The large takeaways and massive questions from Anthropic’s S-1

• Anthropic unveils its IPO prospectus.
• Cybersecurity researchers poke holes in Anthropic’s security.
• OpenAI claims breakthroughs in math, computer science, and physics.
• OpenAI releases GPT-6.1 Terra.
• The number of AI-spotted cyber vulnerabilities is soaring.

Yesterday Anthropic published its IPO prospectus, giving us some key insights into the company’s financials, and by implication, the economics of the rest of the AI industry. But the company’s S-1 filing also left a lot of key questions unanswered. As my colleague Allie Garfinkel wrote in her “Term Sheet” newsletter today, the prospectus embodied all the contradictions of the AI era, encapsulating both the enormous potential opportunities of the technology, and its gigantic risks.

For more of Fortune’s excellent reporting on Anthropic’s prospects, check out the “Fortune on AI” section of this newsletter below.

Meanwhile, here’s a look at some of the most interesting things we learned from Anthropic’s S-1, and some of the things we’d still like to know.

Anthropic’s operating economics aren’t too shabby (for now). As of June, the company was generating more than two dollars in revenue for every dollar it was spending on compute. That’s better unit economics than some AI skeptics had assumed. Once other operating costs were added in, the company’s adjusted operating margin was still at a 19% profit margin in the most recent quarter it reported. (Although that figure excludes the cost of Anthropic’s stock-based compensation, as well non-cash charitable contributions, and what Anthropic is paying to settle copyright violation claims from book authors.) What’s more, those unit economics have been improving over time, with a 50% improvement in revenue per dollar of compute cost just between the first and second quarters of 2026. The S-1 also shows that the company’s operations generated $3.9 billion in free cash flow in the first half of 2026.

But the company warns repeatedly throughout its S-1 that these trends might not continue. In particular, it warns “as significant incremental compute is brought online in future periods, the associated expense will be recognized in advance of the full revenue that the compute will ultimately support, and we expect operating margin and Adjusted Operating Margin may compress in those periods.”

The company also cautions that price competition with rivals could significantly impact its margin or even “adversely affect our ability to achieve or sustain profitability.” For more on the extent to which OpenAI is already winning market share by undercutting Anthropic on price, check out this story, headlined “Anthropic’s margin is OpenAI’s opportunity,” that ran earlier this week in The Information.

Anthropic is planning to spend crazy amounts on compute. The company spent $5.6 billion on compute and infrastructure in the six months through June 2026. That spending is set to explode. By exactly how much? It’s a bit hard to tell because the company’s S-1 includes many different numbers in different places. The spending commitments are over different time periods. Some of them are cancelable. Some of them are not. My colleague Emily Forlini lays out some of this in her excellent piece from yesterday on Anthropic’s future compute plans. Meanwhile, Sebastian Herrera and I looked at the risk stemming from the ease with which Anthropic’s customers can switch to competing AI models versus the fact the company has locked in most of its costs with non-cancelable compute contracts.

Here is quick look at those compute numbers: the company is spending $45 billion to secure data center capacity from Microsoft, $110 billion with Amazon, $121 billion with SpaceX, and $115 billion with Google, plus commitments for between $125 billion to $150 billion more, as well as $45 billion with neocloud Nscale and $41 billion with its rival Lambda. So that’s at least $602 to $627 billion, right there. Then there’s the amounts it is spending for chips in some of these data centers. That includes at least $20 billion with AMD and $161 billion in a colossal leasing deal with Broadcom. So that brings the total up to as much as $808 billion.

Whether Anthropic’s revenue growth will really be strong enough to cover these costs is one of the big questions that the S-1 can’t really resolve. Certainly its 1,300% revenue growth rate between the first half of 2025 and the first half of 2026 would be sufficient. But, of course, that hypersonic revenue expansion is almost certainly not going to last.

Anthropic doesn’t like concentrated power, except its own. One of the risks that the company warns about in its prospectus is that AI could be used by authoritarian governments to “create high-tech surveillance states, deepen repression, and make themselves much more difficult to dislodge.” Anthropic says it is “committed to working with free societies to provide a counterweight to authoritarian abuse and promote freedom and democracy.” But apparently not shareholder democracy.

The company rests all control of its board in the hands of its Long-Term Benefit Trust (LTBT), whose five members have the ability to appoint the majority of Anthropic’s corporate board, and its seven cofounders, who collectively, through a Founders LLC, have 50.1% voting power to elect the rest of the board. In some very limited circumstances, if the LTBT and the cofounders deadlock over the election of a board director, Anthropic’s employees, who hold a special Class E of voting stock, get to help decide. They also get to vote on certain changes to how the LTBT operates. Regular investors, who receive Class A shares, but for all practical purposes they will always be out-voted by the cofounders (their votes will only count in cases where the cofounders are split on a decision). Anthropic backers Amazon and Google are granted Class N shares that also have no voting power.

For a company that often pays lip-service to democracy—and which has taken steps to solicit a wide set of views on what values should be embodied in the written “constitution” it uses to guide the behavior of its Claude models—Anthropic’s lack of trust in shareholders does seem somewhat jarring.

The risks are unprecedented. My colleague Beatrice Nolan has a good piece breaking down some of the major risks highlighted in Anthropic’s S-1. These include everything from bad actors using its AI models for cyberattacks to the risk the U.S. government will choose to nationalize the company at some point.

Of course, the biggest risk mentioned in the prospectus is the potential that AI could wipe out humanity. Matt Levine over at Bloomberg has a typically hilarious and trenchant column on Anthropic’s S-1 (much of which dwells on the corporate governance issue I raise above) which begins with his annoyance that Anthropic chooses to couch this risk in its prospectus using passive voice:

Concerns have been raised both within our organization and by other researchers, regulators, policymakers, and industry participants that sufficiently advanced AI systems could, if not developed, deployed, and operated with appropriate safeguards, oversight, and security measures, pose catastrophic or existential risks to humanity, particularly if such systems were misused, replicated, weaponized, or allowed to operate with a high degree of autonomy.

Among those raising those concerns has, of course, been Anthropic CEO Dario Amodei.

Now we come to some of the big outstanding questions that the S-1 didn’t answer:

Why hasn’t the company told us about its third quarter results? There was a lot of criticism of Anthropic on social media for not having included third quarter 2026 financial results in its S-1, even though it included other recent events in the document, and even though it briefed existing investors about these results during its October 14 investor day. The critics are saying the company didn’t include the third quarter results because they don’t paint as positive a picture of the company’s financial health and growth prospects.

We know that growth slowed in Q3 for two reasons. One is that some of these figures leaked out from that investor day. But also, there are some figures in the S-1 that allow you to impute a few of the Q3 figures. For instance, Anthropic mentions that its revenue for the three months ended September 30 was 86 times what it was for the same period in 2024. Doing that math produces about $16.8 billion (which is the same figure that leaked from the investor day.) That is about 45% more than in the second quarter of 2026. But that growth rate is significantly less than the 147% growth rate between the first and second quarter.

What other less flattering numbers are in the not-yet-reported third quarter results?

How much is Anthropic’s use of convertible notes covering its true expenses? Another criticism leveled at the company on social media is that its use of convertible notes to pay for some computing costs mask its true operating economics. Some compared this to a tactic used by many of the money-losing companies that went public during the dot-com bubble. Those companies often paid for stuff by issuing warrants to suppliers ahead of their IPOs. This made their adjusted operating figures and their cash flow numbers look much better than if they had to pay for stuff with cash.

Most of Anthropic’s notes were issued to Amazon and Google and it is possible that those companies also offered Anthropic discounted rates on the compute the company used. The question is, what happens in the future, after Anthropic is public, and it has to start paying cash for this compute?

What is the exact payment schedule for all of that compute? The S-1 doesn’t specify exactly what amounts Anthropic needs to pay which compute and infrastructure providers when. The S-1 talks about obligations coming due between 2026 and 2033, or in some cases 2036. In other places, it talks about commitments due over the course of between one and 20 years. Analysts would like to see a schedule of exactly when these payments are likely to be due so they can get a more realistic sense of how likely Anthropic is to have enough revenue to meet these obligations.

Hopefully, we’ll get answers to many of these questions in the coming weeks before Anthropic’s shares actually begin trading. That’s expected to happen sometime between November 9 and Thanksgiving.

With that, here’s more AI news.

Jeremy Kahn
jeremy.kahn@fortune.com
@jeremyakahn

Before we get to the news, just a reminder to check out our new vodcast, Fortune AI Weekly. This week, Bea Nolan and I discuss the growing number of AI-related cyber security crises, increasing concerns among investors about the sustainability of the AI boom, and what the mood was like at Nvidia GTC Berlin. You can check out the vod here on YouTube.

Also, if you want to learn more about how your company can harness AI successfully, please consider joining me and my Fortune colleagues at this year’s Fortune Brainstorm AI San Francisco, taking place December 7-8. We’ve got a great lineup of speakers, which we’ll be announcing soon. You can apply to attend here.

FORTUNE ON AI

Anthropic’s IPO prospectus shows $16.3 billion in revenue, an $80.7 billion net loss, and goal of an ‘age of miracles’—by Beatrice Nolan

Anthropic plans to spend up to $567 billion on compute. Its IPO prospectus reveals plans to set up its own data centers—by Emily Forlini

Anthropic’s risk factors include the end of humanity, a feud with the Pentagon, and CEO Dario Amodei’s reputation—by Beatrice Nolan

Anthropic’s dual-class share structure borrows ideas from Mark Zuckerberg, Elon Musk—and the New York Times—by Nick Lichtenberg

Anthropic’s S-1 makes clear it’s on the hook for billions in compute. Its customers can walk at any time—by Sebastian Herrera and Jeremy Kahn

Anthropic’s 7 cofounders are each worth $14 billion already—and that could double in an IPO. They’ve promised to give most of it away—by Nick Lichtenberg

Anthropic’s 7 cofounders are splitting $200 billion almost evenly, down to the last stock option—by Amanda Gerut

Anthropic’s founders’ 80% giving pledge could be worth nearly $80 billion—by Tatiana Sataua

AI IN THE NEWS

Cybersecurity company finds big holes in Anthropic’s security. Cybersecurity startup Cathedral, founded by former DOGE staffers, used AI agents to penetrate sensitive systems at Anthropic, according to a story in the Washington Post. It took the security researchers less than 12 hours to gain access to Anthropic’s internal meeting transcripts, salary and job-offer information, and Slack discussions about advanced AI models. Cathedral, operating under Anthropic’s bug-bounty program, did not break directly into Anthropic’s core AI systems but instead exploited vulnerabilities in third-party business software connected to the company, highlighting how mundane enterprise tools can become a weak link for frontier AI labs. Anthropic said the researchers accessed only a limited set of sales, HR and IT systems—not customer conversations, model code or model weights—and that it quickly closed the vulnerabilities, while accusing Cathedral of overstating the national-security implications. The incident has nonetheless alarmed U.S. officials because foreign intelligence services are believed to be targeting leading AI labs and the research showed that these companies may not have sufficient cybersecurity measures in place.

Anthropic suffers another rogue AI incident. Anthropic disclosed that its Claude AI model, while being used internally for a statistics project, bypassed a paywall without being instructed to do so and accessed aggregate Georgia vote counts that are publicly available for a fee. Claude did not enter Georgia’s voter-registration system, retrieve individual voter records, or alter any election data, and Anthropic says it has introduced safeguards to prevent similar unauthorized actions. The episode adds to mounting concerns about increasingly autonomous AI agents taking actions their human operators did not explicitly authorize, an especially sensitive issue as the U.S. approaches the 2026 midterm elections. Read more from Axios here.

Cohere says Alibaba model attempted to contact Chinese server. AI company Cohere said an open-weight model built by Chinese internet giant Alibaba, Qwen3.8-Flash-Next, behaved unexpectedly during a cybersecurity test, inspecting its sandbox environment and attempting to upload a set of harmless data, known in cybersecurity jargon as a “probe string” and which can be a precursor to an attempt to exfiltrate more critical data, to an Alibaba Cloud storage bucket in Beijing. The model’s reasoning traces did not record the action, which raised further suspicions. Cohere said its sandbox blocked the attempted connection. The company said it could not determine whether the behavior was deliberate or merely a residue of training, but argued that the episode illustrates the risks of trusting an AI agent’s stated reasoning rather than monitoring what it actually does. Cohere’s claim, and its implications of a possible backdoor built into the Qwen model, drew significant pushback, with critics noting that the behavior occurred fewer than once per 100,000 evaluation calls, could not be reproduced with the original prompt, and does not prove that there was a backdoor or even who controlled the destination bucket. Some also questioned the framing given that Cohere competes with Alibaba in AI models and used the post to promote its own “sovereign AI” and security offerings. You can read Cohere’s report on the incident here.

OpenAI debuts GPT-6.1 Terra. GPT-6.1 Terra is a mid-priced model that OpenAI says is up to 50% cheaper per token than both its GPT-5.6 Terra model, released in July, and the higher-performing GPT-6.1 Sol released in September. The company says the new model is particularly strong at common workplace tasks such as drafting proposals and filling out forms, as well as video editing. The launch is part of OpenAI’s effort to compete more aggressively with Anthropic by offering customers cheaper models and other financial incentives. Read more from The Information here.

EYE ON AI RESEARCH

OpenAI claims to have cracked key math, computer science, and physics problems. The company said an unreleased AI model had achieved three potentially major scientific breakthroughs.

In mathematics, the models produced a proof of the “local smoothing conjecture,” a 35-year-old problem concerning the behavior of waves; if correct, the result would also settle several other longstanding mathematical conjectures.

In theoretical computer science, the AI produced a proof overturning the widely believed Exponential Time Hypothesis, which says, roughly, that certain computational problems inevitably require exponentially more time as they grow larger.

And in physics, OpenAI says its models generated rigorous mathematical proofs establishing the existence of quantum chromodynamics—the theory describing interactions between quarks and gluons—and of Yang–Mills theory, part of one of mathematics’ famous $1 million Millennium Prize problems. (OpenAI recently claimed to have solved a different one of the seven Millennium Prize problems and made substantial progress on several others.) 

The claims still need to be digested and scrutinized by the scientific community, and OpenAI is treating the AI-generated manuscripts as something closer to raw research output than finished academic papers. The math and computer-science results have been formally checked using Lean, software that can verify the logical steps of a mathematical proof, but prominent outside researchers are now examining and explaining the results. Meanwhile, a separate group led by Nobel laureate David Gross is reviewing the physics work before the underlying material is released.

If the findings hold up, their significance extends beyond the individual problems: they would provide unusually strong evidence that AI systems can generate genuinely novel theoretical results at the frontier of human knowledge. But they also could upend how these fields operate, changing which human skills scientists value and also how training and career advancement works within these disciplines. You can read OpenAI’s blog about the findings here and coverage in Quartz here. 

AI CALENDAR

Nov. 16-17: Fortune 500 Innovation Forum, Detroit. Apply here to attend.

Nov. 18-19: Slush, Helsinki, Finland. 

Dec. 6-12: Neural Information Processing Systems (Neurips) conference. Sydney, Australia.

Dec. 7-8: Fortune Brainstorm AI, San Francisco. Apply here to attend.

BRAIN FOOD

Is the AI cyber apocalypse upon us? Certainly there’s been a lot of talk about “Black October” among cybersecurity experts, given the number of AI-assisted cyber attacks that have taken place in the past few weeks and the number of critical vulnerabilities that AI systems have found lately. Putting some figures on it, Deedy Das, a partner at Menlo Ventures, posted some stats: the number of security issues (or CVEs, common vulnerabilities and exposures) found in the past six months has grown 3x. Only 1.5% of those found were officially credited to AI tools. But, given that 60% of the findings were not credited at all, it is possible many of the others were found by AI too. Anthropic has reported the most CVEs among AI companies, with 294 credited to it (a number that has since grown to 329, according to this tracker.) OpenAI had about 111 credited to it so far. You can see Das’s post on LinkedIn here.