Anthropic Is the $13.7 Billion Customer Nobody Could Name
RUM Group disclosed a six-year GPU services contract worth roughly $13.7 billion in an August SEC filing and declined to say who the buyer was. On September 14, The Information reported the answer: Anthropic. The capacity comes from RUM Group’s data center in Maysville, Georgia, and the order value is split evenly across three purchase tranches, with the third requiring the customer to approve a delivery date before obligations start. RUM’s stock moved on the confirmation.
The structure is where it gets interesting. RUM issued a 10-year warrant for up to 50.8 million shares at $0.01 each. Half vests against GPU purchases under the Maysville contract. The other half only triggers if Anthropic commits to another 400–500 megawatts at a second RUM facility still under construction. That is not a supply agreement with an option attached — it is a supply agreement engineered to make the option attractive.
Two things to hold at once. RUM Group has long-standing ties to the Trump administration, which makes this the most concrete form yet of a rapprochement that has been building since a federal judge ruled in August that the Pentagon’s supply-chain-risk label on Anthropic was unlawful retaliation. And RUM has said plainly that it still needs financing to fulfill the deal. Anthropic has contracted $13.7 billion of compute from a vendor that has not yet paid for it.
The Three Labs Have Been Quietly Building Their Own Regulator Since July
The Washington Post and The Information reported that Anthropic, OpenAI and Google have been discussing a shared AI industry standards body since at least July, with working groups meeting as recently as last week. The participants are executives below CEO level — which is how you can tell it is a real workstream rather than a press posture.
The origin is a July essay by Demis Hassabis proposing a US-led body modeled on FINRA, the securities industry’s self-regulator, that would evaluate advanced models before release as a public-private partnership. The core of what is on the table now: shared protocols for pre-release testing, independent evaluations, and standardized risk assessments. The explicit design goal is a self-regulatory framework without government involvement.
Status check before anyone gets excited: nothing is finalized. No organization has launched, no rulebook exists, and three companies meeting about standards is not a standards body. But it reframes what happened last weekend. Amodei’s essay did not arrive out of nowhere and get instant agreement from rivals by coincidence — these teams had been in a room together for two months. The public consensus was the announcement of a private one.
Axios: The Safety Week Did Not Slow the Listing Down
The obvious question after a weekend of slowdown essays and whistleblower coverage was whether Anthropic would push the IPO. Axios reports it will not. The company is still on track to list in 2026, on Nasdaq, with the roadshow possible from mid-October and the offering aimed at closing before the November midterms.
The framing from Anthropic’s side is the part worth noting: the company may see the past week as strengthening the case for listing rather than weakening it, on the argument that public-company transparency is itself a safety mechanism. Pair that with the pledges already made — third-party model evaluation, some pacing of releases — and the pitch becomes that the disclosure regime is a feature. OpenAI still looks like 2027.
The numbers behind it, for reference: confidential S-1 filed June 1, up to $100 billion raised at roughly $2 trillion (both still under discussion), against a May Series H mark of $965 billion that raised $65 billion. CFO Krishna Rao, hired from Airbnb to run exactly this, has spent two months in test-the-water meetings in San Francisco. Nvidia is weighing up to $10 billion as an anchor.
Two Releases in One Day: 2.1.271 and 2.1.272
After a quiet weekend, the pipeline shipped twice on September 14. 2.1.271 is the one with features: fast mode in Claude Code Remote sessions, mouse support in the /config panel in fullscreen, a new claude self-hosted-runner --drain-marker-file option for graceful runner shutdown, and the item worth your attention — per-command allowed_domains for Bash, PowerShell and Monitor in auto mode with sandboxing.
That last one extends the domain-restriction pattern from agent web tools down to individual shell commands. If you run Claude Code in auto mode against a sandbox, you can now scope network reach per command rather than per session. It is the same containment idea that showed up in Managed Agents last week, and it is still the cheapest safety control in the product.
2.1.272 arrived behind it as a reliability pass. Fixed: terminal capability-query replies leaking into the shell prompt or editor on exit or suspend; duplicate background commands restarting after a conversation compacts; /resume and /continue showing only one or two sessions on short terminals in fullscreen; and --resume silently dropping the 1M context window when the resumed session’s model family differs from your configured default. Also faster rendering on large diffs and long transcripts, Markdown artifacts now rendering as styled document pages with title header and syntax-highlighted code, and artifact watching raised from 5 to 10 concurrent published artifacts.
Managed Agents Got an auto Permission Mode
Quietly useful and easy to miss in the platform notes: Managed Agents permission policies now include auto. Instead of a binary allow-or-prompt, the server evaluates each agent or MCP tool call and then runs it, denies it, or pauses for approval. The decisions are observable — agent.tool_use and agent.mcp_tool_use events report how each call was evaluated.
That last detail is the one that matters operationally. A policy you cannot audit is a policy you are trusting rather than enforcing. With per-call evaluation events you can actually answer “what did this agent try to do, and what did we stop” after the fact, which is the question that comes up the first time something goes sideways.
Also now generally available on the Claude Platform, if you missed the rollout: the computer use tool, the browser use tool, the Skills API, and the Files API. And a standing reminder from last week that still applies — Sonnet 5 stays at $2 / $10 per MTok; the scheduled increase to $3 / $15 is not happening.
Enterprise Frontier Safeguards Is Rolling Out, and It Is Free
Enterprise Frontier Safeguards replaced Anthropic’s prior data retention policy on September 1 after customer pushback, and it is now rolling out in phases toward broader availability this fall. The trade it resolves is a real one: zero data retention normally means giving up misuse detection, because you cannot spot a pattern across sessions you did not keep.
The mechanism is that logs live in the customer’s own cloud — Amazon S3, Azure Blob Storage or Google Cloud Storage — under the customer’s own encryption keys and access policies, while Anthropic still runs cross-session misuse detection against them. Your compliance team owns the data; the safety system still works.
It was built with more than 100 customers across financial services, healthcare, manufacturing, telecom, law, retail and the public sector — including the Analysis and Resilience Center for Systemic Risk, whose membership is the CISOs of the largest US banks, plus leaders at Comcast, KPMG, Mastercard, Salesforce and Visa. Anthropic does not charge for it. If you have an enterprise plan and a data-residency objection sitting in a procurement thread, this is the thread to reopen.
The Legal Backdrop the S-1 Has to Describe
Two matters sit behind the October listing and both moved recently. The $1.5 billion copyright settlement — approved in July, covering roughly 500,000 works at about $3,000 per book, after a judge found Anthropic had downloaded and stored pirated books for training — reached the stage in early September where the administrator sent notices to all claimants. That is the phase where the number stops being an accrual and starts being cash out the door.
The other went Anthropic’s way. In August, a federal judge ruled the Pentagon’s designation of Anthropic as a supply-chain risk — the first such label applied to a US company, issued after Anthropic refused the military unrestricted use of its models — was unlawful retaliation under the First Amendment, arbitrary and capricious, and a Fifth Amendment due process violation. Anthropic had sued in March.
Read those two together with today’s compute news and the shape of the year is legible: Anthropic paid $1.5 billion for how it got its training data, won a First Amendment case against the administration in August, and signed a $13.7 billion deal with a vendor tied to that administration in September. All three will be in the prospectus.
You Can Pace a Roadmap. You Cannot Pace a Six-Year Contract.
Saturday, Anthropic asked the industry to slow the rate of capability gain. Monday, we learned Anthropic committed $13.7 billion over six years to GPUs. There is a clean answer to the apparent contradiction and it is worth stating fairly: pacing is about release cadence and alignment evidence, not about how much silicon you own. You can buy compute and choose not to ship. Training runs you can halt; substations you cannot conjure. Under-buying compute now would not make the company safer, it would make it smaller.
That answer holds right up until you read the warrant. Half of the 50.8 million shares only vests if Anthropic commits to another 400–500 megawatts at a facility that does not exist yet. That is not a company keeping its options open — it is a company that has been handed a financial incentive to expand, on a clock, by a counterparty that says it still needs financing and whose stock jumped when Anthropic’s name leaked. Anthropic’s demand is now collateral in someone else’s capital raise. Pacing commitments are annual and revisable. That warrant runs ten years.
The standards-body reporting reframes the weekend too, and mostly in Anthropic’s favor. Three labs endorsing a slowdown within hours looked like either a genuine inflection or a coordinated maneuver, and the honest answer turns out to be neither — it was two months of working groups below the CEO line, seeded by a Hassabis essay in July, aimed at a FINRA-style self-regulator. That is more durable than a viral essay and more concerning than one, because the explicit design goal is a framework without government involvement. FINRA is the analogy the industry chose for itself. FINRA is also a body that has been repeatedly criticized for going easy on the firms that fund it.
Which leaves the thing to actually watch this quarter, and it is not the rhetoric. Anthropic is telling Axios that public-market transparency makes it safer. Fine — that is a testable claim, and the test arrives with the S-1. A prospectus has to describe material risks, related-party exposure, and contractual obligations. So: does the $13.7 billion RUM commitment and its warrant structure get disclosed in full, with the political relationship characterized honestly? Does the pacing pledge appear as a stated constraint on growth, where investors can price it? If transparency is the safety mechanism, the filing is where it either shows up or does not. Everything else this week was people saying things. The S-1 is people signing things.