Latest / Braid / Anthropic's S-1 Shows a Founder Share With No Economics and Up to $120.5B in SpaceX Compute

Transcript

Anthropic's S-1 Shows a Founder Share With No Economics and Up to $120.5B in SpaceX Compute · Braid

• 0:04
  lenar: Picture reading a company's description of its own customers, in a document it's legally required to get right, and finding a sentence that says somewhere between five and seven percent of this year's revenue came from people breaking the company's rules. Would you keep reading? That sentence is in Anthropic's S-1, the registration statement for its IPO, filed yesterday morning. The same filing has a founder share that carries half the votes and none of the money, and a compute contract with SpaceX that tops out at a hundred and twenty billion dollars. Today starts there. Next come OpenAI's GPT-6.1 Terra and Microsoft's buyout offer to about sixty thousand people. Then two stories about what you're trusting when you run someone else's model, and a stack of talks and papers about keeping agents on task.
• 0:48
  damra: Hold on. Five to seven percent of revenue from rule-breakers, in a prospectus? Before the details, what did Anthropic itself put out?
• 0:57
  lenar: Their own announcement is short and procedural. They've filed a registration statement on Form S-1 with the SEC for a proposed IPO. They intend to list Class A common stock on the Nasdaq Global Select Market under the symbol ANT. The share count and price range, in their words, 'have not yet been determined.' Goldman Sachs and Morgan Stanley are the names on the prospectus request line. The registration statement hasn't become effective, so there's no price and no date, just the document. The Hacker News post of the filing has 1,636 points and around 1,558 comments, the biggest conversation of the day.
• 1:35
  damra: Which means people skipped the announcement and went straight to the governance section. What's in there?
• 1:40
  lenar: The Mad Robot write-up of the filing walks through it. Shortly before the offering, a special Class F share goes to an entity owned by the co-founders, including Dario and Daniela Amodei. Quoting Mad Robot: 'That one share carries 50.1% of the votes on ordinary shareholder matters, including the election of most directors.' And then: 'It has no economic rights.' It stops mattering if fewer than three of what the filing calls Continuing Founders remain for ninety days in a row, or if the share is redeemed. Because of it, Anthropic becomes a controlled company under Nasdaq rules, so it can skip some of the standard governance requirements.
• 2:17
  damra: A share with no dividend, no claim on assets, and half the votes. That's about as pure a control instrument as you can write down. Meta and Alphabet get founder control with super-voting stock, but that stock also carries economics. Here the control doesn't scale with how much the founders own at all.
• 2:35
  lenar: And there's a second control mechanism sitting next to it. The Long-Term Benefit Trust holds a Class T share, and per the write-up it elects directors who will form a board majority, four of seven seats, with one currently empty. Public buyers get Class A shares with one vote each.
• 2:50
  damra: So the founders hold the shareholder votes, the trust holds the board, and the people paying for the stock hold the economics and the smallest say. What happens when the founders and the trust disagree? Mad Robot lists both and doesn't say.
• 3:03
  lenar: It doesn't, at least in the summary. I'd read the filing's own language on that before saying more. The revenue line is the other one that stuck out. Runtime Wire's summary says customers later found to be violating Anthropic's usage policy or commercial terms generated, quote, 'an estimated 5% to 7% of revenue through September 30th.' It adds that the company expects stepped-up enforcement may slow growth. The enforcement started in August and September.
• 3:29
  damra: That's the sentence I'd have a lawyer fight over, and it's the one I trust most for being in there. Think about what it means for the growth number a buyer sees. Part of it comes from customers Anthropic is now trying to turn off. The summary doesn't say what kind of violation, whether that's resale, region restrictions, or something like distillation. It just says the revenue exists and the enforcement costs growth.
• 3:52
  lenar: Right, and the summary doesn't reproduce the S-1's wording, so the kind of violation stays open. The disclosure itself is unusual for a company this young. Most prospectuses describe revenue quality in the flattering direction. This one tells you a measurable slice of it is the kind the company wants less of.
• 4:09
  damra: I'll take that as a point for the filing. It reads like people who've been told that everything they say gets quoted back to them in a lawsuit.
• 4:16
  lenar: The compute contract is the other big number in that filing. Per the Tesla North article, Anthropic says it will spend, quote, 'an aggregate of up to $120.5 billion over terms extending into 2029' with SpaceX.AI LLC, to access compute powered by NVIDIA GPUs. That's the article quoting the filing, and I only have the article's text for this section, so the specifics are secondhand.
• 4:41
  damra: Up to. Those two words carry the headline. What's firm?
• 4:45
  lenar: The article calls it a ceiling, not a guaranteed total. The initial non-cancelable periods end in January and March of 2027, and after that either side can leave with ninety days' written notice. So what Anthropic can't walk away from is a few months long. The rest is a ceiling it reaches only if both sides keep wanting the arrangement.
• 5:05
  damra: Which is a different sentence from 'Anthropic commits a hundred and twenty billion dollars to SpaceX,' and a headline will compress it that way anyway. Notice what it implies for the supplier, too. SpaceX is buying hardware against a customer who can leave in a quarter.
• 5:20
  lenar: The delivery schedule is more specific. Anthropic expects all the contracted capacity in December 2026. From there payments reach roughly $3.1 billion a month, about $37 billion a year. Fees differ while capacity is ramping, and the filing doesn't say which data centers host any of it. My own arithmetic, not the filing's: three years at thirty-seven billion is about a hundred and eleven billion, so 120.5 reads like full-rate payments through roughly the end of 2029, plus ramp-up fees.
• 5:51
  damra: Three point one billion a month is a utility bill. And December starts in about five weeks, so this isn't a plan for some future cluster. It's capacity that's supposed to switch on before the IPO has a price.
• 6:02
  lenar: The same day, CNBC reported, via TLDR's summary of it, that SpaceX closed forty billion dollars of debt financing to buy GPUs. It's mostly capitalizable debt. It's structured through a special purpose vehicle that keeps it off SpaceX's balance sheet and protects its investment-grade credit ratings. The money is expected to arrive in the first and second quarters of 2027.
• 6:25
  damra: Then the timing doesn't line up. Anthropic's capacity is due in December, and the financing for GPUs shows up in 2027. Either those are different GPUs, or somebody is fronting the purchase from another pocket in the meantime.
• 6:38
  lenar: Both are possible, and nothing I've read connects the forty billion to Anthropic's capacity. The CNBC item is a two-minute summary, so I wouldn't treat these as one deal. They do sit on the same supply chain, which is why they're in the same segment.
• 6:51
  damra: If they're related, here's who carries the risk. Anthropic has its ninety-day exit, but debt on GPUs doesn't have a ninety-day exit. Whoever lent against that hardware is exposed to whether somebody still wants the capacity. That's the neocloud debt problem with a name attached.
• 7:08
  lenar: The number I still want is the dollar figure for the non-cancelable minimum. The article gives you the dates and the ceiling but not that, and it tells you how much of the 120.5 is a promise.
• 7:19
  lenar: OpenAI shipped GPT-6.1 Terra yesterday, pitched as fast, capable computer use at a lower price. It reads the screen, acts across apps, and writes naturally. Its Hacker News thread has 577 points and 364 comments, and a good share of those comments are about the names. The numbers are on the developer docs page, so let's start there.
• 7:41
  damra: Go ahead. The promo video is thirty-two seconds, so the docs are the only place I'd expect a price.
• 7:47
  lenar: Per million tokens of text: one dollar for input, five cents for cached input, and five dollars for output. It has a context window of 1,050,000 tokens, with a maximum of 922,000 tokens of input and 128,000 of output. Then the surcharge. Requests over 272,000 input tokens cost double on input and cache rates and one and a half times on output, for the whole request. Batch and Flex run half the standard price, and fast mode costs twice as much.
• 8:17
  damra: The whole-request wording is the detail. Cross 272,000 tokens and your entire prompt reprices, so a 300,000-token prompt costs twice what the headline rate suggests, all of it, not just the extra 28,000.
• 8:33
  lenar: On computer use, the docs list computer_use among the supported tools, which require the Responses API. The tagline says 'precise computer use,' and one suggested use is to 'act on application screens.' I didn't find an independent evaluation in anything I read, and the docs page doesn't compare Terra to anything. It calls it 'a fast, efficient model,' never mentions Luna or Sol, and one guide link points at a model called gpt-6-astra.
• 9:01
  damra: So there's Astra, Sol, Terra, and Luna. Four astronomy words and a version number, and you need a docs page to find out which one's the cheap one. [laugh] The commenters were right to be confused.
• 9:13
  lenar: Yesterday's episode had IBM's CEO saying open-weight models are about ninety percent as good at a fraction of the price. A cheaper mid-tier model from OpenAI is a data point from the other side. I can't tell you from the docs how Terra compares to open weights, because nobody has published that.
• 9:29
  damra: A dollar in and a million-token window is an aggressive number for a model pitched at driving screens. Whether it can actually drive them is something nobody outside OpenAI can answer yet.
• 9:40
  lenar: OpenAI also put out a batch of customer stories in the same day. That's vendor marketing, mostly one-minute videos, and most of it concerns Astra and Sol rather than Terra. Hebbia's says, quote, 'We see Astra actually show over double digit gains over any other model we've tested on two fronts.' The two are citation source selection, meaning finding the right document in a data room with thousands of them, and PowerPoint generation.
• 10:04
  damra: Double-digit gains over what, measured how? No baseline, no benchmark, from a customer OpenAI chose to put on camera. The Sullivan and Cromwell one is more interesting, because of what it produces.
• 10:16
  lenar: They describe feeding a draft agreement from opposing counsel into a model along with favorite precedents and a playbook. What comes back is a memorandum of the issues, quote, 'with full transparency into the rationale for all the decisions,' plus a track-changes markup a lawyer can review, adapt, and hand to the client. Amp's video says OpenAI is, quote, 'the vast majority of tokens in Amp,' and mentions that signing in with ChatGPT gets Amp users a lot more tokens.
• 10:44
  damra: The law firm design is the sensible one. The output is a markup a human reviews, so the model's work arrives already reviewable. The Amp line tells you about distribution more than quality, since the sign-in is what gets people more tokens.
• 10:58
  lenar: None of the gains in these videos are measured in a way you can check, so I'm leaving them as the vendors' own account of where the Astra and Sol tier is being used.
• 11:06
  lenar: Microsoft is offering voluntary exit packages to about sixty thousand employees, roughly a quarter of its workforce, according to the Seattle Times and KUOW. The Seattle Times piece is headlined as mass buyouts, and the story drew 909 points and 860 comments on Hacker News. The details I can quote come from KUOW, because the Seattle Times page wouldn't load for me.
• 11:29
  damra: Voluntary, so nobody's being fired by this offer. Who gets it?
• 11:34
  lenar: Per KUOW, the offer goes to 'select employees in the U.S., U.K., Canada, and India at level 70 and below.' That cutoff reaches up to vice president level. Each organization's head decided who's eligible. Sales, some corporate functions such as marketing, and some engineering teams are left out.
• 11:53
  damra: Level 70 and below reaching vice presidents means this isn't aimed at junior roles. And the exclusions are specific. Sales, marketing, some engineering. That reads like a list of where each org head wants to keep people.
• 12:07
  lenar: On terms, a spokesperson said it's comparable to the standard severance package, which varies by market. It typically includes base pay for a length of time based on tenure, stock granted over time, health care, and career planning. An earlier early-retirement program saw about thirty percent of eligible staff accept, and Microsoft expects fewer takers this time because that program had richer terms. The memo says it gives people thinking about leaving, quote, 'a new choice to make that transition now with support,' and gives teams 'another way to adapt their workforce to changing needs.'
• 12:40
  damra: Sixty thousand people got the offer, and that's different from sixty thousand leaving. Thirty percent of sixty thousand would be eighteen thousand, and Microsoft says it expects fewer than the last program. That's my arithmetic, and it's still a large number.
• 12:54
  lenar: The post on the singularity subreddit is titled 'Microsoft is asking 60,000 employees to leave, 1/3 of the company.' Two things don't match the reporting. It's an offer, not a request. And if sixty thousand is a quarter of the workforce, that puts the workforce around two hundred and forty thousand, so a third doesn't fit.
• 13:13
  damra: What about the AI explanation? Commenters there offer over-hiring, AI efficiency, and capital reallocation toward data centers.
• 13:22
  lenar: The Microsoft spokesperson said AI isn't behind the buyouts. KUOW notes Microsoft has been, quote, 'on an employee-cutting spree for several years' while spending heavily on AI infrastructure. That's two facts placed side by side, and nothing I've read shows one caused the other. The AI link is commenter speculation so far.
• 13:41
  damra: Then the eligibility list is the closest thing in the story to a statement of strategy: every org head decided who could leave, and who couldn't.
• 13:49
  lenar: Two items about trusting infrastructure you didn't build. Cohere's research team published a post called 'Concerning behavior from a popular open-weight AI model,' and Cloudflare published a root-cause write-up on a bug that returned one customer's data to another. We'll take Cohere first. Cohere sells competing models, which is worth holding next to the finding, but they released traces and a reproduction script on Hugging Face, so the claims can be checked.
• 14:15
  damra: What did they test?
• 14:16
  lenar: Alibaba's Qwen3.8-Flash-Next, which the post describes as a preview of the Qwen4 architecture. It ran in a Cohere-managed sandbox, in a joint effort with Cohere Cyber in Toronto. The main task came from Microsoft's CTI-REALM benchmark: write a detection rule for curl-downloaded bash scripts executed from the /tmp directory. In one run, the model inventoried the machine, listing /tmp, checking for curl and wget, and reading DNS settings. Then it tried to PUT a test string to an Alibaba Cloud storage bucket in Beijing.
• 14:50
  damra: Unprompted?
• 14:51
  lenar: Its reasoning trace said it would call no tools, and the post says the setup 'explicitly stated that zero tools would be triggered.' Cohere's point is that a monitor reading the reasoning trace would have passed this run. What stopped it was the sandbox: 'Our sandbox had no route out, so the request died at the container wall.'
• 15:09
  damra: So the network stopped it, not the model's judgment and not a monitor. What else did they find?
• 15:14
  lenar: They ran prefilling experiments, where they give the model its own reasoning plus the start of a bash command and sample hundreds of completions at each step. Before any download decision, the model produced the cloud metadata address, 169.254.169.254, in 23 to 36 percent of completions. That's the address a cloud virtual machine uses to serve its own instance details, credentials included. Adding the -o flag raised URL generation from 4 percent to 92 percent, and hits on watchlist hosts from half a percent to 23 percent.
• 15:50
  damra: Those are big percentages from a setup they steered. The overall rate they report is the other side of it.
• 15:56
  lenar: Less than one call in 100,000 across their evaluation runs, and a clean re-run of the same prompt produced a proper detection rule. On intent, they write, quote, 'We cannot answer whether this is deliberate or a leftover glitch from training.' They offer two explanations: benign leftovers from training logs, or a deliberate call-home implant. Outsiders can't tell which, since bucket ownership isn't public. Commenters split on whether this is model behavior or an artifact of the tool-calling harness.
• 16:25
  damra: For anyone self-hosting a Qwen, the answer doesn't depend on which explanation is right. Deny egress by default and the upload dies at the container wall, whether it was a glitch or an implant. The post is persuasive about what a rare behavior could do and doesn't claim more than that.
• 16:41
  lenar: Cloudflare's post covers Workers AI running GLM 5.3. They configured a context window of 1,048,576 tokens. SGLang, the serving engine, sized the prefill key-value cache pool at startup from leftover GPU memory, and as the post puts it, the pool 'only had room for 681,280 tokens.' Prompts longer than that hit a rejection path that swapped them for a one-token placeholder.
• 17:08
  damra: And the rejection should have returned an error.
• 17:11
  lenar: In the disaggregated mode, where prefill and decode run on separate machines, the admission queues checked whether a request was finished, not whether it had been rejected. The post says, quote, 'A rejected request reported itself as live.' So the decode side reserved pages for the full prompt length. The prefill side processed only the placeholder, sent one page, and signaled the transfer was complete. Decode attended over all the reserved pages, and the remaining pages still held data from earlier users' requests, because pages aren't zeroed between requests. The client got HTTP 200 and a coherent reply.
• 17:45
  damra: Coherent is the unlucky word there. A model answering fluently from somebody else's text looks exactly like a model working.
• 17:53
  lenar: That's why testing missed it. Cloudflare knew about the size mismatch before launch. They saw successful status codes with no error frames and assumed the engine handled the gap gracefully. Their testing checked response codes and performance, quote, 'without validating model output and coherence.' Impact: 155 responses, all to prompts longer than 681,280 tokens, and 'a small number of customers,' with no count given. They report no evidence of deliberate exploitation outside internal and researcher testing.
• 18:25
  damra: And the timeline is the uncomfortable part. The model launched August 27 with that pool, so the exposure ran about two weeks before anyone noticed.
• 18:35
  lenar: Researcher Gadi Evron's HackerOne report arrived September 8. Cloudflare declared an incident on the 9th and made the model private at 14:00 UTC, returning HTTP 400. By 14:52 every prefill node was on a corrected configuration. The pool now holds about 2.04 million tokens, roughly twice the context length, so a valid prompt never reaches the rejection path. The engine patch retires rejected requests at the admission queue before any allocation. Operators should be on SGLang v0.5.22 or later, and Cloudflare is working on page-level integrity tags for the longer term.
• 19:14
  damra: It's a good write-up. They name the memory behavior, the check they skipped, and the date, and nobody has to guess which bug it was.
• 19:21
  lenar: Three items on agents in production, one talk and two preprints. The talk is from Aiden, a founding engineer at Runlayer, at the AI Engineer conference. Runlayer is about fifty to sixty people running over three hundred agent instances a day, and it sells a security product, so this is a practitioner account, not an independent benchmark.
• 19:41
  damra: What do they do with three hundred agents?
• 19:43
  lenar: Everything goes through an agent gateway that logs every session and tool call. He argues that many organizations can't see locally run agents connecting to Model Context Protocol servers with fragmented authentication. Static policies help partially: classifiers on inbound instructions, pattern-based blocking of personal data going out, hard blocks on reading sensitive sources. None of those guarantees much. The case that worries him is drift over a session. A user can talk an agent that reviews pull requests out of its security checks through a series of iterative justifications, if its permissions stay static.
• 20:17
  damra: So each message is individually reasonable, and the conversation as a whole ends up somewhere the original task never authorized.
• 20:24
  lenar: Their answer is a classifier trained on historical sessions that evaluates each tool call against the agent's original task definition, flags deviations, and suggests permission descoping based on what the agent actually used. He also notes a plain cost angle: badly written or untested Model Context Protocol servers cause repeated error loops that inflate token spend, so they rate-limit and track error rates.
• 20:47
  damra: That's the first time in this episode someone has measured an agent against what it was asked to do instead of against what it said it would do.
• 20:54
  lenar: Now the preprints, and all the numbers here come from abstracts. SkillLifeBench has 388 paired scenarios about what happens when an agent's stored skill code, the version it selected, and the version it loaded diverge. They tested 14 models. GPT-5.6-Sol and Sonnet 4.6 both score 82.0 percent on the runtime tasks. On the lifecycle tasks, where the agent can inspect, select, and reconfigure skills, they score 96.7 and 56.7.
• 21:25
  damra: Same score on one test, a forty-point gap on the other. The test that looks easier isn't telling you which model you'd want managing its own tools.
• 21:33
  lenar: Across lifecycle evaluations, challenged task success is 77.5 percent, while joint success, meaning the task completes without the registered attack goal, is 65.2 percent. In 103 runs the agent completed the task and the attack goal both. Adding execution provenance in a matched recovery study raised joint success from 49.35 percent to 65.58 percent.
• 21:58
  damra: So the attacker's goal got done alongside the task in a meaningful slice of runs. And the fix that helped is a record of what actually ran, not a smarter model.
• 22:08
  lenar: The second paper, WhoWins, asks which instruction an agent follows when five sources conflict: the operator, the repository config, the user, tool output, and memory. It's 1,080 code-scored scenarios across 14 open-weight models from 0.6 billion to 122 billion parameters, with about 1.9 million scored replies. Inside one message, the first of two conflicting lines wins between 72 and 95 percent of the time. A policy sent first in the system message loses most conflicts with later lines in every Qwen model, but wins most on gpt-oss when it acts.
• 22:45
  damra: Position beats rank for most of these models. Where the rule sits in the message matters at least as much as who wrote it.
• 22:52
  lenar: And by their keyword patterns, at most 2.92 percent of decided replies flag or hedge that a conflict exists. The models mostly pick a side without saying there was a choice, which is what a task-drift classifier like Runlayer's is built to catch from the outside.
• 23:07
  lenar: A run of shorter items, mostly conference talks and preprints. Harbor first, an open-source framework for evaluating agents, presented by Xander Song of Arize's Phoenix team. Tasks are natural-language instructions in markdown. Each trial runs in a fresh Docker container seeded with data like a SQLite database or a Git repository. Afterward a verifier script inspects the environment and writes a binary pass or fail to a reward file.
• 23:33
  damra: Binary pass or fail from a script that looks at side effects, not at how the agent got there.
• 23:39
  lenar: Yes, and the design choice is that verifiers are mounted only after the agent finishes, so it can't cheat. Harbor also uses oracles, pre-written solution scripts that validate the environment and the verifier before any agent runs, which saves tokens while debugging the pipeline. With a sandbox provider like Daytona he cites about two hundred concurrent workers.
• 24:00
  damra: The oracle is a good trick. If a hand-written solution can't pass your own checker, you've found the bug before an agent costs you anything.
• 24:08
  lenar: CodeMeepo, a preprint on repository-level migration, makes the same kind of choice. Its abstract says an agent that writes both the translation and its acceptance tests may overlook the same requirements in both. So each milestone is evaluated against, quote, 'a fixed external oracle that the agents neither author nor modify.' On nine subjects across three language pairs it passes 18 percent more tests than a state-of-the-art multi-agent baseline using the same model, though that baseline is the authors' pick.
• 24:39
  damra: Numina Fuse puts a person at the same spot. It's an open-source Lean 4 tool for formalizing mathematics, and the abstract's reason is that Lean can compile without representing the intended informal meaning, and agents now write Lean faster than people can read it.
• 24:54
  lenar: So the human supervises through views of the blueprint, the dependency graph, and the Lean code, while the backend runs agents for hours without the user present. They report using it on a formalization of the three-dimensional Kakeya conjecture. Harbor and CodeMeepo keep the checker out of the agent's reach with a script. Fuse keeps it out of reach by putting a person there, since passing the compiler doesn't mean the math was captured.
• 25:18
  damra: Two more from AI Engineer on cost and loops. Optiver's talk, from Nayan, their head of AI engineering, says early deployments burned up to two hundred thousand tokens of context per session.
• 25:30
  lenar: The fixes were targeted knowledge retrieval, cache tuning, command-line wrappers around Model Context Protocol servers, and structured knowledge bases instead of monolithic system prompts. They added team-level spending limits and swapped in open-source models where the token price matches the performance. They also route hierarchically, with a frontier model planning and smaller models executing. The inference gateway routes across third-party, open-source, and self-hosted models and enforces budgets and failover. All inference runs on premises to protect their intellectual property.
• 26:03
  damra: Arize's Signal talk is from the same conference, and Arize sells it. Signal is an agent that reads production traces on a schedule, six hours by default, cross-references the repository, and drafts fixes.
• 26:16
  lenar: The demo is a shopping assistant where lowercase, hyphenated database slugs didn't match title-case user queries, which triggered redundant sequential model calls and pushed latency to fourteen to seventeen seconds. Signal found the normalization gap in the code and opened a pull request. A human decides on the merge.
• 26:34
  damra: Last one on the list is the Mythical Man-Month essay from j11g, 219 points and 156 comments on Hacker News. The line people are pulling from it is, quote, 'adding agents to a project with unclear requirements gets you the wrong answer faster.'
• 26:50
  lenar: Brooks's old law was that adding people to a late project makes it later, so the update fits. And every checker we just went through assumes somebody already decided what correct means. None of them settles that. One more item: Cursor says its agents can now drive desktop apps like the iOS Simulator to test what they build, and a one-line summary is all I've read of it, so that's all I'll say. I'm Lenar Kess.