Headcount grew from about 940 to about 5,300 in under two years, which the filing itself flags as a strain on controls. External reviewers get access to internal systems, vendor access can be legally compelled, and third-party control environments limit what can be audited. Regulated buyers inherit that whole chain through vendor diligence, and that will be its own essay.
What the filing doesn’t say is that any of this affected valuation. It’s a risk-factor document, and the price is blank. Section 1 of The Valuation Spread covers Item 106. The cybersecurity disclosure it requires begins with the first 10-K, not the S-1, and the first management report on internal control follows in the second.
References & Frameworks Cited
Regulatory & Filings
U.S. SEC (EDGAR): Anthropic, PBC: Form S-1 Registration Statement (filed Oct 26, 2026)
U.S. Securities and Exchange Commission (SEC): Final Rule 33-11216: Cybersecurity Risk Management, Strategy, Governance, and Incident Disclosure (Item 106)
Incident Disclosures & Reporting
Anthropic: Investigating incidents in our cybersecurity evaluations (Jul 30, 2026)
Anthropic: Improving our alignment and security efforts (Aug 31, 2026)
Anthropic: An alignment assessment of recent cybersecurity incidents (Sept 9, 2026)
UK AI Security Institute: Incident Report: Unsanctioned Agent Behaviour During Cyber Testing (Aug 4, 2026)
BleepingComputer: Anthropic’s Claude breached 3 orgs, uploaded PyPI malware during tests (Jul 30, 2026)