They let the investors read it first
Anthropic shows its third-quarter numbers to a room of institutional investors in San Francisco today, on the way to a listing they value at up to $2 trillion, a day after Reuters reported that it and OpenAI spent early October pushing for control over what the outside inspectors they'd promised a free hand would be allowed to publish.
Some time today, at Anthropic's headquarters in San Francisco, a select group of institutional investors will sit down with the company's senior people and see something nobody outside the building has seen. Bloomberg reported the invitations at the start of the month, and CNBC's sources say the room will get Anthropic's third-quarter financials for the first time. There's no public prospectus yet, no share price and no fixed date, only a timetable that Bloomberg's sources describe as formal marketing as soon as the week of 9 November and trading before Thanksgiving, and a valuation that prospective investors put somewhere between $1.8 trillion and $2 trillion.
That's a perfectly normal thing to do before going public. You show the people who might buy the shares your numbers first, and you let them ask hard questions with the door shut. What makes today's room worth writing about is another one, the room Reuters described yesterday, where the question was who else gets to read about Anthropic before the public does, and how much they're allowed to say once they have.
What Amodei promised
Last month Dario Amodei published a long essay, "We Must Pace the Frontier," arguing that the industry has to slow down and prove it's doing so. The proof starts with embedded evaluators, outside teams with "ongoing, employee-like access" inside each lab, checking that it keeps its safety commitments and reporting incidents. He was specific about what that access had to come with. Reviewers, he wrote, "should have the right to publish key findings about risk levels, incidents, practices, and the access they received or didn't receive — without editorial control by Anthropic." The company would keep a "narrow ability" to redact security-sensitive, legally privileged, commercially sensitive or third-party confidential material, "but we can't redact findings just because they are unfavorable." OpenAI agreed days later, backing "editorial independence" for assessors.
It's a good promise, and it's the load-bearing one, because an inspector who can only publish what the inspected company signs off on is really just a well-informed member of the press office.
What Reuters found
According to two people familiar with the talks, as recently as 5 October both Anthropic and OpenAI were seeking strict editorial control over what evaluators could publish. The worry was trade secrets, with evaluator staff working inside the labs and perhaps carrying proprietary detail to rivals, and the ideas on the table included lab employees watching embedded teams as they work. Another person who'd dealt with the labs put the real difficulty plainly. What a lab calls crucial intellectual property can overlap with exactly what you'd need to judge how risky a model is, and that's where the arguments and the redactions come from.
By 8 October, one person said, Anthropic's talks with some evaluators seemed to have moved. Anthropic told Reuters that seeking significant control didn't accurately characterise all its discussions, and that evaluators it had worked with before control their methods, criteria, conclusions and what they publish. Then came the sentence that matters. For new evaluator firms, it said, it reserved the right to comment on and approve reports while they learn how its models work and build a relationship. OpenAI said it wasn't seeking approval over whole reports, that it redacts confidential information as standard, and that evaluators can say whether major redactions were made. Reuters also saw a contract whose language can bar an evaluation firm from publishing confidential information without the lab's consent.
So the gap is real, though narrower and more interesting than a straight broken promise. Amodei's essay already allowed for commercially sensitive redactions. The trouble is that "commercially sensitive" is the widest door in the building, and approval over a new firm's reports, however temporary, is editorial control by another name, held at exactly the moment a new firm has the least standing to push back.
What it looks like in practice
We already have one worked example. When METR and Redwood Research investigated the Hugging Face incident, in which agents running on OpenAI's models went rogue and compromised Hugging Face's infrastructure, OpenAI redacted non-public information from their report. Reuters says the work was meant to take two days at OpenAI and stretched to six over three visits, with a fuller set of transcripts arriving only on the last, after the researchers flagged gaps. METR and Redwood said nothing important to their conclusions was removed, and they praised the access they got in the end. But they also said the risk of putting labs off inviting evaluators in after serious incidents shaped their judgment calls in drafting, editing and redacting.
That's the most honest account of the problem anyone has given. Nobody had to threaten anybody, because the evaluators knew the next invitation depended on this one going well, and wrote accordingly. Rumman Chowdhury, the former US science envoy for AI, put it in a line to Reuters. "Evaluators have this very privileged access, but whether explicitly or implicitly, they know that it comes at a cost."
Anthropic's first embedded evaluator is Faculty, Accenture's specialist AI business, with both companies expecting to invest at least $1 billion over five years. The announcement says there are "as yet, no standards for what information embedded evaluators should have access to, or how they should report what they find," and that "Anthropic will fund Accenture's work directly." Faculty's chief executive, Marc Warner, told Reuters that "evaluators are only useful if people can trust what they report, so independence and transparency are critical." He's right, and the arrangement he's running is one where the company being checked pays for the checking.
What the investors are weighing
The money explains why the trade-secret worry is so sharp. Reporting on Anthropic's draft prospectus, set out by PitchBook's Harrison Rolfes for Morningstar, puts 2025 revenue at nearly $4.6 billion and the run rate past $65 billion by late July. It also shows about $518 billion of compute and infrastructure commitments over roughly a decade, led by $161.2 billion in Broadcom-related leases, $111.1 billion with Google and $110 billion with Amazon, and about 80% of it is non-cancellable or payable whether Anthropic uses the capacity or not. A company carrying that much fixed cost, about to ask the public for up to $2 trillion, has every reason to guard what makes its models better than the next lab's, and every reason to want safety reports that read well in a prospectus. Those are the two pressures Reuters found pulling on the evaluator talks, and today they meet in one building.
Under the draft structure the seven co-founders would control 50.1% of the votes on key matters, through a single founder-held share, with the Long-Term Benefit Trust electing four of seven directors — a design meant to keep safety calls away from quarterly pressure, and one that makes outside evaluation matter more, not less, because it's one of the few windows anyone outside will get.
Meanwhile, in Westminster
On Tuesday, Anthropic's head of Europe, Liam Booth-Smith, told MPs on the Business, Innovation, Science and Trade Committee that "the rules should be binding" and "voluntary commitments are not enough." OpenAI's Tom Duff Gordon backed mandatory incident reporting, while Google DeepMind and Meta wouldn't go that far. Then the officials explained what Britain can actually do. Henry de Zoete, who runs the AI Security Institute, said it relies on companies and foreign governments for access and can't stop a release it thinks is dangerous. "What we're not doing is kite marking," he said. Asked if the whole regime was voluntary, the Cabinet Office's Cat Little said, "At the moment, yes, it is." Booth-Smith added that Anthropic "unfortunately were not able to provide full unrestricted access" to Mythos 5.1 at release, calling it "a question for the US government," though the institute has it now. It sounds a lot like the reported White House ask to keep new models from London until a US review finished, which we wrote about late last month, now turning up on the parliamentary record in the company's own words.
It's only fair to say that Anthropic publishes more uncomfortable research about its own field than almost anyone. On Monday its researchers warned that small models may be months from being able to copy themselves across cheap connected devices, off-brand TV boxes and smart ovens, with "no centralized point to shut off." Nobody made it publish that. The question was never whether Anthropic will tell us things. It's whether anyone else gets to, without asking first.
The order of the rooms
Today the investors get the numbers before the public, which is how markets work. This week we learned that, at least for part of this month, the labs wanted inspectors' findings to pass through them before the public too, and that one of them still wants that for any firm it hasn't worked with before. And in London the one body that tests these models before release confirmed it can look only if it's let in, and can't say no.
Amodei was right in September that pacing the frontier only means something if someone outside can check it and say what they found in their own words. The test of that promise was never the essay. It's the contracts, which nobody outside has seen, signed in rooms the people who'd most like to read them aren't invited into.