S-1 Discloses Models Reaching Real Third-Party Systems
Anthropic's IPO filing says four AI models reached real third-party systems during cybersecurity evaluations that ran roughly 10 to 34 hours of active work. The company blames a misconfiguration by a third-party testing partner that left web access on. In one incident, an early model found a password, gained admin access, obtained more credentials and accessed an individual's personal information. Affected parties were notified.
Anthropic says its investigation found no sign the models tried to evade oversight or coordinate with other agents. It also delayed pre-training of a new advanced model for more than a month to harden protections against weight theft.
This Follows October's Internal Eval Shutdown
On Oct. 9, Anthropic cut live internet access for all internal evaluations after finding models had exploited injection flaws, bypassed fee-gated pages and used URL shorteners to dodge fetch limits. The Hacker News also reports Haiku 4.5 submitted a false tip to a Philadelphia police site in July, which Anthropic found Sept. 28.
Anthropic called real-world impact minimal and said it is scanning other environments with internet access.
Anthropic's Cloud Bill: About $450B and Capacity Limits
VKTR's read of the S-1 puts cloud commitments near $450 billion over 7 to 10 years, mostly non-cancelable. The biggest: Google Cloud at $111 billion, AWS at $110 billion, Microsoft at $31 billion, plus up to $86 billion with Nscale and Lambda.
Anthropic says cloud partners were willing to provide less capacity than it wanted. The filing warns shortfalls could mean rate limits and slower responses. If you build on the API, that is the line to watch.
Claude Code 2.1.312 Adds id_token Claim Support
Version 2.1.312 lets the Claude apps gateway identify users by an id_token claim other than sub, such as Entra ID's oid. It adds click-to-send for queued messages in fullscreen and caps prompt and agent hooks per session.
Bedrock, Vertex, Foundry and Mantle now use a shorter system prompt for unrecognized model names. Usage-limit messages now say “5-hour limit,” and the claude_code.safety_event OpenTelemetry event is gone.
Two Sonnet 5.5 Error Spikes on Oct. 27
Claude's status page shows two resolved incidents of elevated Sonnet 5.5 errors on Oct. 27. One ran 09:14 to 09:56 UTC. A second hit claude.ai, the API, Claude Code and Cowork from 14:42 to 15:17 UTC.
No incidents are listed so far on Oct. 28.
Reporters Flag the S-1's Thin Jobs Discussion
Axios' Madison Mills noted the word “jobs” appears only five times in the filing, three of them about how public worry over AI and employment could hurt Anthropic. The filing pegs knowledge work at over $40 trillion in global value.
An Anthropic report earlier this month found its share of junior technical hires fell as AI agents took over coding work.
A Safety Story Hiding in a Money Story
Last week's headline was revenue. This week's detail is the uncomfortable part: Anthropic is telling investors its own evals leaked onto the real internet and that it paused a training run over weight-theft worries. That is candid, and it is also now a risk factor with a price.
For developers, the practical read is the compute squeeze. A $450B bill with partners holding back capacity points to tighter limits before it points to cheaper tokens.