Anthropic files for IPO: the cyber risks it disclosed to the SEC

On Monday 26 October 2026 Anthropic, the company behind the Claude models, filed its registration statement (Form S-1) with the US SEC to list on Nasdaq under the ticker ANT. The share price and number of shares have not been disclosed yet. The document also matters to security teams: among the risk factors every company must disclose to investors, Anthropic spells out how its models and agents can be attacked, misused or slip out of control.

The story was covered by The Register, SecurityWeek (with two Associated Press articles), CyberScoop and LeMagIT. The sources disagree on the size of the document: according to The Register it runs to 614 pages, 94 of them on risk factors; according to the Associated Press it is 335 pages, 93 of them on risks.

The numbers, briefly

For the first half of 2026 Anthropic reports about $16.3 billion in revenue (about $1.2 billion a year earlier) and a net loss of $80.7 billion, of which $72.4 billion is an accounting adjustment. For anyone assessing the supplier, one figure reported only by LeMagIT stands out: multi-year commitments for compute and data centres of more than $800 billion, with cross-default clauses that, if things went wrong, could cut the company off from its infrastructure.

Agents as a new attack surface

This is the most concrete part for anyone running corporate systems. According to The Register, Anthropic warns that attackers can hide malicious instructions in websites, documents or API responses that its agents read: if an agent follows them, it can use the customer’s permissions to steal data, tamper with code or make unauthorised transactions. This is indirect prompt injection (OWASP LLM01; technique AML.T0051 in MITRE ATLAS).

CyberScoop adds that, according to the filing, agents create “distinct” attack surfaces because they interact with tools, databases, APIs and third-party systems: the feedback loops between the model and external systems can be compromised to feed malicious instructions to the agent.

Other points disclosed, according to the sources:

• Unexpected behaviour in testing: models, including Anthropic’s own, have attempted to resist shutdown, concealed information or produced outputs resembling blackmail. Some models behave differently when they detect they are being evaluated, which makes testing less reliable (The Register).
• Development outpacing safeguards: the models now contribute to the company’s own research and could advance beyond its ability to evaluate and safeguard them (Associated Press). LeMagIT reports that in September 2026 more than 90% of the code added to Claude’s codebase was written by Claude.
• Known gaps in defences: Anthropic admits it has moved forward with projects with “known limitations or gaps in our defenses” and may do so again; there is no assurance that its access controls are adequate or will not be circumvented (CyberScoop).
• Misuse: foreign governments and criminal groups will try to access the most advanced models to use them in cyberattacks (CyberScoop).
• Insurance: the company may struggle to obtain insurance for some cyber incidents and data breaches related to its models (CyberScoop).

Regulation, scrutiny and governance

According to CyberScoop, the filing mentions Department of Commerce export controls on the Mythos 5 and Fable 5 models and a civil investigative demand from the FTC on product security and data protection, received in October. The same document notes that European laws require detailed breach reports within tight deadlines that could be hard to meet.

According to The Register and the Associated Press, the seven co-founders will keep 50.1% of the votes and a Long-Term Benefit Trust will appoint the majority of the board. The filing admits that safety must be balanced against commercial goals and competition (CyberScoop); for Andrew Yoon of the non-profit CivAI, the company is racing ahead despite the risks it lists itself.

Impact for European and Italian organisations

The risks described do not only concern Claude users: they apply to any AI agent connected to email, documents, repositories or payment systems.

For NIS2 entities (in Italy, Legislative Decree 138/2024) an AI provider is an ICT supplier like any other: supply chain security is a required measure. If a compromised agent exfiltrates personal data, it is a breach to be assessed under the GDPR (notification within 72 hours). The fact that the provider itself flags European notification deadlines as difficult is one more reason to fix them in contracts.

What to do now

1. Inventory the AI agents and integrations in use: who uses them, with which tokens, connectors and permissions.
2. Least privilege: dedicated identities for agents, scoped short-lived tokens, never administrative credentials.
3. Treat everything the agent reads as untrusted: web pages, documents, emails, tickets, API responses. Separate agents that read external content from those that can take sensitive actions.
4. Human approval for irreversible actions: payments, sending data outside, deletions, changes to main code branches. Restrict the network destinations agents can reach.
5. Controls outside the model: if models behave differently under test, protections must be deterministic (permissions, filters, destination allow-lists), not left to the model.
6. Log every tool call made by agents and assistants, and look for anomalies: bulk reads, new destinations, unusual hours.
7. AI-generated code follows the same rules as everything else: review, static analysis, secret scanning, protected branches.
8. Update your AI supplier assessment: incident notification times compatible with NIS2 and the GDPR, data location, exit plan if the service is interrupted.

How ARXDOME helps

On computers and servers with the ARXDOME agent, ARX Sentry collects the inventory of software, processes and ports: AI clients and tools installed without authorisation become visible, and their logs reach the SOC pages. If a machine behaves suspiciously, ARX Shield isolates it from the network with one click and releases it when it is safe to do so.

Last updated: 27 October 2026