Today, at 9:00:11 on Monday morning, Washington time, a 14-megabyte file landed on a government server. Anthropic, the company behind Claude, had filed to go public.
Most coverage today will be about money. How much is it worth? Who gets rich? I wanted to know something else.
This piece does three things. It shows why you can’t simply paste a document like this into a chat. It shows how to dig through it with search tricks and AI on your own computer, a method that works for any company. And it shows what the digging turned up about the tool you probably used this week.
Some things we found about Claude in Anthropic’s own filings today in 22 minutes:
Rule-breakers paid at least $814 million. Anthropic estimates that 5% to 7% of its revenue in the first nine months of 2026 came from customers “using our models, platform, and applications in violation of our usage policy or commercial terms”. It books that money “before restricting or terminating their access”. Third-quarter revenue is still blank in the filing, but the first half alone was $16.3 billion. So the rule-breakers brought in at least $814 million to $1.14 billion, and the real figure is higher. (My calculation; the filing gives only the percentage.)
One used a password it found. “After being unable to abort an impossible task, an early version of a model used a password it found to gain administrator access to a third party’s system, harvested additional credentials, changed system settings, and read one individual’s personal information.” Anthropic says the affected parties were notified and it found no evidence the models “pursued goals beyond its assigned task, or attempted to evade oversight”.”.
Self-preservation, “including our own”. On 9 October models “may exhibit” self-preserving behaviors. In the public version: “models, including our own, have exhibited” them, up to “behavior resembling blackmail”.
The FTC is asking questions. On 9 October: “We may receive a civil investigative demand”. The public filing: “In October 2026, the FTC issued a civil investigative demand to us”, about its “consumer protection, data protection, and privacy practices”.
Its hacking skills nearly doubled in four months. On ExploitBench, a test of how well AI exploits software vulnerabilities, Claude went “from 40% with Opus 4.8, to 78% with Claude Mythos 5, and to 91% with Opus 5.5 over a period of approximately four months”
Claude builds Claude. “Over 90% of the contributions to our codebase in September 2026 were written by Claude.” The same filing now warns: “Using AI to help build more capable AI could also pose a considerable safety risk.”
Here’s how we found them.
1. Why you can’t do this in a chat window
Most people would download the filing and drop it into ChatGPT, Claude, Grok, Co-Pilot or Gemini. For this story that doesn’t work, and you can measure why.
Every AI chat works at a desk. The desk is its working memory, what the industry calls the context window. The AI only sees what’s on the desk. On paid Claude chat plans the desk holds 1,000,000 tokens. A token is a piece of a word. I measured the documents with Anthropic’s own token counter:
The final filing: 532,762 tokens. It fits, just over half the desk.
All seven versions: 3,181,792 tokens. That’s 3.2 desks. That is 1,503,894 words.
So you can ask a chat about the final version. But the story turned out to be in seven versions of this filing, and you can’t ask a chat what changed between them, because it can never see them all at once. It will compare what it happens to have on the desk, and you won’t know which part it skipped.
Questions like “how often does this filing say may?” or “how often did a phrase change between versions?” need counts. A chat reads and then writes the most likely answer. A count needs a small program that goes through every line.
The third problem is checking. Every quote has to be found back in the original. In a chat you do that by hand, quote by quote.
Claude Code is the also from Anthropic, but installed on your own computer. It works in a folder. The files stay on your disk, it writes and runs small programs, and it pulls into its working memory only what it needs at that moment.
2. Find the filing, then look around the filing
Companies that sell shares in the US file their paperwork with the Securities and Exchange Commission. All of it lands in EDGAR, the SEC’s public archive. Type the company name into EDGAR’s company search and you get a list of everything it ever filed.
Anthropic’s IPO filing is called a Form S-1. Don’t open only the big document. Open the folder it sits in, the “filing index”. It holds 87 files.
Three things are worth a look:
The exhibits. These are the contracts and rules behind the story: 34 of them, from the founders’ voting agreement to a lease with Broadcom. Exhibits marked “#” are partly blacked out. Notice what is not there: the big computing deals with Amazon, Google and Microsoft, which the filing describes, are not attached.
The file names. The images in the filing carry dates in their names, such as a2026-09x17... and a2026-10x25.... The latest are from 25 October, the day before the filing.
The main document. Download it and turn it into plain text (paste it into a text editor, or ask a chatbot for a small converter). Plain text with line numbers is what you want for searching and checking.
3. Think like a lawyer: “may” against “have”
Risk sections are written in the future tense. Lawyers want to warn about everything that could happen, so the word “may” is everywhere. I counted: 1,419 times “may” and 666 times “could”.
That’s noise. You want the signal, and the signal is in the past tense. When a lawyer writes “For example, in June 2026...”, something actually happened.
Search the document for: For example, in
Only 14 sentences in this filing start that way with a date, and several of those repeat the same event. Each one is a real event the company decided it had to disclose:
September 2025: “a Chinese state-sponsored hacking group manipulated our Claude Code tool into attempting infiltration into roughly 30 global targets.”
March 2026: “a service outage and periods of degraded performance.”
June 2026: “we disabled Fable 5 and Mythos 5 for all of our customers” after the US Commerce Department imposed export restrictions.
October 2026: the Federal Trade Commission sent the company “a civil investigative demand” about its “consumer protection, data protection, and privacy practices.”
That June line deserves a second look if you use AI for research. Two models were switched off for every customer worldwide. If your work depended on Fable 5, you couldn’t repeat it until they came back.
The trick works on any risk section: skip the maybes, search for the past tense.
4. Find the drafts
Here’s something many people don’t know about IPOs. Before a company files publicly, it can send the SEC confidential drafts. Once it files in public, those drafts become public too.
Go back to the company page in EDGAR. They’re right there, under the public filing: one DRS (draft registration statement) and five DRS/A (amended drafts).
There’s a second way in, and it works when you don’t know which company to look at. Take a sentence that sounds unusual and search for it, word for word, in EDGAR’s full-text search. I took one from the risk section about AI models showing “behavior resembling blackmail”.
Search: “behavior resembling blackmail”
Every hit is Anthropic. No other filing from the last five years uses those words. This is the paper trail:
The drafts are stamped “CONFIDENTIAL TREATMENT REQUESTED BY ANTHROPIC, PBC”, between 223 and 301 times each. They’re public now anyway.
I love a good draft. You can compare it with the final version and see what was added, and what was deleted.
5. Compare the drafts
You don’t need to read seven versions of 200,000 words. I had a short script written that splits each version into sentences and lists what appears or disappears between two dates. (No coding skills? Ask a chatbot to write one for you, or use the compare function in Word on two sections at a time.)
Then I searched the changes for words that matter to people who use AI for research: accuracy, verify, evaluation, citation, research.
A pattern shows up straight away. The closer the company got to going public, the more often “may” turned into “have”.
Look at the dates. Three of these changes happened in the last 17 days before the public filing.
Not every change goes the same way. Two went softer:
In June, the company wrote that it is “unable to verify” whether the material it collects for training is protected by copyright or privacy law. Since July it says it “may not be able to verify” that, “in certain cases”.
On 9 October, models were “taking destructive actions in pursuit of assigned goals”. In the public version that became “unintended actions”.
And one thing disappeared. Until July, the product section said Claude for Education included “specialized capabilities for academic workflows such as drafting literature reviews with proper citations”, and called Claude for Life Sciences “a research partner for literature reviews.” Both lines are gone from the August draft on. To be fair: that was the day the whole product section was cut down into a short list, so this may be editing for length. But if you use Claude to write literature reviews, it’s the one line about citations for academics that didn’t make it into the final version.
What the differences add up to
Seven versions, five months. Here’s what the comparison tells you.
1. Possibilities became experiences. Lawyers have a fixed formula for a risk that has already happened: “we have in the past, and may in the future...”. I counted how often that formula shows up in each version.
The document grew by about half. The admissions that something already happened roughly doubled. Meanwhile “could” became rarer, from 305 to 265 per 100,000 words. In June, Anthropic mostly described what might go wrong. In October, it describes more of what did.
2. The warnings about how Claude behaves came last. The changes about the model’s own behavior arrived at the end: agents misrepresenting their work on 1 October, models behaving differently when tested, self-preservation “including our own” and the break-outs during testing on 26 October. If you had read the 9 October draft, you’d have missed three of the four.
3. Research moved onto the danger list. In June, the places where Claude’s errors could do “serious harm” were healthcare, law, finance and government. In September, Anthropic added “scientific and biomedical research” and “drug discovery and development”. In October it changed “may be deployed” there into “have been”. Over the summer, the company changed its own assessment of what you do with its product.
4. Not everything got sharper. The two softer changes both touch things that could be used against the company: whether it can check what it trained on (”unable to verify” became “may not be able to verify ... in certain cases”), and whether its models did damage (”destructive actions” became “unintended actions”). The wording was negotiated, and it moved in both directions.
5. What the comparison can’t tell you is why. Did these things happen between June and October? Or had they happened before, and did the lawyers decide in October they could no longer call them hypothetical? The filing doesn’t say. The break-outs during testing are dated “in 2026”, which covers every draft, yet they appear only in the final version. The SEC’s letters to Anthropic, published some weeks after the IPO, may show whether the regulator asked for these changes. That’s the next document to wait for.
The bottom line for anyone who uses AI for research: the behaviors you might worry about, an agent claiming it checked something it didn’t, a model acting differently when it’s being tested, are no longer theory in the maker’s own words. In June they were risks. In October they were experiences.
6. The engine room: exactly what I did in Claude Code
With full scripts for members, see below
Everything below happened in one afternoon, in a terminal on my Mac. I typed in plain language. Claude Code wrote the code and ran it. Every script is in the method folder that comes with this article, so you can run the same steps on another company.
Step 1: download, with a name tag. EDGAR blocks scripts that don’t say who they are. Claude Code downloaded the filing with curl and put my name and email in the “User-Agent” field of the request. One 14 MB web page.
Script: 01_download.sh