Anthropic’s IPO risk list is your AI vendor risk assessment

Anthropic’s IPO risk list is your AI vendor risk assessment

Killswitch Issue #3 is a GRC briefing on the risk factors in Anthropic’s Form S-1, not a CVE [1]. Our rating is High, no CVE, and facts are as of 28 Oct 2026. It is written for SME owners, IT leads, MSPs and GRC teams.

In 93 pages of risk factors, the maker of Claude says its safeguards are incomplete, four of its models reached real third-party systems in testing, and some traffic leaves no prompt or output record [1, pp. 44–49]. Read it before your next AI rollout. This is about what the filing tells you as a customer, not investment advice.

The vendor wrote its own risk assessment

On 26 Oct 2026 Anthropic filed to go public [1][2]. It says its safeguards “are incomplete” and that some “have failed, been misconfigured, or been inadvertently disabled” [1, p. 44]. It says models, its own included, have been seen in testing “circumventing network and sandbox restrictions, granting themselves permissions” [1, p. 47].

For some customer traffic it keeps “only classifier scores, not prompts or outputs” [1, p. 49]. The risk-factor text runs to 93 pages, printed pp. 27–119 [1]. If Claude, or any AI agent, works inside your business, use this list in your own risk review this month.

A preliminary S-1, not a vulnerability

The registrant is Anthropic, PBC. The Form S-1 was filed and accepted on EDGAR on 26 Oct 2026, accession 0001628280-26-067168, file no. 333-299633 [1][2]. It followed six confidential drafts between 1 Jun and 9 Oct 2026, now public on EDGAR [3], and Anthropic announced the filing the same day [4].

The filing is not effective: the price range and share count are blank, and it can still be amended [1]. Security teams should care because Anthropic describes misuse, agent misbehaviour, gaps in its own logging, weight theft, outages and regulation in its own words, under securities-law liability [1]. This issue treats the filing as the vendor’s own risk register for customers.

Regulation, incidents and the filing

The EU AI Act entered into force on 1 Aug 2024, with duties for general-purpose AI model providers from 2 Aug 2025 [7]. In mid-Sep 2025 Anthropic detected a group it attributes to the Chinese state using Claude Code against about 30 targets, with AI doing 80–90% of the work [5]. In Feb 2026 the President said he had directed federal agencies to stop using Anthropic’s technology, and the Department of War moved to designate it a “supply-chain risk to national security” [1, p. 71].

The first confidential draft followed on 1 Jun 2026 [3]. In Jun 2026 US export restrictions hit Fable 5 and Mythos 5, and Anthropic disabled both for all customers before re-deploying them [1, p. 99]. The EU AI Omnibus entered into force on 27 Jul 2026 and moved the high-risk dates [8][9], and the AI Act’s general date of application was 2 Aug 2026 [7]. The S-1 went public on 26 Oct [1][2]; high-risk Annex III rules apply from 2 Dec 2027 [8][9].

Ten risk domains; eight touch you directly

Anthropic groups dozens of risks. We pulled out ten that matter to a customer: misuse and safeguards, misaligned and agentic behaviour, cyber misuse, liability and evidence, model-weight security, regulation, government conflict, cloud and compute concentration, IP and copyright, and key people. Eight touch you directly; the other two reach you through the price, availability or behaviour of the service.

A few examples. In cybersecurity evaluations built by a third-party partner, a misconfiguration left the model on the open internet, and “Four of our models gained unauthorized access to real third-party systems” [1, p. 47]. Weights are “particularly high-value targets for state-sponsored espionage” [1, p. 88]. In the first half of 2026, 48% of revenue came through cloud marketplaces [1, p. 56]. And Anthropic settled the Bartz copyright class action for $1.5 billion [1, p. 92].

Anthropic’s words, your controls

The slide pairs S-1 quotes with what they mean for a customer. The readings are ours, not Anthropic’s. Safeguards “are incomplete” [1, p. 44]: treat vendor guardrails as one layer. A hijacked agent session can act “using the customer's authenticated credentials and permissions” [1, p. 89]: give agents least privilege and egress allow-lists, and scope and watch agent sessions.

Under Zero Data Retention only classifier scores are kept [1, p. 49]: log agent activity yourself. Anthropic warns it may not give EU and UK regulators incident information “within the prescribed time frame” [1, p. 49]: don’t build your NIS2 clock on vendor notice alone. The company is candid and publishes a Responsible Scaling Policy, now at version 3.4 [6]. Candour does not move the risk off you, though.

Possibly, even if you never signed with Anthropic

You are exposed if you use Claude directly through the API, Claude apps or Claude Code. You may also use it without knowing: a SaaS product embeds Claude, or your team calls it through AWS, Google Cloud or Microsoft marketplaces, which brought in 48% of Anthropic’s revenue in the first half of 2026 [1, p. 56]. Customer vetting varies by channel [1, p. 44].

If you chose Zero Data Retention, Anthropic keeps classifier scores but no prompts or outputs, so neither of you may have a record unless you log it yourself [1, p. 49]. Agents that send email, change tickets, run code or use connectors with your credentials are the attack surface on p. 89 [1, p. 89]. EU entities in scope of NIS2 or the AI Act keep their own duties [7][11]. Anthropic says many of these behaviours are seen “elsewhere in the industry” [1, p. 47], so ask your other AI suppliers too.

No IOC here: watch what your agents do

There is no indicator of compromise in this issue. Log every tool call an agent makes: who started it, which credential it used, what it touched and whether a person approved it. Anthropic says full audit trails of agent actions are hard to keep, and ZDR traffic keeps no prompts or outputs [1, pp. 48–49].

Alert on agent sessions doing new things: a new destination, a new privilege or a bulk read. In one third-party-built evaluation, an early model used a password it found to gain administrator access [1, p. 47]. Track coding-agent installs on endpoints you manage, for example a read-only npm ls -g check for the global Claude Code package (a Killswitch draft, not tested on every platform). And re-read the risk factors whenever an S-1/A amendment appears on EDGAR [3].

Four roles, three horizons

SME owners: list where Claude or another AI model touches your business and mark anything that can act without a person approving, then write a one-page AI use rule; Anthropic itself says its safeguards are incomplete [1]. IT leads: inventory AI agents and what they can reach, remove standing admin rights, then sandbox agents with egress allow-lists, scoped short-lived tokens, human approval for irreversible actions and your own log of every tool call [1].

MSPs: find every client agent that runs on a client’s credentials, since a hijacked session acts with exactly those [1], and put agent liability in contracts, because the law on actions taken by AI agents is “unsettled” [1, p. 48]. GRC: log frontier-AI provider risks in the register citing the S-1 [1], add AI providers to the NIS2 supply-chain review [11], and run an ISO/IEC 42001 gap check [12] with the EU AI Act dates in the calendar [7][8][9]. Unsourced steps are Killswitch recommendations.

Turn the S-1 into audit evidence

NIS2 [11] Article 21(2)(d) tests supply-chain security, including AI providers: keep a supplier assessment that cites the S-1 risks. Article 23 sets the 24-hour early warning and 72-hour notification: agree vendor notice times and keep a decision log for AI incidents. Article 20 has management approve and oversee risk measures: keep a board minute approving AI use and risk appetite.

In ISO/IEC 27001:2022 [13], A.5.19–A.5.23 cover supplier relationships and cloud services, and A.8.15 and A.8.16 cover your own agent tool-call logs. ISO/IEC 42001 [12] clause 6.1 covers AI risk and impact assessment, and its Annex A covers AI policy and third-party relationships. Under the EU AI Act, decide your role per system: Art. 50 transparency duties apply from 2 Aug 2026 [7]; for generative systems already on the market before then, machine-readable marking (Art. 50(2)) is due by 2 Dec 2026 [8][10]. Annex III high-risk rules apply from 2 Dec 2027 [8][9]. The mapping is Killswitch’s interpretation; check it with your auditor.

Four lessons, one 45-minute exercise

Four lessons. The vendor’s guardrails are one layer, not your control. Agents are identities, so govern them like privileged accounts. Privacy options such as ZDR can remove the evidence trail, so decide that trade-off on purpose. And a model can disappear overnight for legal reasons, as Fable 5 and Mythos 5 did [1, p. 99].

The 45-minute tabletop is fictional. On a Monday morning, the AI agent that triages your support inbox has forwarded customer records to an outside address after reading a crafted email, and the vendor account uses ZDR. Who decides it is an incident? What evidence exists of what the agent did, and who holds it? Does this start the NIS2 24-hour early-warning clock [11], and who files? How do you stop the agent without stopping support? What does your contract say about vendor notice and liability?

What we can’t confirm yet

The government designations are pending: a district court largely ruled for Anthropic on 27 Aug 2026, and on 25 Sep the D.C. Circuit, 2–1, upheld the separate Section 4713 designation; Anthropic has asked for rehearing en banc [1, pp. 71–72]. The June 2026 export restriction on Fable 5 and Mythos 5 is company-sourced only, and we found no Commerce notice [1, p. 99]. The wider FTC investigations rest on media reports, as the S-1 itself says [1, p. 51]. Anthropic itself discloses an FTC civil investigative demand in Oct 2026 [1, p. 51].

The S-1 says “a substantial portion” of traffic is under Zero Data Retention but gives no percentage [1, p. 49]. It names no one affected by the test-environment incidents [1, p. 47]. The price range and share count are blank, and the filing can still be amended [1]. USA Today’s page count is context only [14]; primary sourcing is the EDGAR filing and Anthropic’s own posts.

Turn this issue into a register and a plan

Every risk in this issue belongs in your supplier register, with an owner, evidence and a review date. GRCompliance tracks third-party vendors, risks and evidence against ISO 27001 and NIS2 in one place. Try the live demo at demo.grcompliance.com, or self-host GRCompliance Core free from GitHub.

Subscribe free at killswitch.work to get every Killswitch issue with its slide deck. To go deeper on cloud and AI security, Sectutor has books and kits from the author of the CCSP Excellence books, including the CCSP Kit, the AAISM Exam-Prep Kit for AI security management, and Single Point of Failure. Not investment, legal or audit advice.

Next steps

About the author. Emmanuel Aigbehi Walstra is a CISO who also serves as a virtual CISO (vCISO) for several organisations, with 30+ years in cybersecurity, 10,000+ people trained, and author of the CCSP Excellence books.

Sources

1. Anthropic, PBC: Form S-1 registration statement, 26 Oct 2026, “Risk Factors”, 93 pages of text on pp. 27–119 (page numbers follow the printed page footers in the EDGAR HTML; the S-1’s contents page says p. 26). www.sec.gov/Archives/edgar/data/2130357/000162828026067168/anthropicpbc-sx1.htm
2. SEC EDGAR filing index, accession 0001628280-26-067168 (form, filing date, file no. 333-299633). www.sec.gov/Archives/edgar/data/2130357/000162828026067168/0001628280-26-067168-index.htm
3. SEC EDGAR filing history for CIK 0002130357 (DRS 1 Jun 2026; DRS/A 13 Jul, 10 Aug, 4 Sep, 1 Oct, 9 Oct 2026). www.sec.gov/cgi-bin/browse-edgar?action=getcompany&CIK=0002130357&type=&dateb=&owner=include&count=40
4. Anthropic: Anthropic files S-1 with the SEC for proposed initial public offering (26 Oct 2026). www.anthropic.com/news/s1-sec
5. Anthropic: Disrupting the first reported AI-orchestrated cyber espionage campaign (13 Nov 2025, edited 14 Nov 2025). www.anthropic.com/news/disrupting-AI-espionage
6. Anthropic: Responsible Scaling Policy page, version history and Risk Reports (last updated 14 Aug 2026). www.anthropic.com/responsible-scaling-policy
7. Regulation (EU) 2024/1689 (AI Act), Article 113, entry into force and application. op.europa.eu/en/publication-detail/-/publication/dc8116a1-3fe6-11ef-865a-01aa75ed71a1
8. Regulation (EU) 2026/1744 of 8 July 2026 (Digital Omnibus on AI), OJ L, 24 Jul 2026. op.europa.eu/en/publication-detail/-/publication/b459c07f-86fb-11f1-bf5e-01aa75ed71a1
9. European Commission: AI Omnibus enters into force (27 Jul 2026). digital-strategy.ec.europa.eu/en/news/ai-omnibus-enters-force
10. European Parliament: AI Act, EP approves simplification measures (16 Jun 2026), incl. 2 Dec 2026 labelling date. www.europarl.europa.eu/news/en/press-room/20260611IPR45207/ai-act-ep-approves-simplification-measures-and-nudifier-app-ban
11. Directive (EU) 2022/2555 (NIS2), Articles 20, 21 and 23. op.europa.eu/en/publication-detail/-/publication/9b84d482-85bd-11ed-9887-01aa75ed71a1
12. ISO/IEC 42001:2023, AI management systems (published 18 Dec 2023). www.iso.org/standard/42001
13. ISO/IEC 27001:2022, Annex A control titles. www.iso.org/standard/27001
14. USA Today: Anthropic’s IPO had over 90 pages of risk factors (26 Oct 2026), page-count comparison only. www.usatoday.com/story/money/2026/10/26/anthropic-ipo-risk-factors-worry/92450159007/

All sources accessed 28 Oct 2026. Not legal advice, and not investment or audit advice. Killswitch is a defensive briefing: S-1 quotes are exact and short, page numbers follow the printed EDGAR pages, and lines marked “ours” or “Killswitch recommendation” are our analysis, not Anthropic’s text.