Within weeks, Anthropic is expected to make public the registration statement for what may be the largest initial public offering in history. Press reports put the valuation near $2 trillion and the proceeds as high as $100 billion, with trading as soon as November. When the prospectus appears, readers will turn to the section called Risk Factors, and they will find dozens of pages of it. We want to put something on the record before they do: our own view of the risks that matter most to Anthropic’s value, and our prediction of how the prospectus will describe each of them.
We are doing this in advance, and dating it, for a simple reason. Once a prospectus is public, every analysis of it is shaped by it. The only way to learn whether careful work from public information can anticipate what a company will disclose, and what it will leave out, is to write the analysis down first and compare afterward. Everything here rests on information that was public on or before September 26, 2026.
Our argument fits in one sentence. The risks that most threaten Anthropic’s value are not the AI-safety risks that dominate public debate about the company. They are a compute build-out of roughly half a trillion dollars in commitments set against revenue with only a few quarters of history; a supplier base that is also its shareholder base; and a federal government that twice in 2026 acted against the company by executive discretion. The safety and liability risks are real, but most of them are contingent and sit in the tail. Our prediction follows from how prospectuses are written. The document will be most specific about the risks the law requires it to describe, and least specific about the ones that drive value. One more thing belongs at the top. When our list was finished, one of us read it as an accountant and added two risks that rank with the most important here: the unit economics of selling AI, and the charge for stock-based compensation that will hit at the IPO. Our process missed both, and we explain below how.
How Risk Factors Actually Work
It is natural to assume that lawyers scrub a prospectus by leaving things out. For risk factors the pressure runs the other way. Under Section 11 of the Securities Act, an issuer is strictly liable for a material misstatement or omission in its registration statement, and the officers, directors, and underwriters face liability alongside it. The safest course for counsel is to disclose everything that might conceivably matter, which is why technology prospectuses routinely carry 50 to 100 captioned risk factors. The SEC’s 2020 amendments to Item 105 of Regulation S-K responded to the resulting sprawl. They require a summary when the section runs past 15 pages, require headings, and discourage generic risks that could apply to any issuer.
The shaping happens in the manner of disclosure rather than the fact of it, and it takes four forms. The first is generality: a risk specific to the company is written in language that would fit any company in its industry. The second is hypothetical framing: an event that has already happened is described as something that could happen. The third is the absence of numbers: the risk is named and the magnitude is not. The fourth is burial: a serious risk sits among eighty others with nothing to mark it as different. Hypothetical framing is the one that has drawn enforcement. In 2019 Facebook paid the SEC $100 million for describing the misuse of user data as a hypothetical risk after it had learned that such misuse had occurred.
This tells us what is worth predicting. Almost every risk we identify will appear in some form. The informative question is how—named specifically or generically, as an event or as a possibility, with a number or without one. That is what our predictions address, and any reader can check them against the filing.
How We Arrived at Our List
We used nine industries whose histories of liability, reliance, and regulation offer a structural parallel to a frontier AI company: tobacco, asbestos, pharmaceuticals, social media, credit rating agencies, enterprise software, telecommunications, banking, and semiconductors. We did not use them as arguments that AI resembles any of them. Each industry was a device for generating questions. What did tobacco’s experience with internal knowledge and warnings suggest about Anthropic? What did the telecom capacity glut of 2000 to 2002 suggest about its compute commitments? What did the rating agencies’ conflict, in which the rated party pays, suggest about a company that grades the safety of its own models? We then tested the resulting risks against current public information, consolidated them, and only afterward compared them with the SASB standards. The Methodological Appendix describes the process. The full detail is in four working papers on Bob’s website: Working Paper 1, “Anthropic Before the Prospectus”; Working Paper 2, “Mapping the Inventory to the SASB Standards”; Working Paper 3, “Scoring Protocol”; and Working Paper 4, “Placebo and Null Arms.”
One disclosure belongs in the body of this piece rather than a footnote. The research and drafting were done with Claude, the AI model made by Anthropic. We chose to do it this way because whether an AI model can analyze its own developer is itself worth knowing. It also creates an obvious risk: output that looks like analysis may be recall of the company’s own self-description, which the model has seen in quantity. We guarded against this in three ways. Every factual claim had to trace to a dated public source. Anything the model could not trace was marked as unsourced in the working paper. And we ran the same method on a fictitious company, to see what it produces with no company-specific information at all. The appendix reports that test, including its limits, and its result is instructive.
The Risks We Think Matter
We identified 15 risks. Table 1 lists them with the fact that makes each material and our prediction of its treatment in the prospectus. We discuss them here in three groups.
Money and Infrastructure
The largest risk is compute. Anthropic has told investors it expects about five gigawatts of computing capacity by the end of 2026 and roughly double that by the end of 2027. According to reporting by The Information, it signed compute agreements totaling about $517 billion in the 11 months to September 2026. They include more than $100 billion to Amazon Web Services over 10 years; a $30 billion commitment to Microsoft Azure; up to a million of Google’s tensor processing units (TPUs), the custom chips Google designs for AI, plus further multi-gigawatt Google and Broadcom capacity from 2027; $50 billion of data centers with Fluidstack; $45 billion with Nscale; a twenty-year lease with TeraWulf; and $15 billion a year to SpaceX through May 2029. Much of the capacity is financed off Anthropic’s balance sheet: more than $71 billion of chip-lease debt sits in special-purpose vehicles, and a $35 billion loan against data-center lease payments carries a Google backstop.
The revenue these commitments serve has grown at extraordinary speed, from about $9 billion annualized at the end of 2025 to more than $65 billion in July 2026. But first-quarter 2026 revenue was about $4.8 billion, and the company told investors its first operating profit, projected for the second quarter, might not last the year. Twenty-year obligations are being set against a revenue history measured in quarters. The telecom build-out of 1996 to 2000 is the cautionary parallel, when capital spending doubled ahead of demand and the sector then lost about $700 billion of market value. The parallel cuts both ways, however, because Anthropic’s current problem is shortage; its outage record and two consumer class actions over usage limits show demand outrunning capacity today. Energy is the physical constraint underneath all of this. Record capacity prices at PJM Interconnection, the operator of the power grid serving 13 mid-Atlantic and Midwestern states and Washington, D.C., have made data-center demand a political issue, and Anthropic has pledged to pay for the grid upgrades its data centers require and to cover consumer price effects.
The second risk is who supplies that compute. Anthropic’s principal suppliers are also its principal investors. Amazon’s investment facility is tied to compute-delivery milestones, and its Anthropic interests are carried at about $190 billion. Google has committed up to $40 billion of investment while supplying TPUs and guaranteeing lease financing. Microsoft and Nvidia invested alongside the Azure commitment. AMD’s equity investment accompanies its chip supply, and Broadcom backs the lease vehicles. The investors book gains on Anthropic’s rising valuation while Anthropic’s spending appears as their cloud revenue. Whatever the commercial logic, this is a concentration of counterparty, pricing, and governance exposure that equity analysts will want to see set out plainly. The third risk is the other side of the ledger: revenue concentration. In 2025, two coding products, Cursor and GitHub Copilot, were reported to account for nearly a quarter of Anthropic’s revenue, and Microsoft is at once a channel, a supplier, an investor, and a competitor.
The last item in this group is not a risk in the usual sense but a disclosure question: how revenue is measured. Anthropic’s growth has been communicated almost entirely through annualized run-rates. A prospectus will present revenue under GAAP, and the reconciliation between the two will matter. So will a less discussed accounting question. When Claude is sold through Amazon’s and Google’s cloud marketplaces, whether Anthropic records the gross sale or only its net share. With investors who are also resellers, the answer affects both reported growth and the reading of the related-party relationships.
Government
Two events in 2026 showed that Anthropic’s access to its own markets depends on executive discretion. On June 12 the U.S. government issued an export-control directive suspending access to Anthropic’s two most capable models, Fable 5 and Mythos 5, by any foreign national. The concern cited was a technique for getting the model to read code and fix software flaws, which is the capability Anthropic sells to cyber defenders. Anthropic disabled both models for all customers to comply. Access was restored on July 1, on conditions that included reporting malicious activity to the government. Nothing was priced and nothing was litigated. Permission was simply withdrawn and then returned. Anthropic advocates strict export controls on AI chips while having contested the control applied to its own models. The two positions are distinguishable in principle, but both coincide with its competitive interest.
The second event is still live. In February Anthropic refused to allow its models to be used for mass domestic surveillance or fully autonomous weapons, and the Department of War designated the company a supply-chain risk. The Secretary stated publicly that no contractor doing business with the military may conduct commercial activity with Anthropic. A federal district court held the designation unlawful in August. On September 25, the day before our cutoff, the D.C. Circuit upheld it by two votes to one. Anthropic reads the designation narrowly, as covering only use of Claude as a direct part of defense contracts. The financial stakes depend almost entirely on which reading prevails, because Anthropic’s largest suppliers are themselves defense contractors. Few disclosures in the prospectus will be read more closely.
Liability and Governance
The liability that has already crystallized concerns training data. Anthropic settled Bartz v. Anthropic for $1.5 billion after the court held that training on lawfully acquired books was fair use but that downloading and keeping pirated copies was not. By August $1.05 billion had been paid. The final $450 million is reported to fall due in September 2027 or 30 days after a “qualifying funding event,” whichever is earlier. An IPO may be such an event, and the filings we reviewed do not define it. The settlement covered past acquisition only. Three music-publisher suits followed. The second relies expressly on evidence surfaced in Bartz and names two of Anthropic’s co-founders personally: Dario Amodei, the company’s chief executive, and Benjamin Mann. At the statutory maximum that suit alone could reach about $3 billion; at the Bartz rate per work it would be about $60 million. A range that wide is the classic condition for disclosing a loss rather than accruing it. Anthropic also indemnifies its business customers against intellectual-property claims arising from their use of Claude, outside its ordinary contractual limit of liability.
The liability that has not crystallized concerns harm from use. We found no wrongful-death or product-liability suit against Anthropic as of our cutoff. The comparators are nonetheless close. Courts in cases against Character.AI and OpenAI have declined at the pleading stage to treat chatbot output as protected speech. Section 230 of the Communications Decency Act of 1996, which shields online platforms from liability for content posted by their users, is widely read as unavailable where the model itself generates the content. Meta’s settlement with state attorneys general over harm to minors, reached with a bipartisan coalition of forty-seven states and the District of Columbia, is worth up to $17.1 billion and mandates age verification. Anthropic received both of the attorneys-general letters sent to AI companies in 2025, which demanded safety testing, recall procedures and warnings. Two further risks sit alongside harm from use. One is misuse: Anthropic has itself disclosed a state-sponsored espionage campaign in which its model did most of the work, and insurers have reportedly balked at covering the laboratories’ exposures. The other is agentic products, which act in customers’ systems, so that a failure takes the form of an action rather than an answer. Anthropic’s contracts cap its liability at a year’s fees, and that cap has never been tested against an agent-caused loss.
Regulation is multiplying quickly. California’s SB 53, which Anthropic endorsed, requires frontier developers to publish safety frameworks and report critical incidents. New York’s RAISE Act imposes a seventy-two-hour reporting clock. The EU AI Act‘s obligations for general-purpose models are now enforceable. Anthropic has given $40 million to Public First Action, a group that backs candidates and a platform favoring transparency legislation. We found no public position from Anthropic on the question that matters most financially: who should bear liability when a model causes harm.
Anthropic’s own safety commitments are a risk in a sense that is unusual for a prospectus. They can require the company to forgo revenue. Its Responsible Scaling Policy can require it to delay or restrict a model. It has withheld its most capable cyber model from general release. Its August risk report disclosed an internal model that it does not plan to release. The policy was also revised in February 2026 in a way that removed an earlier commitment to pause development. Jared Kaplan, a co-founder and Anthropic’s chief science officer, explained that unilateral commitments did not make sense “if competitors are blazing ahead.” Investors will want to know which commitments bind and who can change them.
Finally, governance. The founders are reported to be seeking shares carrying 50.1 percent of the vote on most matters. The seven co-founders own about 2 percent of the company apiece, and the extra votes carry no economic value. Investors have accepted the separation of control from ownership before. Mark Zuckerberg holds 61 percent of Meta’s vote on 13 percent of its economic ownership, and under the registration statement SpaceX filed in May 2026, Elon Musk holds 85.1 percent of its vote. Anthropic goes further in one respect: control is split between founders with small stakes and a Long-Term Benefit Trust with none, which selects a majority of the board. The company is also a public benefit corporation obliged to balance its mission against shareholder returns. SaferAI, a nonprofit that rates the risk management of AI developers, found in July 2026 that Anthropic has a designated Responsible Scaling Officer but no central risk function and no management-level risk committee. The banking parallel is instructive. Banks also depend on models they build themselves, and large banks must have an independent chief risk officer reporting to a board risk committee. Anthropic faces no such requirement and has no such structure.
What We Expect the Prospectus to Say
Our predictions for all 15 risks are in Table 1. The pattern is what matters. We expect the prospectus to be specific wherever the law or the facts leave no choice. The copyright litigation will be described in detail, because pending legal proceedings must be. The June export suspension will be described as an event, because describing it as a possibility would invite the Facebook problem. The founder share class, the Trust and the public-benefit structure will be set out at length, because governance of that kind must be. The Pentagon designation will be disclosed, but we expect it to be read narrowly. Regulation will get extensive and accurate treatment.
We expect the prospectus to be least specific where the company has discretion and the stakes are highest. The compute commitments will appear in the contractual-obligations table as numbers. The risk around them will be framed as needing more capacity, not as having committed to too much. The supplier-investor relationships will appear as related-party transactions, as they must, without being characterized as a concentration of risk. Customer concentration will be anonymized. Harm from use and misuse will be described in general terms, with insurance limits unquantified. We do not expect the company to state a position on liability allocation. Nor do we expect it to quantify the revenue its safety commitments have cost it, or to say whether the offering accelerates the final Bartz payment.
We also expect the prospectus to give heavy weight to risks our analysis did not rank highly. These are competition among frontier laboratories, commoditization by open-weight models, the rapid obsolescence of each model generation, dependence on key personnel, and the security of model weights and source code (Table 2). We say so now so that their prominence is not mistaken for a miss on our part. Our industry analogies were chosen to surface liability, reliance and control risks, and we knew from the start that they would not generate commercial ones. As the next section shows, that boundary also cost us two risks that belong among the most important.
When the prospectus is public we will compare it against this piece and report what we got right, what we got wrong, and what the filing told us that public information could not. For anyone who wants to make that comparison systematically, Working Paper 3 provides a scoring protocol. We will also return to the question we have deliberately set aside here: what these risks are worth in dollars. That analysis is better done with the audited numbers in hand.
What a Domain Expert Added
The industry analogies were Shiva’s idea. Bob then built the list out with Claude under the process described above. When the 15 risks, the predictions and the working papers were finished, Shiva read the result as what he is, an accounting professor who reads financial statements for a living, and wrote down 10 risks of his own. Table 3 sets them against ours. We present them separately, and leave Table 1 as it was, because the point of this section is to show what a domain expert added after a machine-assisted process had run its course. The working papers predate his review and are unchanged.
Two of his items are the most important thing our process missed, and they are not details. The first is unit economics: whether the price of a token falls faster than the cost of serving it. It combines his first item, cheap Chinese models, and his fourth, token costs that are not falling fast enough for mass adoption. In September 2026, published price lists showed DeepSeek’s V4 Pro at $0.24 per million input tokens and $0.69 per million output tokens, against $2 and $10 for Claude Sonnet 5, Anthropic’s mid-tier model. On the cost side, Anthropic was reported early this year to have cut its 2025 gross-margin projection to 40 percent, with inference costs running above plan. Those facts were in our own source register, and we did not turn them into a risk. Unit economics is arguably the most important driver of Anthropic’s value after the compute commitments, and it is the mechanism that would turn those commitments into losses. Table 2 declared price competition out of scope because our analogies were not built to find commercial risks. We now think that was a convenient way of excusing a gap rather than a principled boundary.
The second is stock-based compensation. The large charge at an IPO does not come from revaluing awards at the offering price; under US accounting they are valued when granted. It comes from restricted stock units that vest only on a liquidity event. Until the event occurs no expense is recognized, so years of accumulated compensation cost land in the first public quarter. Facebook is the precedent. In the quarter of its 2012 offering it recognized $1.3 billion of share-based compensation and related payroll taxes and reported a GAAP net loss of $157 million. Whether Anthropic’s awards are structured this way is not public, and the prospectus will say. We predict a specific, quantified disclosure, a large GAAP loss in the first reported quarter, and dilution that analysts will need to model.
Three of Shiva’s items, years without profit, perpetual cash burn ,and the compensation charge, are one risk seen from different sides—the price of patience. Amazon is the obvious precedent, and the instructive thing about it is that it is the same issue in a very different economic environment. Jeff Bezos told shareholders in his 1997 letter that when forced to choose between “optimizing the appearance of our GAAP accounting and maximizing the present value of future cash flows, we’ll take the cash flows.” Investors accepted that, and the capital to act on it was cheap. In January 1999 Amazon raised $1.25 billion in convertible notes paying 4.75 percent. Much of its pay took the form of options, which until 2006 did not have to be expensed. Interest rates stayed low for most of the two decades that followed.
Anthropic is asking for the same patience on a far larger scale and at a far higher price. The junior tranche of its chip-lease debt, which lacks a Broadcom guarantee, was reported in August to trade at about 8.5 percent. Its commitments run to hundreds of billions of dollars, not $1.25 billion, and its compensation cost will be visible from the first quarter. We add a prediction: the prospectus will include a letter from the founders, in the Amazon tradition, asking investors to judge the company over the long term. What the letter will not settle is whether investors will extend Amazon’s patience at today’s cost of capital. We read items (vi) and (vii) as part of risk 1, which should be understood as the compute commitments and their financing.
Shiva’s point about distribution sharpens one of ours. We said that Microsoft is at once channel, supplier, investor, and competitor. He says that Microsoft controls access to corporate customers and Google to individual ones, so the customer relationship is owned by gatekeepers who compete with Anthropic. That is the better sentence.
He also raised a question we had not asked. The leaders of the frontier laboratories, Amodei among them, describe the risks of AI in near-apocalyptic terms. Is that an attempt to become too big to fail? We cannot know the motive and do not speculate about it. The effect is easier to see, and it bears on misuse (risk 11). When a company says publicly and repeatedly that its products could contribute to catastrophic harm, it establishes that the harm was foreseeable, which is the element a plaintiff most needs and an insurer most prices. Tobacco’s liability rested on internal documents showing that the companies knew what they denied in public. Here the knowledge is published. Insurers have already reportedly balked at covering the laboratories’ largest exposures. The likelier outcome is not too big to fail but too big to insure, in which the company retains the tail risk itself or, in the extreme, the government does.
The rest of his list adds less. Data-center delays, years of losses and the public benefit corporation are in our fifteen. Key-person risk is in Table 2; Amodei has himself written about surviving early-stage cancer, and we expect the prospectus to name the founders as key persons without reference to health. Nationalization abroad does not survive contact with the facts, since Anthropic has little outside the United States to take. The realistic versions are U.S. compulsion and foreign market-access rules, which are tails of risks 6 and 7.
The pattern is the finding. Shiva’s list is an investor’s and an accountant’s list: the income statement, the cash-flow statement, dilution, and competition. Ours is a liability, regulation, and governance list. His items came quickly from expertise; ours came from a heavy, sourced process. His list will probably predict the prospectus’s own risk factors better than ours, because counsel and bankers think in his categories. Ours is better at identifying what the prospectus will underplay. Nine industry analogies, a disciplined sourcing process and an AI model with the relevant facts in its own register did not produce the two risks an accountant produced by reading the result. The honest description is not that the human refined the machine’s work at the margin. The machine-assisted process was thorough within the frame it was given, and the human saw outside the frame, in the direction that matters most to an equity investor.
Methodological Appendix
Sources and Cutoff
Every factual claim in this piece and in the working papers rests on a source that was public and dated on or before September 26, 2026. The sources are listed in a register of 151 entries in Working Paper 1 each giving the claim, the source, the URL, the publication date and the type of source: company statement, regulatory filing, court document, government source, press report ,or analyst estimate. As of the cutoff, Anthropic’s public registration statement had not appeared on EDGAR; the company had announced a confidential submission on June 1. Press-reported figures, especially revenue run-rates and the aggregate of compute commitments, are not audited, and we treat them as such.
The Industry Analogies
We chose nine industries which we then organized into three groups. The first group concerns harm and liability arising from use: tobacco, asbestos, pharmaceuticals, and social media. The second concerns reliance, intermediation, and the contractual allocation of liability: credit rating agencies, enterprise software and telecommunications. The third concerns systemic exposure and control regimes: banking and semiconductors. For each industry we identified the structural feature doing the work: tobacco’s internal knowledge and warnings, asbestos’s indeterminate and ultimately uninsurable tail, pharmaceuticals’ regime of pre-approval testing and post-market surveillance, social media’s erosion of intermediary immunity, the rating agencies’ conflicted payment model, enterprise software’s contractual allocation of implementation failure, telecom’s capacity glut and common-carrier obligations, banking’s independent risk function, and semiconductors’ concentration and export controls. We then asked what each feature implied for Anthropic, and we kept only risks we could anchor in current public facts. Table A1 lists the industries and what each contributed. The analogies are generative, not probative. None of them is an argument that AI is like tobacco or asbestos. Their value is that they surface questions a reader of the company’s own materials would not think to ask.
The analogies produced overlapping risks, which we consolidated into the fifteen in Table 1. Where several industries arrived at the same risk by different routes, we treated the convergence as evidence that the risk was real rather than an artifact of any one analogy. The copyright exposure is the clearest case. It was reached separately through tobacco (what executives knew), asbestos (the reuse of evidence by successive plaintiffs) and social media (discovery), and all three routes are visible in the second music-publisher complaint.
The SASB Comparison
We deliberately did not consult the SASB standards until the list was complete, so that the existing catalog would not shape it. SASB identifies the sustainability issues likely to be financially material in each industry. It was never meant to identify every material issue, and competition, financing, customer concentration and accounting are deliberately outside it. So we asked two questions of each risk, including Shiva’s two additions. Is it a sustainability issue in SASB’s own terms, falling within one of its twenty-six general issue categories? And if so, is it a disclosure topic in the standard for Software & IT Services, the industry to which Anthropic would be assigned? Of the 17 risks, seven are clearly sustainability issues, three are partly so, and seven are not. The seven that are not (the compute commitments, the supplier-investors, customer concentration, revenue measurement, the IP indemnity, unit economics and stock compensation) are outside SASB’s scope by design, and they include the largest risks in dollar terms. Of the 10 that are sustainability issues, only one, energy and data-center infrastructure, is a topic in the Software & IT Services standard. Four more fit only with strain. The other five, among them harm from use, misuse, frontier-AI regulation, and the cost of safety-driven restraint, sit squarely within SASB’s remit and are absent from the standard that would apply. They are product-safety risks of a kind the standards handle in pharmaceuticals, tobacco, and consumer goods but not in technology. The finding is timely. In July 2026 the International Sustainability Standards Board decided to revise all six SASB technology standards, with the effects of artificial intelligence named as an emerging issue. Working Paper 2 maps the original 15 risks topic by topic; the two-question frame used here is a refinement of it.
Working with Anthropic’s Own Model
The research, drafting, and source-gathering were done with Claude, working under our direction. The model had no non-public information about Anthropic. Because it was trained on a large volume of Anthropic’s published self-description, we required every factual claim to trace to a retrieved and dated source. Any claim it could not trace was marked in line as unsourced, and Working Paper 1 shows those markings. The risks most exposed to this problem are the ones that depend on Anthropic’s descriptions of its own safety governance, and we have flagged them there. A separate instance of the model, which had not taken part in producing the inventory, checked every cited claim against the source register and re-fetched the highest-stakes sources; its corrections were made before publication.
We also tested what the method produces when the company-specific information is thin or absent. These tests were run inside our working session with Claude, not in separate conversations. Claude launched each as a sub-agent that began with an empty context: the sub-agent could not see our conversation, the Anthropic inventory or the purpose of the test, and it received only the brief used for Anthropic with the company name changed. But the briefs were written, and the results interpreted, by the same session that produced the Anthropic analysis. The tests are therefore not independent of us, and they should be read as a check on the method rather than a controlled experiment.
The first test used Safe Superintelligence, a thinly documented laboratory. By September 2026 it had enough public substance, including a large Nvidia investment in July, to yield a real analysis, so it could not serve as a placebo. The second used a fictitious laboratory whose name returned no match in any search. The model invented no facts about the fictitious company; t stated at the outset that no public record existed. But the method still produced a fourteen-item inventory of risks for frontier laboratories as a class, and that inventory reproduced eight of our 15 Anthropic risks in full and three in part. We draw a clear lesson. Much of what an analysis like ours says about Anthropic would be said about any frontier laboratory.
The company-specific value lies in four risks the generic inventory did not produce (customer concentration, the Pentagon designation, energy, and revenue measurement) and in the evidence attached to every risk. That evidence includes the Bartz payment terms, the June suspension, the supplier-investor web and the founders’ proposed share class. It is also where our predictions should be judged. A further caution; the model’s picture of frontier-laboratory risk in general was learned substantially from Anthropic’s own public record, so agreement at the generic level proves little. The generic run retrieved the April 2026 revision of bank supervisors’ model-risk guidance, which excludes generative and agentic AI and which our own inventory had initially missed and has since corrected. Working Paper 4 reports both tests.
Limitations
The main limitations are four. First, the figures are press-reported rather than audited, and some sources conflict; the register records the conflicts. Second, the analogy set was chosen for liability and control risks, and it under-represents commercial and accounting risk by design; the section on what a domain expert added shows what that cost. Third, the placebo and null tests were run once each, from within our own working session, by the same model; they are suggestive rather than conclusive. Fourth, a stronger version of those tests would be run in a separate conversation by someone other than us, and with web search disabled.