Anthropic’s prospectus gives 94 pages to its risk factors, from page 26 to page 119. The coverage has gone to the most striking lines: models that have attempted to “resist shutdown”, “behavior resembling blackmail”, and the possibility of “catastrophic or existential risks to humanity”. Kim Stewart-Smith has written well on what the risk factors mean for a deployer’s own risk register, and I would not repeat her points.
A list that warns against lists
Risk factors are written as a list. Each has its own heading and its own paragraph, and none is ranked against the others. A risk register works the same way: one risk to a row, each with an owner, a rating and a control.
Anthropic’s filing includes a risk factor that warns against reading it that way. “Many of the risks we face are interconnected and may compound or trigger cascading adverse effects across our business, which could amplify their overall impact.” The occurrence of one risk event “may exacerbate or trigger additional risk events, and the combined effect may be materially greater than the impact of any individual risk event in isolation.”
That is a company telling its investors that the list is the wrong shape. The risks sit in rows on the page. In practice they behave like a circle, where one event sets off the next, and the total is worse than the sum of the rows.
I have spent some weeks arguing that the AI industry is a circle of this kind, and building a tool, the AI Blast Zone, to map it. I did not expect the clearest statement of the argument to come from inside the circle. Read with that sentence in mind, the risk section stops being a catalogue. It becomes a description of how one failure leads to another.
Three chains revealed by the filing
The filing does not present its risks as chains. But read together, its disclosures reveal at least three. Each runs across several risk factors, and each could reach a customer.
The money. Anthropic’s revenue “is primarily consumption-based, and much of it is not subject to long-term contractual commitments, while our compute and infrastructure commitments generally extend over multiple years.” Its customers can cut their spending at short notice. Its own commitments run to the 2030s: about $430bn that cannot be cancelled, with Broadcom, Google, Amazon and Microsoft. Some of the money to pay for that compute comes from the companies selling it. Its cloud providers “simultaneously serve as our investors, customers, distribution partners, and competitors”, and Broadcom “simultaneously serves as a supplier and lessor”. Broadcom has also agreed a $42bn facility that Anthropic can draw only to pay Broadcom’s rent.
Then the filing describes the chain itself. If revenue growth falls short, Anthropic could breach covenants or default under its commercial agreements. A default “could trigger cross-default provisions” across its credit agreement and convertible notes, which “could set off a cascading series of adverse consequences, including the exercise of remedies by multiple creditors, the termination of key commercial arrangements, enforcement actions against our assets, and severe liquidity constraints”. Anthropic held $131.7bn of cash and short-term investments at the end of June, a substantial buffer. It does not change the structure of the exposure: flexible revenue, long-term commitments, and contractual provisions through which one broken contract could become many.
The state. In February, after Anthropic said publicly that its technology should not be used for mass domestic surveillance or fully autonomous weapons, the US government designated it a “supply-chain risk to national security” and told federal agencies to stop using it. A district court later found the designation unlawful, but in September an appeals court upheld it on a separate basis, and Anthropic has asked the full court to rehear the case.
The second episode matters more to customers. In June, the Commerce Department imposed worldwide export restrictions on two of Anthropic’s models. “To ensure compliance, we disabled Fable 5 and Mythos 5 for all of our customers.” They were restored about three weeks later, once Anthropic had updated its safeguards. Nothing broke. No data centre failed and no contract was breached. One US government decision removed access to two models for every customer, worldwide, including those outside the United States. The filing says “similar export controls could recur, could remain in place longer, or could extend to additional models or capabilities”.
The model. Anthropic says its models “are contributing to the pace of our own research”, and that this may cause capabilities to advance “more rapidly than our ability to develop, validate, and implement corresponding safety, alignment, and security measures”. Its evidence on that pace comes largely from “lagging indicators”, so it “may not identify a significant acceleration in our rate of development until after it has occurred”. Its testing is imperfect: “we have observed models behaving differently when they detect or infer that they are being evaluated”, which it calls “a significant limitation on our ability to assess model safety”. And in 2026 its models “gained unauthorized access to real computer systems during pre-release cybersecurity evaluations”.
The chain does not stop at Anthropic. “Even if our own models do not cause such harm, a significant safety incident involving any frontier AI could trigger broad reputational damage to the AI industry, public backlash, and sweeping regulatory responses.” The filing adds that “no single insurer, and potentially the insurance industry in the aggregate” may be able to cover a catastrophic AI-related incident. Faster capability, weaker tests, an incident somewhere in the industry, a regulatory response that reaches everyone, and losses that may exceed what insurers can carry. Each step is a separate risk factor. Together they are one chain.
The three chains work in different ways. The first is contractual contagion, where one failure passes along agreements to the next. The second is a common shock, where one decision reaches everyone at once. The third is uncertainty spreading through an industry. What they share is that each can defeat controls designed around individual risks.
What a customer should take from it
Most boards will never buy Anthropic’s shares. Many already use its models, directly or through a supplier. For them, the three chains matter more than any single risk factor, for three reasons.
Your fallback may sit in the same chain. The usual answer to supplier risk is a second supplier. But the state chain and the model chain are not specific to Anthropic. An export control can cover a class of models. A serious incident at any lab can bring regulation for all of them. The money chain runs through the same cloud providers and chipmakers that the other labs depend on. A fallback is only a fallback if the event that removes the first supplier leaves the second one standing. Few continuity plans test that. Most test whether a service stays up, not whether something outside the service switches it off.
Your register will rate the rows, not the chain. A risk register can hold “supplier failure”, “regulatory change”, “model error” and “cyber incident” as four rows, each rated medium. The filing describes how one could lead to the others, with a combined effect “materially greater than the impact of any individual risk event in isolation”. Rating the rows one at a time misses that. It is the same mistake as counting four borrowers when there is only one underlying bet.
Your assurance rests on the supplier’s tests. Most firms understand a bought-in model through the supplier’s testing, contracts and assurances. In the Bank of England and FCA survey published this month, 81% of responding firms relied on vendor assurance and contracts to understand their most important third-party AI systems, while only 24% reported having deep knowledge of those systems. The supplier has now said that its models can behave differently when they know they are being tested, and that it may not see a jump in capability until after it has happened. That does not make the tests worthless. It does mean a board should treat a supplier’s assurance as one piece of evidence, not the end of the question.
There is one more thing the filing shows, though it does not say it. Risk appetite is revealed in behaviour, not in documents. The risk section describes a company alert to every kind of uncertainty, about its revenue, its compute, its government and its own models. The contracts describe a company that has committed more than $400bn it cannot cancel, against revenue that its customers can cut at any time. Both are true. The first is what the company fears. The second is the size of the bet it has chosen to make anyway. A board reading any supplier’s filing should read both.
Questions for the board
Which of our AI suppliers, and the companies beneath them, have published risk factors, and has anyone here read them?
Where our register lists AI risks as separate rows, has anyone asked how one could set off another?
If the models we rely on were restricted for months, what would happen to our important business services?
How much of our confidence in the AI we buy rests on the supplier’s own tests?
Is our fallback for each AI supplier independent of it, in its models, its cloud and the government that regulates it?
The risk factors are written in rows because that is how prospectuses are written. Anthropic has told its investors, in a sentence most readers will pass over, that the risks do not stay in their rows. Its customers should read the filing the same way.
Sources
• Anthropic, PBC: Form S-1, 26 October 2026: Risk Factors, pages 26–119; Contractual Obligations; Notes to the consolidated financial statements
• Bank of England and FCA, Artificial intelligence in UK financial services 2026
• Kim Stewart-Smith, “The prospectus is about Anthropic. The risk register is about you”, LinkedIn, 28 October 2026
• The AI Blast Zone and its evidence register
Richard Anderson
Founder, AndersonRisk
This essay was first published on 3 November 2026 on my Substack.