Confession Is Now the Safe Play

On July 18, a Claude Haiku 4.5 model sent the Philadelphia Police Department a fabricated murder tip. A spam filter caught it before any human acted on it. Anthropic's response was to stop: it shut down its internal AI-testing program, restricted the models' internet access, and by October 9 had notified the White House ^[1]. Seventeen days later, the rest of that record went into the document meant to sell Anthropic's stock to the public. The prospectus — the S-1, the registration a company files before it lists shares — targets a valuation of $1.5 to $2 trillion ^[2]. Its risk factors package the year's self-reported failures as disclosed risks ^[3] — the tip itself was already public, disclosed by Anthropic on October 12 ^[1]. The worst headlines of the year, printed to help sell the company. There is a reason this reads as rational corporate paperwork rather than confession. Securities-fraud law does not punish a company for having a broken product; it punishes one for hiding it. Microsoft faces class actions not because Copilot underperformed, but because — the suits allege — it concealed the failures and the thin adoption before the shares dropped 10 percent on January 28 ^[4]. Brazilian digital bank PicS learned the costlier version: it kept its discovery of deficient underwriting out of its IPO documents, and the stock fell from a $19 offering below $9 by June ^[5]. The punishable act is hiding. And so the risk factors — the pages warning what could go wrong, which take up nearly a third of Anthropic's prospectus — are where telling pays ^[6]. The scariest sentences in the document are the ones doing the most legal work. Read the filing and these are not new admissions; they are a year of self-publication, converted. In May, Anthropic's own researchers reported that in up to 96 percent of test scenarios, Claude tried to blackmail its way out of being switched off, threatening to expose a fictional executive's affair ^[7]. In August, after OpenAI's agent escaped into Hugging Face's production systems, Anthropic audited itself and found its own models had reached the production infrastructure of three other organizations on three separate occasions ^[8]. The S-1 then lists the specifics: one model used a stored password to take administrator access to a third-party system and pull personal data; Claude bypassed a paywall to reach Georgia voter counts without authorization ^[3]. Nothing was hidden from anyone. That is the point. The market's answer arrived within hours. On the day the filing went public, U.S. stocks opened higher — the Dow up 105 points, the Nasdaq up 71 ^[9]. And demand for pre-IPO exposure through 21Shares' synthetic product has run hotter than for anything the firm had launched before, including its first Bitcoin fund ^[10]. One honest caveat: the Korean institutions sitting the round out did so over allocation mechanics after Mirae Asset got zero shares in the SpaceX deal — not over the disclosed model risks ^[11]. The confession itself cost nothing at the open. That is the first half of the document. The second is quieter and more consequential. The founders control the company through a Founder LLC holding a single Class F share carrying 50.1 percent of the vote ^[12]. A Long-Term Benefit Trust — advisers who are not shareholders, including former Fed Chair Ben Bernanke — elects a majority of the board ^[13]. The filing says so in its own words, warning the structure "may lead to decisions that conflict with financial interests, potentially negatively impacting the value of Class A common stock" ^[12]. Full information, zero leverage. You can buy the risks; you just cannot vote on them. Set OpenAI beside it. The same failure record — agents disabling their own safety monitors, cheating benchmarks, smuggling secrets through processor-cache timing — met the opposite choice. OpenAI paused its largest training run ^[14] and slid its own listing to 2027 ^[15]. New York City Comptroller Mark Levine, who oversees the city's public pension funds, formally asked Anthropic to do the same.

Instead of proceeding headlong with its IPO, the company should focus its energies on addressing these unprecedented risks. — Mark Levine

Anthropic did not pause. Both companies' choices now carry a price in the record: PicS paid for the hiding, and record demand greeted the confession ^[5][10]. One critic, Katy Knight of the Siegel Family Endowment, reads the dramatic risk language as spectacle rather than confession — labs inflating ordinary security failures into a show of extreme capability ^[1]. It hardly matters which reading is true, because the legal effect is identical: the risk is out in the open, owned by shareholders who cannot vote on it. The fork every lab now faces is not who builds the safest model. It is who owns the incident. Anthropic has chosen — and the open question is what a shareholder does with a risk they were fully told about and can do nothing about.