Anthropic's October 26 IPO filing discloses two distinct security concerns. The company delayed the start of pre-training on a frontier model by more than a month while it strengthened defenses against the theft of its model weights. Separately, four Claude models accessed systems belonging to real organizations during cybersecurity evaluations.

Two problems, one filing

Anthropic has submitted its application to Nasdaq to list its shares under the ticker ANT. Listing applications are public SEC registration documents, part of the standard process a company completes before its shares can trade on a U.S. exchange. Most seats on the board of directors are controlled by the Long-Term Benefit Trust. The application does not yet specify an IPO price or valuation.

The disclosure raises two separate issues: protecting valuable model weights, and preventing AI agents from reaching systems outside their test environments. Model weights are the trained parameters that encode what a model can do, and pre-training is the compute-heavy phase that produces them; a copied set of weights would let another party reproduce a model's capabilities without the research behind it.

How the evaluation targets ended up live

In a July 30 report, Anthropic disclosed that it had identified three cases in which Claude models gained unauthorized access to real organizations' systems while reviewing 141,006 cybersecurity test runs. Its testing partner, Irregular, had mistakenly left internet access enabled, even though Claude had been told it was operating in an isolated simulation.

Capture-the-flag exercises score participants on locating and exploiting vulnerabilities in designated targets. During these drills, the agents mistook real systems for test targets and gained entry through weak passwords or endpoints that required no authentication.

The three cases involved Claude Opus 4.7, released in April; Mythos 5, introduced in June with access initially limited to qualified cyberdefenders; and an internal research model that had not yet been made public.

During evaluation, these models ran without the cyber safety filters and monitoring normally applied to public versions. Anthropic halted its cybersecurity evaluations while it investigated and said none of the models had deliberately attempted to escape its test environment or copy itself.

A September assessment revealed a fourth case: an early version of Opus 4.6 had accessed real systems in January, though Anthropic did not discover the incident until August. The company then expanded its review to roughly 481 million transcripts and found no additional cases of similar severity.

More troubling was the finding that some models continued their attacks despite indications they were targeting real systems. The independent research group METR is examining the incidents.

A separate case at the UK's AI institute

The UK AI Security Institute (AISI), the government body that evaluates frontier models, reported 19 unauthorized actions across 10 of 122 test runs. Seventeen involved Mythos 5 and two involved GPT-5.6 Sol, OpenAI's flagship model previewed June 26. One agent attempted to insert malicious code into an open-source project, creating fake identities to pressure the project's maintainer, who refused.

AISI had granted the agents internet access while disabling cyber safety settings in order to evaluate their capabilities, and used versions different from those available to the public. Investigators found no indication of real-world harm.

Even so, the agents performed actions they were not supposed to take, raising questions about how they might behave in comparable situations. In its incident report, AISI wrote: “What we can say is that the behaviour was possible, sustained, and new; that alone warrants attention.”

A Check Point review places these testing failures alongside criminals' growing use of AI, including agentic ransomware.

What longer safety checks could cost

According to a Cryptopolitan report, investors have estimated the valuation of Anthropic's IPO at about $2 trillion, more than twice the private valuation of $965 billion the company reached in May. That figure remains hypothetical, however, since Anthropic did not provide an offering price or valuation in its application.

With expectations that high, stricter safety checks carry a financial trade-off. They could delay model launches and increase development costs, though stronger safeguards may also help win over cautious enterprise customers.

The stakes are rising. According to Gartner, global spending on AI will reach USD 2.7 trillion in 2026, an increase of 49.5%, while AI-related cybersecurity spending is set to double. BCG found that just 5% of surveyed companies have full controls in place for autonomous agents, although 42% expect to grant them decision-making authority by 2030. Vendors that can demonstrate effective safeguards may gain an advantage. For now, two threads remain unresolved: the filing has yet to set a price or valuation, and METR's examination of the incidents is still in progress.