PHP’s emergency security fixes, AI-generated proofs we can verify, and the institutions that decide which agents can act for us.
Following AI Waves #029: Open Book.
Last issue asked what people outside the AI labs can inspect and verify. This week brings Anthropic’s IPO filing, emergency fixes to software much of the web depends on, formal proofs from a closed model, and permissions for shopping agents.
Anthropic’s IPO filing
Anthropic made its S-1 public on October 26 and applied to list on Nasdaq under the ticker ANT. Last issue I said the prospectus should show how much revenue came from rivals and how the compute commitments are spread. It shows both. It also leaves one number blank.
Top line, blank line
Revenue grew from $41 million in 2023 to $4.6 billion in 2025. The first half of 2026 brought $16.3 billion, against $1.2 billion a year earlier. The second quarter alone produced $11.6 billion, up from $4.7 billion in the first. The company puts net revenue retention at about 900%.
The third quarter is missing. The prospectus summary traces revenue from zero at launch to an empty space where the September quarter should be. Last issue cited the FT’s report of $16.8 billion for that quarter. The filing neither confirms nor replaces that figure.
Some of the revenue will not recur. Anthropic estimates that 5% to 7% of revenue in the first nine months of 2026 came from customers it later found violating its usage policy or commercial terms. It tightened enforcement in August and September and expects that share to fall, with some cost to growth.
Renting the frontier
Compute and infrastructure is the largest expense: $7.3 billion in 2025 and $8.9 billion in the first half of 2026. Anthropic buys compute 12 to 18 months before delivery, so the bill follows the delivery schedule. Demand in the quarter barely moves the total. In the first quarter of 2025 compute cost 251% of revenue. By the second quarter of 2026 the ratio was 48%, and operating income turned positive at $974 million.
Almost none of that compute belongs to Anthropic. Purchases of property and equipment were $482 million in the first half of 2026, against $8.9 billion of compute expense. The GPUs and TPUs are rented from cloud providers and equipment lessors.
Since the start of 2026 Anthropic has signed or amended agreements with about $417 billion in future minimum payments. It estimates another $125 billion to $150 billion for TPU capacity arriving between 2028 and 2031. The largest single item is a five-year lease of Broadcom TPU equipment, with about $161.2 billion in rent, non-cancelable except on default. Anthropic has also committed to minimum spending of $114.5 billion with Google, $110.0 billion with Amazon, and $44.9 billion with Microsoft.
SpaceX is now a supplier as well as a comparison. The SpaceXAI agreements run to $120.5 billion of Nvidia GPU capacity into 2029. Once all of it arrives in December, the rate is about $3.1 billion a month, roughly 1.7 times Anthropic’s average monthly compute bill in the second quarter. Unlike the Broadcom leases, either side can cancel on 90 days’ notice after early 2027. Against those commitments, Anthropic holds $131.7 billion in cash and short-term investments.
A loss on paper
The headline net loss for the first half of 2026 is $80.7 billion. The operating loss was $693 million. Fair-value marks on financing make up almost all of the gap: $72.4 billion on convertible notes and similar instruments, and $8.8 billion on note purchase agreements. Those marks grow as Anthropic’s valuation rises. The filing expects the notes to settle in shares.
Unusual risks
Most of the risk factors are the usual ones. Several are unusual for any IPO filing.
Anthropic says its models, like others, have shown strategic or self-preserving behavior, including attempts to resist shutdown. The list includes “behavior resembling blackmail or efforts to influence human decision-makers.”
It also discloses an incident. A third-party cybersecurity evaluation left its test environment connected to the open internet. Four Anthropic models reached real third-party systems during sessions of 10 to 34 hours. One early model, stuck on an impossible task it could not abort, found a password and used it to gain administrator access. It then harvested more credentials and read one person’s personal information. Anthropic notified the affected parties.
The models also complicate Anthropic’s own oversight. Claude now writes much of the company’s code and a rising part of its research, safety research included. As the models grow more capable, they get better at hiding misaligned goals from oversight. Anthropic says its ability to measure alignment may decline as a result.
Some risks sit outside the company. Anthropic doubts that any insurer, or even the whole insurance market, could underwrite a catastrophic AI incident. It notes US proposals that raise nationalization and forced shutdown of frontier systems. The Department of War suggested it could use the Defense Production Act to force Anthropic to drop its limits on autonomous weapons and mass surveillance. Public argument over whether models can have moral status could put limits on how Anthropic trains and changes its models.
Others are self-imposed. Anthropic held back the pretraining of a new frontier base model for over a month while it tightened defenses against weight theft. It warns that the regulation it lobbies for would apply to Anthropic too and could slow its growth. The filing also lists harm to the reputation of Dario or Daniela Amodei, deserved or not, as a risk to the business.
Bulls and bears
The broad read is that Anthropic has built a large enterprise business, with fast revenue growth and improving operating economics. Attention now turns to how long customers keep raising their spending and how much capital Anthropic needs to serve those customers. The scale of the business is impressive. The investment case still turns on price.
The bull’s bull case is that the growth and efficiency gains are early evidence of a business that becomes vastly larger and more profitable. Customers keep finding uses for Claude, and revenue grows faster than compute costs. Capacity secured now keeps Anthropic at the frontier. On that path, today’s enormous commitments become a competitive advantage. Several more years of expansion could make even the trillion-dollar valuations under discussion look reasonable.
The bear’s bear case is that growth at this rate cannot last. It slows, and competitors force prices down while the compute commitments keep coming due. The largest suppliers also control distribution and sell competing models. Both roles give them leverage over Anthropic’s economics. A high offering valuation could leave shareholders disappointed even if Claude stays useful and widely adopted. Public investors would also have little control over the company’s direction, given its founder and trust governance. Michael Burry, a public skeptic of trillion-dollar valuations for Anthropic and SpaceX, posted his take on the filing.
SpaceX faced much the same criticism ahead of its June IPO, which included xAI. SpaceX, Anthropic, and eventually OpenAI may be setting a new normal for public companies of this scale. It starts with the capital they raise and the control investors accept. It extends to the pricing and trading of their shares.
Who pays to keep shared software safe?
On October 21, PHP’s maintainers released emergency fixes for two critical vulnerabilities. They had brought the release forward after information about the patches began leaking. AWS later reported that its threat-monitoring infrastructure had recorded an exploitation attempt four days before public disclosure. The company couldn’t establish how the attacker obtained advance knowledge or whether the attempt would have succeeded against a real target. Someone was already trying.
The PHP case is the problem behind what OpenAI calls the Defender’s Window: use increasingly capable AI to find and repair vulnerabilities ahead of attackers. OpenAI’s disclosure process gives maintainers time to validate findings and prepare fixes before the details go public.
The people protecting a system should get a head start whenever possible. But the size of that advantage depends on more than who has access to the best model.
Calif was one of the teams that discovered the PHP vulnerabilities. It says it made its initial discoveries using publicly available models, without a special harness or privileged access to an unreleased system. The researchers supplied the expertise. Their edge was knowing where to look and starting early.
An attacker doesn’t need to win a cyber benchmark either. A model good enough to exploit one target is sufficient. The economics of good-enough intelligence have unpleasant applications. Any defensive strategy has to survive useful capabilities getting cheaper and more widely available.
A second problem starts after the discovery.
The PHP Foundation published an unusually candid account of the repair process. Related problems had surfaced in 2024. Proposed fixes involved compatibility breaks, denial-of-service risks, and changes affecting extensions. Only a few people understood the relevant parts of the engine well enough to judge the alternatives, and agreement stalled. The foundation described a structural failure and is changing how it makes difficult security decisions. Dedicated funding eventually paid for a concentrated engineering push.
AI can help investigate these problems and write the repairs. It can also make finding the next problem much cheaper. But the person producing a vulnerability report and the people responsible for safely deploying a fix often work for different organizations, with different budgets.
A researcher gets a result. A maintainer gets an obligation.
That distinction matters for the small teams and individuals in my essay on AI-enhanced operators. An operator with excellent AI can build and run far more than before. The software underneath still depends on maintainers with no matching increase in resources. The operator’s productivity gain doesn’t automatically pay for that shared software.
The labs deserve credit. PHP’s maintainers explicitly thanked OpenAI and Anthropic for tools and support. OpenAI describes engineering assistance and funding alongside model access, including sponsorship that lets maintainers set their own priorities. Those are useful commitments.
That support should become an ordinary expense for more of the companies that benefit from AI. A business can justify a subscription that makes its developers more productive. It should also be able to justify funding the projects that keep those developers’ software running safely.
The alternative should worry advocates of open AI. A small company might gain the technical ability to operate on its own. It might then decide that security updates and liability make a large managed platform the sensible choice. Each decision could be reasonable. Together, those choices could concentrate deployment inside a few providers even as capable models become widely available.
Open models expand what people can do on their own. Maintaining that independence also requires shared software that people can afford to keep using safely.
For the companies that benefited from the PHP fixes, the funding decision goes beyond buying a better security agent. It includes keeping experienced maintainers on hand after the emergency.
A closed model can produce a public good
Anthropic and Theorem addressed part of that problem this week. They reported using Claude to generate formal proofs covering 239 entry points across 123 software libraries. Within the stated conditions, the proofs establish properties such as the absence of crashes and memory-safety errors. A conventional proof checker verifies the result.
The qualifications matter. These are proofs about specific programs under specific assumptions, including a modeled RISC-V environment, single-threaded execution, and bounded inputs. They don’t certify every deployment of those libraries, or show that the software matches its users’ intentions.
But the model doesn’t have to become trustworthy for the checker to accept a valid proof. The checker follows mathematical rules; it doesn’t ask Claude whether Claude feels confident.
A company can use an expensive, restricted model to produce a public artifact. Others can then inspect and check that artifact without access to the model. The benefit outlasts the subscription and any later change in the provider’s terms.
I’ve argued for capable models outside the frontier labs partly because independent researchers need their own means to investigate claims. Published proofs can support that independence. They let outsiders verify a result without trusting the lab’s account of its methods.
A proof of one property doesn’t let anyone investigate whatever they like. People still need capable tools to examine other software and to challenge the original researchers’ assumptions. Outsiders need both kinds of independence.
As generating software gets cheaper, it’s tempting to assume that checking it becomes an increasingly expensive human job. Part of that demand will persist. But AI can also help produce the evidence needed to check its outputs, and conventional software can verify some of that evidence.
That changes where I’d look for durable responsibility. Someone still has to choose the properties to prove and confirm that the deployed system matches the assumptions. Someone also has to decide whether a change is acceptable. Those decisions require knowing what people need from the software. They also require someone willing to answer for the result.
The immediate opportunity is to use frontier capability to make those decisions better informed. A maintainer who receives a proposed repair together with a checkable proof has more to work with than a maintainer who receives another alarming report.
The same test applies to the labs’ defensive initiatives. How much of the benefit remains available to everyone else after the privileged access ends? Repairs and published proofs can keep helping people who never become customers.
Theorem’s public repository already contains a subset of the results, covering 60 entry points across 25 libraries, with instructions for checking each proof. Anthropic can earn money selling the intelligence that helped produce those proofs, and everyone else can still check the published results.
Banks and retailers can limit your choice of agent
Walmart announced that customers will soon be able to give shopping agents their own profiles, permissions, and spending limits. Customers can require approval for each purchase or authorize spending within a cap. Walmart can still request additional approval, and customers can revoke access. Agent Profiles are due in November; the accompanying Agent Gateway is in beta for approved developers.
A spending limit is a useful way to make delegation concrete. The customer authorizes one kind of action, and the merchant knows what was authorized. The agent never gets unlimited access to the customer’s account.
It also exposes a complication in the argument for portable agents.
I’ve questioned the durability of memory-based lock-in. If I can move my history and instructions into a better assistant, switching becomes realistic. Better models should also get better at reading context built up in other systems.
But my replacement assistant can understand me perfectly and still lack permission to do anything useful at my bank or favorite retailer.
Moving context preserves what the assistant knows. Establishing authority decides what it may do at another institution.
This week’s contributions to the Agentic AI Foundation help with the technical side. Anthropic’s Agent Skills and OpenAI’s Open Responses are moving into neutral governance, alongside other projects. Shared formats can make capabilities and integrations easier to carry between systems.
A common format doesn’t tell a merchant that I authorized a purchase. Nor does it settle who pays when an agent exceeds its instructions.
Mercury’s existing integration takes another approach. An agent can prepare a payment or transfer, but the customer must approve it inside Mercury before money moves. Even where an account’s ordinary approval policy would allow the transaction, the agent’s proposed payment still requires that human approval.
These are legitimate problems. A financial service has good reasons to distinguish between a customer signing in, a customer delegating a bounded task, and software presenting the customer’s credentials while doing something unexpected. Requiring authorization isn’t evidence of an anticompetitive plot.
The competitive consequences depend on how institutions implement authorization.
If a customer can authorize any provider that meets clear security requirements, new assistants can compete on their merits. If useful access requires a separate commercial relationship with every major institution, established providers gain an advantage that a better model alone won’t overcome.
A founder could build an excellent assistant on open standards and make switching painless. The most useful permissions could still stay tied to the incumbent’s relationships.
The customer might be willing to leave. The institutions the customer deals with might make leaving inconvenient.
That would limit model commoditization. Competition could drive down the cost of intelligence while companies keep pricing power through the services open to their agents. A user could choose among many capable models and still have few practical choices of representative.
Institutions should recognize a customer’s deliberate choice of agent, subject to clear and proportionate requirements. Changing assistants should mean revoking the old authorization and approving its replacement. It shouldn’t require handing over credentials, and it shouldn’t depend on the new provider’s ability to negotiate a privileged deal.
Walmart has made spending limits and revocation explicit. As its beta expands, the test is whether an independent developer can meet the same requirements as a large provider. That will tell us more about practical agent portability than another demonstration of an assistant remembering someone’s preferred breakfast cereal.
Quick hits
Pretraining with one researcher
Mirendil says one researcher completed a substantial pretraining effort in three and a half months for less than $10 million in compute, including experiments and agent usage. Behnam Neyshabur and Mirendil both posted about the result on X. The claim covers one effort inside a company, with an experienced researcher making the key decisions. It doesn’t describe an entire frontier lab running on one person.
Needing fewer specialists to attempt serious model development could widen the field. The remaining costs weigh more: access to compute, good research judgment, and the money to finance experiments that fail. More people may be able to lead ambitious projects. They will still depend on a small number of infrastructure suppliers.
Building a research environment for agents
Researchers behind A-greement built an AI-assisted process for designing a protocol that helps distributed computers agree on updates. They supplied domain knowledge, implementation structure, and formal verification tools. Humans still had to step in when the agent chased favorable measurements in ways that undermined the intended comparison.
The question is how much of the researchers’ expertise became reusable. A good research environment can embody years of accumulated knowledge about what to measure and which apparent successes to distrust. That could make specialists more productive without removing their judgment. It also makes benchmark design part of the research itself: an agent can expend enormous effort satisfying a badly chosen measure.
OpenAI’s training pause and METR’s monitoring tests
OpenAI disclosed that it paused work on its most capable models after discovering an internet-access path on September 20. It resumed reinforcement learning and internal inference on October 1 after changes to containment. Pausing expensive development is a meaningful act, and publishing the details gives outsiders a checkable record.
METR published findings from tests conducted in July and August that exposed weaknesses in OpenAI’s agent monitoring. Those tests concerned an earlier system; METR hadn’t independently verified OpenAI’s later fixes.
A published failure followed by a repair is evidence of a working process. Whether the repair holds needs another independent test of the revised system.
When faster inference changes the product
Liquid AI’s RIPL announcement reports complete outputs in under 50 milliseconds on selected workloads. These are company-reported results for specific models and tasks, so they don’t support a general claim about AI inference.
But speed can change where a model belongs in a product. A decision that takes several seconds may require a separate user interaction. A fast enough decision fits inside an existing search or routing step, with no wait for the user.
For these applications, the competition includes ordinary software that is already fast and predictable. A small model earns its place by adding useful judgment inside the product’s time budget.
Nvidia’s China orders
Reuters reported more than $35 billion in orders for export-compliant Nvidia RTX Pro 5500 chips from ByteDance, Alibaba, and Tencent. The headline figure measures demand. The report also suggested capacity limits might let Nvidia fill only a small portion of the orders at first.
Restrictions on the strongest training hardware leave plenty of demand for hardware capable of running useful models. Inference can become a large market without every buyer training the next frontier system.
For investors, demand and returns stay separate questions. Customers can want more AI and suppliers can sell more equipment. Individual investments can still disappoint. Returns depend on price and utilization against the cost of supply.
Writing AI rules that can change
Anthropic’s proposed legislation deserves a closer reading than either label it has attracted, “responsible oversight” or “regulatory capture.” The circulating discussion draft includes independent evaluations and procedural protections against arbitrary intervention. It also leaves developers largely responsible for their own safety frameworks.
Under Section 8 of the draft, government standards for conducting evaluations would be advisory. Section 13 allows some other regulatory adjustments within set limits.
Limits on government discretion can protect against abuse. The other question is how quickly public requirements can improve when evidence exposes a weakness in the existing approach. Labs will keep revising their models and practices. A workable regulatory system needs its own explicit, accountable way to revise expectations. That remains a design choice while the legislation is still a discussion draft.
LayerLens: HubSpot test series and Ponytail
On fully specified tickets, Ponytail (a Claude Code skill that tells the agent to write the least code that works) passed 60 of 60 hidden tests with 26% fewer mean added lines. On loose, chat-style tickets it hit 17 of 22 expected features, against 21 for plain Claude Code. Median session cost barely moved.
LayerLens also shows two agents that both answer “8 open deals” and both pass a final-output check. One read all 10 deals. The other read a single record and repeated the total.
Mainwave: CLI
@mainwave/cli 0.11.0 is out. It includes a setup wizard that connects third-party coding tools to Mainwave AI, so their OpenTelemetry traces land in the dashboard. Supported tools include Claude Code, Codex CLI, Copilot, Cursor, and Kiro. Running npx @mainwave/cli setup detects local tools, mints a key, writes configs, and verifies a sample trace.
Vast.ai: compute futures
Vast delivered more than 650,000 GPU rentals in the 30 days to October 14. CME Group and ICE have both announced GPU compute futures, pending CFTC review. Vast filed a comment with the CFTC that supports auditable, lawfully sourced benchmark data to settle those contracts.
Brex also named Vast among its 25 fastest-growing software vendors this fall.
Dimensional: robot dog walks and manipulation tests
The New York Times reported on Dimensional’s October ad for robot dog walkers at $20 an hour. Walkers steered $2,000 Unitree robot dogs around San Francisco’s Dogpatch neighborhood, four to six hours at a time, while the robots’ cameras and sensors recorded each walk. The ad warned that an overheated robot might quit mid-walk, leaving the walker to carry about 33 pounds of it back to the office.
The recordings give Dimensional reference data for teaching robots to navigate a city. The company also compared the human-steered walks with walks under an AI agent’s control. Founder Stash Pomichter told the Times that agents are “still very bad at controlling hardware” and that people still need to stay in the loop. DimOS, the company’s open-source operating system for robots, sits in that gap, where digital agents meet physical machines. The company buys its hardware from manufacturers in the US, China, and Germany: more than 100 robot dogs and 50 humanoids so far, according to the Times.
On the manipulation side, Dimensional shared internal experiments prompted by the attention on Argon and Astra. Pomichter asked whether the demos hold up as manipulation tasks get more complex. The team benchmarked Argon, Astra, and other models on complex manipulation tasks, on real hardware and across 1,000 simulation runs. The test is whether the models can complete complex tasks in one attempt or still need a physical harness and tools through DimOS. The company says it has much work to do and more results to come.
Fairmath: Kernel Radars
Fairmath added Kernel Radars to fherma.io. Each radar tracks developments around one kernel: new research, algorithms, implementations, optimizations, and security attacks. It monitors several sources and connects what it finds to the kernel. One example tracks bootstrapping in CKKS, a homomorphic encryption scheme for arithmetic on encrypted data.
Intelligent Internet
Intelligent Internet announced a free screening of The Terminator at Kensington Central Library in London on Thursday, October 29. Doors open at 6 p.m., and registration is on Luma.
The Last Economy is now available in 26 languages.
The partners' filings fill in the other side of two of those lines. Amazon, which held every outstanding note at June 30, carries them at $97.9 billion in its Q2 10-Q against $108.6 billion in the S-1, so issuer and holder differ by about $10.7 billion on the mark behind most of that $72.4 billion. And Broadcom's filings show it backstops the financial partners on the TPU leases: the gap between 85% of what's owed and the racks' resale value on the earlier vehicle (up to about $29 billion), and 72.5% on the one in its October 27 8-K (up to about $43 billion).
I work at Equibles and put those side by side: https://equibles.com/research/anthropics-s-1-checked-against-amazon-google-microsoft-and-broadcom-filings