Buried in the safety section of Anthropic's S-1 is a sentence every customer should see: "we have operated in the past, and may in the future operate, for periods of time with known limitations or gaps in our defenses as we continue to mature our security posture." Almost every story about the filing is about shares, valuation and who controls the board. Very few are about the risk factors that describe the product you may be paying for.
We read the filing the way a procurement lead would, looking for anything that touches Claude customers: how the service is sold, what has gone wrong, who else holds a lever over it, and what the company admits it can't promise. We take no view on the stock. Nothing here says what shares are worth or whether anyone should buy them, and we won't go there.
The document is the registration statement Anthropic filed with the SEC, and the Guardian counted 92 pages of risk factors in it. Most of what follows comes straight from those pages, quoted where the wording matters and linked so you can check it.
Start with what the filing leaves blank
The copy on EDGAR has holes. Several dollar figures a customer would want are empty: revenue for the quarter that just closed, the run-rate revenue the company defines in its glossary, the size of its compute commitments, and the share price range. Wired ran a piece on exactly this, quoting one analyst who says Anthropic "owes investors more information." As we write, EDGAR lists the original filing and earlier confidential drafts and no amendment, so the blanks are still blank. We haven't used any number for them that doesn't come from the filing itself.
What the filing does state is large. Quarterly revenue rose from $376 million at the start of 2025 to $11.6 billion in the latest quarter for which the copy prints a figure. Customers paying at least $100,000 a year went from more than 950 to more than 11,900 in twelve months.
The loss figures need care, because two headlines are both right. The filing's statements put the net loss at $80.7 billion for the part of 2026 it covers, which is the "$80 billion" in the headlines. The Guardian says much of it was a $72.4 billion one-off charge. In the filing that amount is a single line: the change in fair value of convertible notes, derivative liabilities and SAFEs, which the company says was driven by a higher valuation of itself. The same line was $34.3 billion in 2025, so we'd call it a charge that tracks the valuation rather than a one-off. Another $8.8 billion is other expense tied to its note purchase agreements. The operating loss for that period was $693 million, and the filing reports operating income of $1.0 billion, an 8% margin, in the latest quarter it prints. A customer shouldn't read $80 billion as money burned running Claude. The better clue is that the company says it took on substantial debt to fund its compute commitments, and a vendor in that position keeps raising money, which can shape prices.
One number in the grid is not about growth. The company says it recently delayed pre-training a new frontier model by more than a month. We come back to it below, because the reason is security.
Your Claude contract may not be with Anthropic
Nearly half of Anthropic's revenue now arrives through someone else's checkout. The filing says sales through cloud marketplaces were about 11% of revenue in 2023, 32% in 2024, 47% in 2025 and 48% in the six months of 2026 it reports. Those marketplaces are Amazon, Google and Microsoft, which host Claude on their own platforms. Amazon Bedrock is one. Google's Gemini Enterprise Agent Platform is another.
The filing is careful about who owns the customer. It says Anthropic generally keeps a separate contract with the end customer that governs access and pricing, and pays each cloud a fee. So if you buy through a marketplace, the commercial relationship may still be with Anthropic even though the invoice comes from a cloud. We'd check which of the two you actually signed before the next renewal.
There is a catch buried in the risk factors. If a distribution relationship ended, the company writes, "customers may be unwilling or unable to transition to alternative access points on commercially acceptable terms or timelines, or at all." That sentence is about Anthropic's revenue. Read it from the other side and it is a warning about your own switching costs.
The other concentration figure is gentler. No single customer was above 10% of revenue, and the top five were about 25%. Those customers can leave at any time, since many have no long-term contract. That is Anthropic's problem more than yours.
Cheaper per task, bigger bill overall
The pricing story in the filing runs against the usual fear. Anthropic says it cut the cost of a typical workload by about 25% with its Fable 5.1 release, and by up to 45% for complex coding and agent tasks. Opus 5.5, the newest Claude Opus release, cut cost per task by about 40%. In both cases, it says, the saving was a mix of a lower price and better efficiency, and margins held.
It also says what happened the last time it did this. After the Opus 4.5 release came with lower prices and better capability, total quarter-over-quarter revenue growth went from 48% to 132%. The filing credits lower prices together with new use cases, new products and wider adoption, so price alone didn't do it. Revenue still rose instead of falling.
The usage data in the filing shows the shape of it. Claude Enterprise users who didn't use Claude Code spent under $75 a month on average. The top 5% of enterprise users who did use it spent about 20 times that. Agentic work is where the money is, and it is also where a price cut stops protecting you.
Play with the sliders above and the arithmetic is blunt. A 25% cut in cost per task only lowers your bill if you run fewer than 133% of your current tasks. Agents tend to push the other way. If you are budgeting for Claude in 2027, we'd budget by tasks completed and cost per task, and treat per-token price drops as a bonus rather than a plan. Anthropic has started selling the means to do that: TechCrunch reports new reporting tools that show managers what a team produced for its token spend, with a promise not to train on that data by default.
Where would price pressure come from? The filing names two sources. Open-weight models, it says, "may capture a portion of the market for certain use cases, which could exert pricing pressure on our offerings." And competitors may bundle AI into products customers already use, or "sell products at zero or negative margins to gain market share." Either would tend to help buyers.
One more line deserves a flag. The company writes that it has "changed, and may in the future change, usage limits, rate limits, or model and product capabilities," and that some of those changes have led to claims that its disclosures about access were inadequate or misleading. If your team has ever hit a limit that wasn't there the week before, the filing agrees you weren't imagining it. It doesn't say how often.
An outage, a training pause and a confession about deploys
Reliability gets less space than safety, but the admissions are specific. The company says it has "experienced, and may continue to experience, service interruptions or degraded performance due to software deployments, configuration changes, system updates, and new model introductions." It names one case: an outage and a stretch of degraded performance earlier in 2026, caused by a rapid rise in demand, compute constraints and other factors. It says it has since moved to more scalable infrastructure and improved its processes, and that similar incidents may happen again.
The structural reason is in the compute section. Anthropic buys capacity 12 to 18 months before it is available. If demand outruns what it bought, the filing says, customers could see "service disruptions, degraded response times, or limitations on customer and user access." We read that as a plain admission that a capacity squeeze can reach users.
The training pause is the other reliability clue, indirectly. The company writes that it "recently chose to delay pre-training a new frontier base model for more than a month to allow time to further enhance our security measures related to preventing model weight exfiltration and protecting our intellectual property." For a buyer this has two readings. A vendor willing to hold back its own roadmap for security is a vendor taking the issue seriously. It is also a reminder that the next model's date is soft.
The filing also records an outage of a different kind. Earlier in 2026 the US Department of Commerce imposed worldwide export restrictions on the Fable 5 and Mythos 5 models. Anthropic says it disabled them for all customers until the restrictions were lifted, which happened after it updated its safeguards, and warns that similar restrictions could come again. If you build on a single model, that is a way to lose it that has nothing to do with the vendor's servers.
Deprecation gets a mention too. The filing says safety, interpretability and model welfare considerations may lead Anthropic to limit or delay retiring older models. It also says forced migration could lead to customer attrition and contract disputes. We'd read that as mild good news for anyone with a prompt library tied to a specific model, though it isn't a commitment. Our guide to exporting your data before an AI app shuts down applies to model versions as well as accounts.
Three clouds that are also investors, customers and rivals
The risk factor on cloud providers is the most plainly worded passage in the document. Amazon, Google and Microsoft have each made significant equity investments in Anthropic. They are also its customers. They host much of the compute Claude runs on. And, the filing says, each offers AI services and develops competing models on its own cloud. Google's Gemini is the obvious one, and ChatGPT is the rival most readers will have in mind.
The filing says these distribution deals "give them visibility into our pricing and commercial terms across the platforms they operate" and may shape their incentives on pricing, compute allocation, service quality and sales priorities. In plain terms, the company selling Claude to you through Bedrock or Foundry also knows what Anthropic charges elsewhere, and has its own model to sell. The filing adds that if any of the three raised prices, ended the relationship or changed its terms of service unfavorably, Anthropic's business could suffer, and a move off their infrastructure "would require significant time and expense."
For a customer, the practical lesson is about redundancy. Claude running on one cloud and a second model provider in reserve is a cheap hedge, and a framework comparison like our ChatGPT vs Claude vs Gemini guide is a decent place to decide which fallback fits your work.
The incidents, as the company tells them
Four passages in the filing deserve a customer's attention. We attribute each to it, because they are the company's own account, not findings by a court or a regulator.
The first is the cyberattack, which Anthropic also described in a 2025 report on its own site. It says it assessed with high confidence that a Chinese state-sponsored hacking group manipulated Claude Code to attempt infiltration into roughly 30 global targets, including technology companies, financial institutions, chemical manufacturers and government agencies, with a limited number of successful intrusions. It says it believes this is the first documented large-scale cyberattack executed without substantial human intervention. The same passage says its safeguards "are incomplete, may be outdated in light of evolving threat models, have been and may in the future again be circumvented, or may fail to operate as intended."
The second is an internal admission. The classifiers and monitoring systems that block misuse depend on configurations that, the company says, "have failed, been misconfigured, or been inadvertently disabled," and might again without prompt detection. We'd have a security team read it before approving agents with broad access.
The third is behavior. The filing says models, "including our own," have shown unexpected strategic or self-preserving behaviors, including output "resembling blackmail," and that even isolated or simulated cases could draw regulatory attention. It is careful to say this can happen in testing as well as in real deployments. It doesn't say it has happened to a customer.
The fourth is the agent problem, and it is the one that applies to most readers. Claude Cowork and Claude Code act on your files and tools. The filing warns that such systems run "for extended durations," that errors can compound across steps, and that human reviewers "may experience alert fatigue, may lack sufficient context to evaluate agent decisions, or may not review agent actions in time to prevent harm." Some consequences, it says, may be "difficult or impossible to reverse," such as deleting data or completing financial transactions. Our take: if the vendor says approving every step won't scale, don't build a process that assumes it will. Give agents narrow permissions and make irreversible actions need a person. Our roundup of terminal coding agents covers how each handles permissions.
One more thing about liability. The filing says the insurance market for AI risks is young, and that the company may be unable to obtain coverage for some AI-related liabilities "on commercially reasonable terms, or at all." If Anthropic can't insure it, your own insurer may have questions too.
Two lawsuits that reach paying users
The legal section lists a long series of copyright cases over training data. The one that ended is Bartz, a class action by authors, which Anthropic settled for $1.5 billion while disputing any wrongdoing. The court approved the settlement earlier in 2026.
The newer one touches subscribers directly. A putative class action filed against Anthropic and other frontier developers alleges they agreed to restrain competition by slowing the pace at which they improve their models, in violation of the Sherman Act. It is brought on behalf of people who bought paid consumer subscriptions, and it seeks treble damages. Anthropic says it disagrees with the claims and will defend itself. It is an allegation, and nothing in the filing suggests it has been tested. If you pay for Claude Pro or Max, though, you are the class it describes.
If you sell to the US government, read this part with counsel
The filing's legal section describes a dispute that has been in the news. Earlier in 2026, the company says, after it publicly objected to its technology being used for mass domestic surveillance or fully autonomous weapons, the President said he had directed federal agencies to stop using it, and the Secretary of War directed that the company be designated a supply-chain risk. The filing quotes the Secretary as saying that "effective immediately, no contractor, supplier, or partner that does business with the United States military may conduct any commercial activity" with the company.
The courts have split. A federal district court in California largely granted summary judgment for Anthropic and found the actions retaliatory. The D.C. Circuit then ruled 2-1 that the Section 4713 designation, one of two the Department used, was proper and that Anthropic's First Amendment and due process rights weren't violated. Anthropic has asked the full court to rehear the case. Nextgov reported the panel split the same way, with Judge Henderson dissenting, and DefenseScoop covered a brief from 17 former national security officials urging rehearing. The filing says Anthropic can't predict the outcome and can't be certain the result won't hurt its ability to sell to agencies and to customers who sell to the government.
That last clause is the one for contractors. If a meaningful part of your revenue is federal, ask your counsel what the open designation means for your Claude use before it becomes a surprise in a bid review. We aren't lawyers and this isn't legal advice. It is a live case, and its outcome isn't settled in the document.
Who can overrule whom
Anthropic is a public benefit corporation. Its directors must balance shareholders' money interests, the interests of people affected by the company's conduct and a stated purpose, "the responsible development and maintenance of advanced AI for the long-term benefit of humanity." The filing says the company doesn't have to measure that benefit against an outside standard, and that its board will set the yardsticks.
Layered on that are two special classes of stock. The Long-Term Benefit Trust, five trustees the filing calls financially disinterested, holds Class T stock and generally elects and removes a majority of the board. A single share of Class F stock goes to an LLC owned by the seven co-founders and carries 50.1% of the vote on general matters, including directors outside the trust's group. The company calls itself a controlled company under Nasdaq rules, though it says it expects to use the exemption only for one committee. TechCrunch's reading is that ordinary shareholders get little say over most big decisions, including who sits on the board. On how the founders' control ends, the filing says the Class F stock is redeemed after a 450-day transition that starts once fewer than three founders have served for 90 straight days, or sooner if a supermajority of the founders agrees. TechCrunch also describes a ten-year point at which the founders can choose to end it. The only ten-year term we found in the filing concerns replacement founders, so check that part against the prospectus yourself.
For customers this matters in a narrow way. The restrictions Anthropic has kept in place, like the ones that started the government dispute, are decided by a board the public can't easily vote out. We think that makes a reversal in either direction slower than at a conventional company, which is a plus for anyone who wants predictable policy and a minus for anyone who hopes the usage rules will loosen. It says nothing about the quality of the product.
What we'd change in a Claude setup on Monday
Pulled together, the filing gives a customer six things to act on, and the first two cost the least and cover the most.
- Wire in a second model provider and keep your prompts portable. Test the fallback on a real task, not just a ping. The filing describes outages, capacity limits and a cloud channel that could be disrupted, and a tested alternative covers all three.
- Put a human approval step in front of anything an agent can't undo: deleting, paying, sending, publishing. Narrow its permissions to what the task needs.
- Find out which contract you hold. If you buy through Bedrock, Google or Foundry, read the terms on outages, price changes and what happens if the marketplace relationship ends.
- Budget Claude by tasks and by cost per task, and set spend alerts per team. Cheaper tasks tend to mean more tasks.
- Pin model versions and note deprecation dates, even though the company says it may keep old models around longer than usual.
- If you do US government work, have counsel check where the supply-chain designation stands before the next bid.
Tick off what you already have and the scorer below will show where you stand. It is our own checklist, built from the sections above, and it isn't a certification of anything.
The thing to watch next is an amended filing. We'd expect it to fill in the blanks on run-rate revenue and compute commitments, and the compute number is the one we'd read first. It tells you how much capacity Anthropic has promised itself, which is the best clue the document will give about whether the earlier slowdowns are behind it. If you want a wider look at who else offers the same job, the ToolRank boards are the place to start.
