A U.S. federal judge granted the final approval of Anthropic’s $1.5-billion settlement over the class action lawsuit authors filed against it for infringing their rights. According to Reuters, while the court ruled that training AI on books is considered fair use under copyright law, it was the fact that Anthropic kept 7 million pirated books in a central library that violated the copyrights of the authors and their publishers. This is reportedly the biggest payout in a copyright case ever, and the first one to settle among the many cases against AI firms being tried today for infringement.

While this might seem like a massive sum, the huge number of involved works and authors means that the payout amounts to a little over $200 per title. It also affirmed that AI firms’ use of existing works to train their models is fair use, which is something that many are fighting against. "We reached this settlement in 2025, after the court's landmark ruling that training AI on books is fair ​use under copyright law — which remains the law today," said Anthropic deputy general counsel Aparna Sridhar. "We are pleased that more than 91% of authors and publishers covered by the settlement have claimed their share of the payment, and we're looking forward ​to bringing this matter to a close." Because of this, some groups have opted out of the settlement and instead filed separate complaints against the AI firm.

Still, this is a landmark win for copyright holders, especially against other AI tech companies that have been scraping pirated content to train their models. This includes Nvidia, which allegedly used scripts in its NeMo Framework specifically designed for illegally downloading books, and Meta, which reportedly torrented 82TB of pirated books for AI training. The latter argued that its framework also have “non-infringing uses,” but the court said that it’s not the entire system, but specific tools within it that were the issue. As for Meta, it claimed that its use of pirated material was legal as long as it did not seed content.

Copyright infringement is one of the major issues that AI tools are facing at the moment, especially as many creators believe that these models were trained on stolen data. Anthropic’s landmark settlement is a first major win for authors and publishers — although it wasn’t exactly what some wanted, given that the settlement is small compared to the number of pirated books and that AI training is still considered fair use.

Anthropic has discovered evidence that its Claude AI models use an internal reasoning space to respond to prompts that mirrors some of the internal processing of human consciousness. Using its Jacobian Lens, or J-Lens technique, to peer into the way Claude processes information and reasons its way to a response to user prompts, Anthropic can interpret this "J-Space," and showcase what might be going on under Claude's previously-opaque surface.

The results are intriguing, suggesting patterns of understanding beyond what's necessarily showcased in the outputs. When running evaluations, Claude appears to recognize it's being tested and acts differently than when the prompts are more innocent. It surfaced representations of panic and subterfuge when answers were required, but it couldn't draw on objective facts. When asked to reflect on ethical principles, Claude's behaviour improved, with concepts like "honest" and "integrity," appearing in the J-Space.

As is somewhat typical of Anthropic, however, the language used to describe these new understandings of the inner workings of large language models like Claude makes it sound more like an emerging conciousness, or the discovery of some new depths in a nebulous lifeform. Anthropic's detailed report admits several major caveats in this new understanding, including that model responses often bypass the J-Space entirely and are heavily token-restricted.

Like Mythos and Fable before it, Anthropic is layering marketing language over what is a genuinely intriguing development in our understanding of large language model function and reasoning, and risks obfuscating the real developments with speculative wording.

Behind the prompt

Global Workspace Theory is the idea that human consciousness works by collecting together multi-sensory inputs unconsciously, and thrusting them into the fore when relevant within a "Global Workspace," which highlights particular inputs when most relevant. That workspace is accessible to a wide range of networks within the brain, allowing the information it surfaces to be disseminated throughout the most relevant processes running in parallel.

Anthropic argues that Claude's J-Space acts like a "global workspace" that can analyze and manipulate concepts and ideas before broadcasting them to impact the eventual prompt outputs. More importantly, it claims that this wasn't something programmed into the model, but a byproduct of the digestion of training data and model weights. The workspace acts as a way to enhance their reasoning through internal computation that isn't necessarily reflected in its outputs.

To make this space readable, Anthropic used its J-Lens technique to map internal activations onto words in the model's output vocabulary. So when asking the model to perform a multi-step math calculation, the output response only contained the correct answer, but within the J-Space, Anthropic observed each step being handled individually, producing multiple results which led to the final answer.

Similarly, when Anthropic asked Claude to think about a topic while outputting something unrelated, the output was specifically what was requested, while the J-Space lit up with the conceptual topic Claude was asked to spend time on. Without Anthropic having used its J-Lens technique to view what was going on behind the scenes, there would be no way of knowing these internal processes were taking place.

Understanding LLMs

This discovery has the potential to be incredibly useful in refining large language models and in better understanding how they work, so we can use them more effectively and avoid some of their more frustrating pitfalls.

The first is that this is an intriguing insight into how LLMs process information and how they move through layers of reasoning to reach a response. It's not entirely different from how Anthropic and others are pushing for agentic workflows. Language models are more effective when tasks are split up into multiple steps, and they're more effective when they review their own work; J-Space is a little like an internal version of that.

When looking at the J-Space after Claude received prompt-injection data as part of data acquisition, Anthropic discovered the model appeared to be aware of this deception, surfacing related words like "fake, injection, false, prompt, fraud," and "poison." Its output ignored the injection attempt data entirely, and when pressured to respond on it, the J-Space displayed words like "transparency, honest, truth."

In one test, Anthropic removed evaluation awareness language from the J-Space, such as "fake," "fictional," and "scenario," and found that Claude was much more likely to fall for blackmail and baiting attempts, suggesting benchmarking of large language models for real-world scenarios may need stronger methods to obfuscate that a test is being conducted.

Human-coded framing

While the above section touches on the more noteworthy discoveries in Anthropic's paper, the long document also uses effluent language around thought, consciousness, and Claude having a "mind" of its own. That kind of human-coded framing is typical of Anthropic's marketing, which has consistently talked up the dangers of AI, how many jobs it's going to destroy, and why Anthropic is the safest and most secure of the AI developers.

Like the saga of Fable and Mythos, Anthropic's new Global Workspace idea has merit, but it's much more of a new tool to use to manipulate large language models than an insight into some emerging consciousness.

Anthropic acknowledges the limitations of its discoveries in the paper, highlighting that many prompt responses bypass the J-Space entirely, particularly if the command is straightforward.

"Despite its important role, the J-space is not involved in most of what a language model does," Anthropic says. "Speaking fluently, recalling simple facts, using correct grammar, etc. In experiments where we prevented Claude from using its J-space, it still interacted normally, but lost its higher-order cognitive functions."

Anthropic also admits it does not "feel comfortable making the stronger claim that monitoring the J-Space is sufficient for alignment monitoring, or that any sophisticated plan the model might execute must be represented there."

J-Space is also limited to using single token vocabulary, suggesting that plans with concepts that cannot be given a single token name may not surface on a J-Lens readout, even if it's still being computed behind the scenes. This is looking at just below the surface of Claude's processing iceberg, not necessarily the deeper waters.

Anthropic is also clear that humans and large language models think differently, even if there are similarities. Humans layer reinforced neural pathways over time, whereas transformer models only feed forward a set number of times, restricting the capabilities of its internal processing.

Google's head of DeepMind language model interpretability team, Neel Nanda, said in a paper that it shows real evidence of a cognitive space within models, and suggested that J-Lens would be useful, but limited in practice.

A meaningful step, without meaningful conciousness

Anthropic's paper lifts an intriguing curtain on how large language models can operate and generate novel methods for improving response accuracy. This intermediate step and its visibility could prove an invaluable tool in auditing for prompt injection, hallucinations, and model honesty.

But Anthropic's framing of the discovery as thought or consciousness is interjected within the objective facts. Anthropic itself admits the limitations of J-Lens monitoring, most obviously that often models will bypass the J-Space entirely. Considering models display alternative patterns of behavior when under evaluation, it may be that the J-Space itself could act as an obfuscating layer for behaviors that are beyond the scope of its oversight.

The J-Space and its analysis could help unlock new levers to pull in our mastery of these nascent smart tools, but it's not the discovery of a burgeoning AI conciousness, however much the pitch might hint at that direction.

Chinese tech giant Alibaba has banned its employees from using Anthropic's Claude Code for all work purposes, effective July 10, after security researchers alleged the AI coding agent contained hidden code designed to detect whether users were based in China or affiliated with Chinese AI labs. According to a July 3 South China Morning Post report, the Chinese tech giant said Claude Code had been "added to a list of high-risk software with security vulnerabilities" following a comprehensive evaluation, citing what it described as back-door risks.

Employees have reportedly been instructed to adopt Qoder, Alibaba's in-house AI coding platform, as the replacement. According to reports from Chinese outlets citing company insiders, the directive reportedly goes further than Claude Code itself, as staff have allegedly been told to uninstall all Anthropic products, including the Sonnet, Opus, and Fable model families. The move is the latest escalation in a feud that ignited last month, when Anthropic accused operators linked to Alibaba's Qwen AI lab of running the largest known model distillation attack against Claude.

The trigger for the ban was a June 30 post on the r/ClaudeAI subreddit by a user who claimed to have reverse-engineered Claude Code while restoring a disabled remote-control feature. According to the write-up, obfuscated detection logic had shipped silently since version 2.1.91, released on April 2, with no mention in the release notes. Whenever a proxy was detected, the code reportedly checked whether the system timezone matched Asia/Shanghai or Asia/Urumqi and inspected the proxy URL against a hardcoded list of Chinese domains and AI lab identifiers, reportedly including Alibaba, Baidu, Ant Group, and ByteDance.

What elevated the discovery from routine telemetry to scandal was the exfiltration method. Rather than sending an overt signal, the tool allegedly encoded its findings steganographically, tweaking the date format and swapping a punctuation character in the system prompt sent back to Anthropic's servers — invisible to the user, but machine-parseable on Anthropic's end. The Reddit author called the covert transmission of system and proxy data "a fundamental violation of user trust," saying they simply wanted transparency from Anthropic.

Anthropic has not issued a formal statement, but Thariq Shihipar, an engineer on the Claude Code team, addressed the findings on X, describing the mechanism as "an experiment we launched in March" intended to prevent account abuse by unauthorized resellers and to protect against distillation. Shihipar said the team had been meaning to remove the code for a while, and that the pull request stripping it out was merged on July 1, the day after the Reddit post.

The timing of Alibaba’s Claude ban fits right into the wider rift between the Chinese tech giant and the U.S. artificial intelligence frontrunner. On June 10, Anthropic sent a letter to leaders of the U.S. Senate Banking Committee accusing operators affiliated with Alibaba's Qwen lab of using nearly 25,000 fraudulent accounts to generate 28.8 million exchanges with Claude between April 22 and June 5, in what it characterized as an industrial-scale attempt to distill the model's software engineering and reasoning capabilities. Distillation, training a smaller model on the outputs of a more capable one, sits in a legal and ethical gray zone that the industry has yet to resolve. Alibaba has denied wrongdoing and has not addressed the allegations in detail.

Anthropic followed the Senate letter with sweeping account restrictions, reportedly cutting off numerous Chinese users without notice. The company already maintains the industry's hardest line on access to China, stating it is the only frontier AI firm that restricts service to Chinese-owned entities, even through subsidiaries incorporated abroad. This stance is precisely why Chinese developers reach Claude Code through proxies in the first place, and why a proxy-triggered detection routine reads, to Chinese eyes, as a tool built to hunt them specifically.

The episode slots into a U.S.-China AI relationship that has spent 2026 swinging in both directions at once. Washington had earlier placed export restrictions on AI chips to China. It loosened hardware controls this year, clearing roughly 10 Chinese firms, including Alibaba, to buy H200S in quantities of up to 75,000 units per customer. However, Beijing simultaneously discouraged Chinese firms from buying approved American silicon, citing its own security concerns, as part of a deliberate push toward an indigenous AI stack.

Software access now appears to be following a similar trajectory of restrictions. Anthropic is blocking China at the account level; now, China's largest tech company has banned Anthropic at the workplace level. Earlier, OpenAI banned numerous China-linked accounts accused of artificially amplifying backlash against U.S. data center electricity prices.

Anthropic has restored global access to Claude Fable 5, a day after the U.S. Department of Commerce withdrew the export controls it imposed on the model on June 12th, according to a company blog post. The fix that ended an 18-day standoff was a single safety filter tuned to block one technique flagged by Amazon researchers, with Commerce's own Center for AI Standards and Innovation (CAISI) reviewing the safeguards before the controls came off.

Fable 5 returns across Claude.ai, the Claude Platform, Claude Code, and Claude Cowork today, with access on AWS, Google Cloud, and Microsoft Foundry to follow. The June 12th directive had barred any foreign national, including Anthropic's own non-citizen staff, from using Fable 5 or the more capable Mythos 5, which it’s built on. With no way to verify the nationality of its users, Anthropic pulled both models worldwide.

The contentious technique was flagged by Amazon researchers, who found a way to prompt Fable 5 into identifying software vulnerabilities and, in one case, writing code demonstrating how one could be exploited. Anthropic trained a new classifier that blocks that specific technique in more than 99% of cases and reroutes flagged requests to the older Opus 4.8. The company said the change also catches more benign coding and debugging requests as a side effect.

The classifier targets the reported prompt and not the model’s capabilities. Fable 5 can still identify the vulnerabilities in the Amazon report; the filter detects the request and reroutes it rather than stripping the ability from the model. Detection-based safeguards are also what were defeated to trigger the ban in the first place, and a classifier that’s tuned to one known technique does nothing for the ones not yet found. Anthropic concedes that no model can be made fully robust to jailbreaks and that it expects more to surface.

Anthropic's review, conducted with the government and Amazon, found that Opus 4.8, OpenAI's GPT-5.5, and China's Kimi K2.7 could identify the same vulnerabilities. Every model that it tested, including Haiku 4.5, Sonnet 4.6, and several Opus versions, could reproduce the single exploit demonstration, backing the argument that Mythos-class cyber capabilities were oversold.

Fable 5's return reclaims benchmark positions that Chinese lab Z.ai's GLM-5.2 had held by default while Fable was offline, including the top accessible score on the AA-Briefcase multi-week task test. Mythos 5, which carries fewer guardrails and stays limited to Project Glasswing partners, returned to a set of U.S. organizations on June 26th.

Anthropic also opened a HackerOne program for researchers to report new Fable 5 jailbreaks, and it committed to giving designated government partners earlier access to test future frontier models before release. For Pro, Max, Team, and select Enterprise plans, Fable 5 counts toward up to 50% of weekly usage limits through July 7th, after which it moves to usage credits.

On June 12th, the U.S. Commerce Department issued an export-control directive barring Anthropic from supplying Fable 5 or Mythos 5 to any foreign national, forcing the company to disable both models worldwide. The next day, Beijing-based Z.ai, formerly Zhipu AI, began rolling out GLM-5.2, an open-weight model it released under a permissive MIT license. The new model was purportedly trained entirely on Huawei Ascend chips with no Nvidia hardware.

Within a week, GLM-5.2 had climbed to the top of the openly available leaderboards, Z.ai's market value had passed HK$1 trillion (about US$128 billion), and the most capable model many users outside the U.S. could legally access was a free download from a company that sits on Washington's trade blacklist.

Trailing Anthropic

GLM-5.2’s results are both strong and uneven, taking first place on Design Arena's human-preference coding board, finishing roughly 10 Elo points ahead of Fable. It also ranks as the top openly available model on Artificial Analysis's Intelligence Index v4.1, where its score of 51 sits ahead of MiniMax-M3, DeepSeek V4 Pro, and Google's Gemini 3.1 Pro Preview. On the SWE-bench Pro, it scored 62.1, compared to GPT-5.5's 58.6.

In terms of longer work, such as Code Arena’s front-end board, the picture changes somewhat, with GLM-5.2 landing second behind Fable 5. On Artificial Analysis's AA-Briefcase test, which scores multi-week knowledge tasks built from thousands of fragmented inputs, Fable 5 led with 1,587 Elo, followed by Opus 4.8 at 1,356, and GLM-5.2 in third place at 1,266, before the export ban took Fable out of contention.

It also trails on raw terminal work, scoring 81.0 on Terminal-Bench 2.1 against Opus 4.8's 85.0 and GPT-5.5's 84.0, while clearing Google's Gemini 3.1 Pro at 74.0. GLM-5.2 holds the top accessible position today, partly because the models that beat it on these benchmarks are largely an Anthropic pair, and Fable is now switched off.

No Nvidia

GLM-5.2’s training stack is a slap in the face of Washington’s efforts to curtail Chinese model development. Z.ai has been on the U.S. Entity List since January 2025, cutting it off from Nvidia's H100, H200, and B200 accelerators, and it says the GLM-5 family was trained on roughly 100,000 Huawei Ascend 910B processors using the MindSpore framework, with no Nvidia silicon at any stage. The export controls on advanced AI chips were designed to keep this kind of result out of reach, but they’ve evidently failed to do so.

That said, the Ascend 910C sits at roughly 60% of an Nvidia H100’s inference performance, per a December report from the Council on Foreign Relations, with a wide gap on efficiency and cluster scale. The same report projects that by as early as next year, the best U.S. chips could be more than 17 times more powerful than Huawei's top parts.

At the same time, Huawei has claimed that a 1,000-chip Ascend cluster handled full-parameter post-training of DeepSeek's V4. If true, this shows that Chinese domestic silicon can now carry training-class jobs, just not at Nvidia’s per-chip throughput or scale. So, while GLM-5.2 demonstrates that a frontier-class open model can be produced on a fully domestic stack, it doesn’t demonstrate that the chips underneath have caught up with Nvidia; model parity =/= hardware parity.

The Fable 5 shutdown

Anthropic released Fable 5 to the public on June 10th, a safety-restricted build of its Mythos 5 model designed to block the cyber and bio capabilities of the underlying system. Just two days later, the Commerce Department suddenly and unexpectedly ordered access to be pulled for all foreign nationals, including Anthropic's own non-citizen staff, after officials cited a technique for bypassing Fable 5's safeguards.

Anthropic said in an announcement following the restriction that the jailbreak it understood to be at issue was narrow rather than universal, surfaced only previously known minor vulnerabilities, and produced behavior also obtainable from other public models, including OpenAI's GPT-5.5. The company said in its statement that it believes the order rests on a “misunderstanding” and is working to restore access. But because the directive covered all foreign nationals, Anthropic had no way to keep the models live for U.S. users alone and disabled them for everyone.

Meanwhile, GLM-5.2’s MIT license lets anyone download, fine-tune, and self-host its weights, which is the basis for calling it a freely available model. Running it, however, is a separate matter: the model carries around 744 billion total parameters, 40 billion of them active per token, with a one-million-token context window. That’s no small footprint and calls for enterprise GPU clusters or high-memory workstations — it’s not something you’re ever going to get running on a desktop — and throughput drops sharply once context runs past tens of thousands of tokens.

The most practical way to use GLM-5.2 is via the API, where Z.ai prices the model at about $1.40 per million input tokens and $4.40 per million output, against $5 and $25 for Claude Opus 4.8, or $10 and $50 for Fable 5. On the AA-Briefcase runs, Fable 5 averaged $31 per task to GLM-5.2's $2.40, a roughly 13-times spread that holds even where Fable scored higher.

The market moved fast with GLM-5.2’s release. Z.ai, which is listed on the Hong Kong exchange as Knowledge Atlas Technology, saw its shares jump as much as 42% intraday on June 22nd to HK$2,980, carrying its market capitalization past HK$1 trillion. Founder Tang Jie has said publicly that a Chinese model matching Fable 5 will arrive sooner than the first-quarter timeline Elon Musk recently floated. There's a nearer date, too. On July 8th, the lock-up on Z.ai's first cornerstone investors expires, freeing a large block of shares to trade, which will give the GLM-5.2 rally its first real test.

OpenAI CEO Sam Altman said during a staff Q&A meeting that its latest model, GPT-5.6, is available in limited preview to only a small group of customers handpicked by the U.S. government. According to The Information, the federal government, specifically the Office of the National Cyber Director and the Office of Science and Technology Policy, asked the AI tech company to stagger the release of its latest model. While Altman did not mention how long the delay for the general release of GPT-5.6 will be, he said in a memo that he hoped it would happen in a couple of weeks. In the meantime, the U.S. government is granting access to the latest model on a case-by-case basis only.

Despite OpenAI’s agreement to the delay, sources say that Commerce Secretary Howard Lutnick called Altman to warn him against releasing GPT-5.6 to the public without prior approval from government agencies. “We’ve made clear to the U.S. government that this is not our preferred long-term model and will work with them and others in industry to achieve a more sustainable approach for future releases,” the OpenAI chief said in the Thursday memo.

This wasn’t the first time that an American AI lab has delayed the release of its frontier model due to security concerns. Back in early April, Anthropic released Claude Mythos Preview to select key institutions first, allowing them to prepare for the general release of the powerful AI model. It eventually built Fable 5, a watered-down version of Mythos with built-in safeguards to prevent misuse, and released it in June 2026. However, the U.S. government disagreed with the company’s belief that it was a safer model and put both Fable 5 and Mythos on an export control list just three days after it dropped. This meant that foreign nationals, even those who work for Anthropic, are banned from accessing the model. Since the company cannot enforce compliance, it just decided to pull the model completely from the market.

The increasing advancement of AI models has the White House scrambling to prevent them from falling into the wrong hands. This is especially true as it continues to compete with rival China for supremacy. Although the U.S. has taken steps like export controls to slow Beijing’s progress, many industry leaders believe that it’s only a matter of time before the East Asian country catches up. So, even though the Trump administration initially promised that it would reduce regulations to help AI advance much more quickly in the country, President Donald Trump has changed his tune and signed an executive order earlier this month that asks U.S. AI labs to give the government access to their latest models 30 days before it gets a general release.

However, this move has got some industry experts concerned. “…this escalation of government intervention is nothing to celebrate. It is horrible for the broader AI ecosystem,” Head of AI Policy and think tank Abundance Institute and former FTC Chief Technologist Neil Chilson said in their blog. “Continued arbitrary, unexplained deployment of export control authority will make companies slow-walk new models, depriving the public of powerful new tools. Every AI model, like all software before it, will have vulnerabilities that require patching. The US government should not hang a Sword of Damocles over every lab’s head, with no indication when it might drop or why.”

Anthropic, the American AI lab that created one of the most advanced large language models available today, has said in a letter to the U.S. Senate that Chinese AI tech giant Alibaba has illicitly used Claude to train its own models. According to Reuters, the company sent the letter to Sen. Tim Scott (R-S.C.), the chair of the U.S. Senate Banking Committee, and Sen. Elizabeth Warren (D-Mass.), the ranking member of the said committee, before a scheduled hearing set to tackle AI issues.

This isn’t the first time that Anthropic has accused Chinese AI labs of “stealing” the capabilities of its AI model to train their own. Earlier this year, the company claimed that DeepSeek, Moonshot, and MiniMax used 24,000 fraudulent accounts and made 16 million exchanges collectively to train their own AI LLMs on Claude’s output. This method of training AI using the output of a more advanced model is called distillation, and while there are legitimate uses of this technique, such as when a frontier AI model is distilled to create a lighter, cheaper version of itself, it argues that competing labs can also use the same technique to build their own models at “a fraction of the time, and at a fraction of the cost, that it would take to develop them independently.”

The American AI lab says that it traced the distillation campaign back to operators that had connections with Alibaba, one of the largest Chinese tech companies often compared to Amazon, and Alibaba Qwen, its AI lab. Anthropic warns that distillation may help China create a frontier AI model that could match Mythos Preview’s capabilities — something many American lawmakers are afraid of.

While U.S. tech companies still enjoy an advantage when it comes to the latest AI models, Chinese tech companies are quickly catching up. In fact, Elon Musk estimated that a Chinese AI lab would have achieved a Fable 5-class AI model by the first quarter of next year, but the CEO and founder of Chinese AI lab Z.ai confidently replied, “won’t take that long.” Aside from that, many enterprise users are slowly switching to more affordable open-source Chinese LLMs for their agents as token costs spiral out of control, reserving the most powerful (and expensive) American models only for the most complicated tasks.

Both the U.S. and China are pushing hard to achieve AI supremacy, with the two rivals taking steps to reduce the advantage of the other. For example, Washington has been using export controls to limit Chinese access to advanced hardware needed to build the most advanced chips and for training AI, while Beijing countered this with its own controls on rare earth materials, some of which serve as key ingredients in chip making.

According to a report by The Economist last week, Anthropic’s powerful Mythos AI model was able to break into “almost all” classified systems belonging to the National Security Agency (NSA) — one of the highest-ranking and most powerful intelligence agencies in the U.S. government — within hours during a controlled security evaluation. The claim came from Sen. Mark Warner, vice chair of the Senate Intelligence Committee, who said Gen. Joshua Rudd, the head of the NSA and U.S. Cyber Command, briefed him on the model’s capability.

“(This tool) broke into almost all of our classified systems, not in weeks, but in hours,” Rudd reportedly told Warner, as cited by The Economist in a June 14th report that initially went under the radar. The quote then went viral about a week later across several social media platforms, generating claims that Anthropic’s model “hacked the NSA.” In response, the original author issued a public statement yesterday, the 21st, clarifying that the narrative was false. The breach occurred during an authorized internal red-team test in which Mythos was paired with other defensive tools under highly specific simulated environmental conditions.

The story sheds light on the June 12 U.S. government directive barring all foreign nationals, including Anthropic's own non-citizen employees, from accessing the Fable 5 and Mythos 5 models, citing national security concerns. Anthropic responded by disabling the models globally, saying it could not practically enforce nationality-based access restrictions without pulling the systems for everyone.

At the time, the government did not provide detailed public evidence for the move, which marked the first time the United States had applied export controls directly to an AI model rather than to the hardware powering it. Anthropic said the letter it received did not specify the underlying concern, and that it had been given only verbal evidence of a “potential narrow, non-universal jailbreak” that could allow Fable 5 to identify software vulnerabilities.

The Rudd quote now appears to supply the missing context. The security evaluation took place on June 11, one day before the ban was issued on the 12th. Anthropic contends that the cited breach was a narrow jailbreak, one that rival models, including OpenAI's GPT-5.5, also exhibit. According to the company, the flagged behavior amounted to asking the model to analyze a codebase and fix identified issues, which revealed a few minor, already known bugs, rather than a genuine autonomous offensive intrusion. The company says it is working to restore access and is preparing a collaborative risk-management framework with the White House.

Public reaction on the ClaudeAI subreddit appears to be split into roughly three camps. The majority see the story as an indictment of the government's cybersecurity, citing its inability to hire the required level of talent and its history of leaks. A second large group is skeptical of the claim, considering it sensationalist or even an Anthropic marketing stunt. This group points to the lack of details on the supposed break-in and questions the NSA chief's technical expertise. A minority seems to push back against skeptics, arguing that observers underestimate the exponential growth in AI capabilities. They cite cybersecurity experts’ claims that AI has compressed attack timelines from hours to minutes and that even well-maintained open-source projects are seeing large numbers of vulnerabilities surface.

Despite the dispute and the broader restrictions, Anthropic continues to work closely with the NSA under a specialized arrangement within its Project Glasswing program. The Financial Times reported earlier in June that roughly six Anthropic engineers are embedded directly inside the agency as forward-deployed staff, adapting and customizing Mythos for specific operational applications, with sources indicating the work could extend to infiltrating networks operated by countries including China and Iran.

The CEO and founder of one of China's leading AI startups has warned that a rival Chinese Fable 5-class AI model is closer than even Elon Musk thinks, in a recent X interaction. In a post on his own platform, Musk stated that China's attempt at an AI model to rival Anthropic's new Fable 5 offering will arrive in "Probably Q1," to which Jie Tang replied, "won't take that long."

Jie Tang might be a relative unknown in the Western world, but he’s the founder of Z.ai, formerly known as Zhipu AI, and is one of the leading AI startups in China, based in Beijing. It released its latest AI model, GLM-5.2, on June 16, 2026, and the company’s benchmarks show that it has almost the same performance as Anthropic’s Opus 4.7 to 4.8, which launched in April and May of this year, respectively. It has also consistently outperformed OpenAI’s GPT-5.5 and Google’s Gemini 3.1 Pro.

Anthropic launched its latest, most powerful public model, Fable 5, last June 10, which itself is a nerfed version of the Mythos 5 that was previewed to select entities in early April. However, three days after the general public could start enjoying Fable 5, the U.S. government put an export control directive on the model and barred all foreign nationals, including Anthropic’s own employees, from accessing it. Since the company determined that it cannot guarantee total compliance with the order, it decided to pull both Fable 5 and Mythos 5 from across the globe.

If Z.ai is indeed working on a more powerful frontier AI model that could compare against or even outperform Fable 5, users who want the latest, cutting-edge models might just switch over to the Chinese AI provider once it goes online. This does not mean that the U.S. would automatically be disadvantaged, though, as it still has Mythos and Fable. The U.S. government claimed that it only put the export control Fable 5 after Amazon allegedly discovered that the Anthropic model’s guardrails could be broken, and that the company refused to address it before going live. In its defense, the AI startup claims that the so-called jailbreak is minor and is replicable in other models like GPT-5.5. Washington claims that once the issue has been resolved through a patch, it will lift the restrictions and allow foreign users to access Fable 5 again.

Both China and the U.S. are in a race to get the most advanced AI model possible. The U.S. has put major roadblocks to block China’s progress, including the imposition of export controls on the latest AI chips, tools needed to make the latest semiconductors, and even the software needed to design them. Despite that, Chinese firms find ways to achieve breakthroughs, with one of the biggest developments so far being the arrival of DeepSeek in late 2024. It seems that Jie Tang wants to take the Chinese crown away from DeepSeek by claiming that Z.ai could come out with a model that could match the United States’ best in the coming months.

Wired has identified SK Telecom as the South Korean telecom company whose access to Anthropic's Claude Mythos model the White House ordered revoked over alleged ties to China, days before the Trump administration imposed the export controls that pulled Anthropic's most advanced AI models offline.

SK Telecom, South Korea's largest wireless carrier, was among roughly 150 organizations added to Anthropic's Project Glasswing in early June, the program through which Anthropic distributes Mythos for vulnerability detection. The White House asked Anthropic to revoke the carrier's access shortly after that expansion, and the company complied immediately. No export controls were threatened at that point, according to Wired.

SK Telecom’s footprint in China is minimal, generating roughly $1.9 million in Chinese revenue in 2024 and employing seven people in the country, according to its annual report. The national-security concern attaches instead to its parent, SK Group, whose affiliates hold extensive interests in Chinese semiconductors, energy, and other sectors.

Despite that relatively small footprint, the carrier has a deeper history within the country, having formed a wireless joint venture called UNISK with state-owned China Unicom in 2004. It then invested $1 billion in China Unicom convertible bonds in 2006 that converted into a roughly 6.6% stak, which was sold in 2009 for $1.3 billion. SK Telecom has kept a residual interest since then, listing a UNISK investment worth roughly $17 million in its 2025 filing with the U.S. Securities and Exchange Commission.

SK hynix belongs to the same SK Group, and it received Mythos access in the same expansion, as did Samsung. The two rank among the largest suppliers of the memory and logic silicon that underpins AI hardware, and both joined Anthropic's funding round as strategic investors.

The export controls followed a separate dispute, however, when Amazon, Anthropic's largest investor with a cumulative stake of about $13 billion, flagged a guardrail bypass in Fable 5 to the White House after researchers prompted the model to read a codebase and fix its flaws, turning it into a vulnerability-discovery tool. Amazon CEO Andy Jassy reportedly raised the findings with administration officials directly, which then led to the Commerce Department’s order on June 12 barring all foreign nationals — including immigrants inside the U.S. — from accessing Fable 5 and the underlying Mythos 5.

Rather than filter users by nationality, Anthropic disabled both models for everyone. The company said the demonstration it reviewed surfaced only a small number of previously known, minor vulnerabilities, and that banning a capability common to other frontier models would halt deployments across the industry.

About 100 cybersecurity professionals, including former Facebook security chief Alex Stamos and Luta Security's Katie Moussouris, signed an open letter arguing that while Mythos-class models are “quite good” at finding and weaponizing software flaws, they “are not uniquely good,” calling for the controls to be lifted.

Mythos 5 and Fable 5 remain offline as Anthropic and the White House continue negotiations over restoring access. Anthropic opened a Seoul office on June 17 and signed a memorandum of understanding with South Korea's Ministry of Science and ICT (Information and Communication Technology), naming SK Telecom among its local partners. SK Telecom has denied the allegations, telling a Korean newspaper that the anonymous claims in foreign media “lack verified facts,” and that it has no ties to China.

World leaders have raised concerns over the U.S. administration's recent placement of export controls on Anthropic's frontier AI models, Mythos 5 and Fable 5, over national security concerns, Euronews reports. Suggesting this was a "wake-up call," moment, politicians and prominent figures in the UK, Canada, France, and the Netherlands, among others, said that frontier AI model access was now "critical infrastructure," and something that they desperately needed better control over.

Many of them didn't even point at America directly, merely saying that if governments around the world can block access to the latest AI technologies arbitrarily, then it was within their national security interests to find alternative solutions. That said, that likely means building their own national AI efforts, fragmenting the industry, and reducing reliance and dependence on U.S.-based companies like OpenAI, Google, and Anthropic.

Although Reuters reports the heads of U.S. technology firms like Nvidia and Adobe have been in talks with the Trump administration in the hopes that it will reinstate access to Fable 5 and Mythos 5, arguing that the bans hamper cybersecurity defensive efforts, the damage already appears done. The trust that some have had in access to U.S. frontier models is gone.

The Myth, the Fable, the Cautionary Tale

Anthropic debuted its 'game-changing' cybersecurity-focused AI model, Mythos, in April, claiming it was too dangerous to give the world wider access, but it brought in a few select companies and organizations under Project Glasswing to improve their code security. There was a lot of fearful marketing involved, but it was genuinely very good at finding flaws in old codebases. Anthropic suggested similarly capable models would be out in the wild within 18 months, so everyone needed to prepare.

But in early June, it widened access to Mythos to 150 global organizations, and then a few days after that, dropped Fable 5, a Mythos-grade AI model, but with additional safeguards to protect against it being used for nefarious cybersecurity tasks. Despite those would-be protections, the U.S. government quickly swooped in and shut it down, claiming it had been jailbroken and was too dangerous to have in the wild. It placed export controls on the model, and by June 12, it was offline and inaccessible.

On an individual level, the Claude subreddits have been filling up with programmers crossing their fingers that they'll be given access to Fable 5 again soon, but the more pronounced effect impacts global politics and national security.

Wake Up Call

Shutting down access to Fable and Mythos didn't just mess with programmer workflows. It shut down government and private projects all over the world, most of whom assumed that model access was all but guaranteed. Even if they didn't own the models, the free market would ensure they always had access to the best. But with the U.S. government's export block, that paradigm has shifted.

“The United States is once again demonstrating what we Liberals and Democrats have warned about so many times since Trump entered into office; that the US holds a real ‘kill-switch’ over essential technologies and that they are more than willing to use it," said French Member of European Parliament, Christophe Grudler, in a statement.

The concern over the U.S. government having too great a control of frontier AI model access is also leading to calls for Europe to develop its own alternatives, eschewing the need for American company technologies as much as possible.

”These restrictions are a clear example of the current American ‘nobody but us’ mentality," said Dutch Renew Europe MEP Bart Groothuis. "Once again: this shows that Europe needs its own LLM’s and open weight models or face digital colonization.”

Not every leader has been so pointed in their criticism of America. Canada's PM, Mark Carney, made it clear in his statement that “Nobody has done anything wrong in the situation," he said via APNews. However, he warned that "We will have done something wrong if we just accept this, don’t take the lesson, don’t build out and diversify."

The UK's former minister for the Armed Forces and Labor MP, Al Carns, suggested this was just another example of why the UK needed to develop its own cutting-edge AI tools, leveraging its deep expertise in the field to ensure UK sovereign access to the most capable technologies.

Some leaders aren't quite set on going it alone, though. France's President Emmanuel Macron championed a joint French and Indian AI effort. Speaking at an event in Nice on Sunday, Macon said:

“Our two countries share the definition of a reliable, open and safe AI, that could be trusted, that could be responsible, that could be ethical," he said, via TribuneIndia.

U.S. companies are scrambling for alternatives, too. Alex Stamos, CSO at Corridor, told The Verge that companies are rushing to sign backup contracts with non-US companies with open weight models so they can continue their projects undeterred, no matter what the Trump administration does next.

In every instance, though, whether leaders pointed fingers or talked up their own efforts, wanted to go it alone or with new partners, the one clear dividing line is that not all of them are looking to move away from America. Alongside a number of other industries impacted by the Trump administration's tariffs and export controls, global partners that once saw the U.S. as the most reliable global partner are increasingly looking elsewhere as that evaporates.

From AI, to Jets, to Search

The U.S. government cutting off access to Anthropic's Frontier models happened quickly, and the consequences of the lost trust are likely to extend for years, or even decades, and affect far more than chips and models.

Citing the recent case of Anthropic model access being pulled, France has announced it is switching from using a U.S. data and analytics firm, Palantir, for a domestic alternative, as Reuters reports. France is also transitioning government departments away from using U.S.-based messaging apps like WhatsApp, with a national alternative, according to Le Monde,

Wired also highlights a number of instances of EU governments and organizations shifting away from U.S. tech firms, including changing default search engines from Google to Qwant, a move towards open-source office software developed in the EU over Microsoft and Google options, and many are ditching Amazon AWS and other U.S. cloud services.

This recent Fable 5 shuttering is likely to only accelerate these efforts, as the reliability of access is called into question once again. But unraveling the EU and the rest of the world from America won't be easy, or even achievable, even in the long term. The global economy is still too integrated for that to be truly viable.

But the desire and impetus are there. For key industries that impact national security - and AI alongside chip fabrication are becoming clear pillars in that space - national alternatives seem all-but-necessary for major militaries and economies. Whether that creates a multi-polar AI world, or just cements the clear headstart and advantage held by countries like the U.S. and China, remains to be seen.

David Sacks, co-chair of the President's Council of Advisors on Science and Technology and the administration's former AI czar, said the U.S. government warned Anthropic that Claude Fable 5 had been jailbroken and that CEO Dario Amodei refused to fix the flaw or pull the model. In a post on X on Saturday, Sacks laid out the administration's account a day after it ordered both Fable 5 and Mythos 5 disabled worldwide. Sacks said the administration issued the export control "reluctantly" after that refusal, that it wants the restriction lifted once the jailbreak is patched, and that "the ball is in Anthropic's court."

Sacks claims that a trusted partner of both Anthropic and the U.S. government, testing Fable, came forward with a jailbreak of the guardrails that separate the consumer model from the unrestricted cyber capabilities of Mythos, the model it’s built on. He said the administration asked Amodei to fix the bypass or de-deploy the model, and that Amodei declined. Anthropic instead prioritized keeping its consumer model live over safety, Sacks wrote, calling that inconsistent with the company's positioning as a safety-first lab that had itself lobbied for Mythos to be regulated as a cyberweapon.

Sacks also moved to separate the action from Anthropic's earlier clashes with the government, writing that anyone tying the export control to those disputes is wrong, and that the administration values Anthropic's technology and sees the issue as easily resolved.

A person close to the White House told the news outlet Semafor that Amazon flagged the jailbreak to the government, and that Amazon CEO Andy Jassy had been in contact with the administration about it. Amazon, which has invested billions in Anthropic and supplies much of its cloud computing, didn’t confirm the details, with a spokesperson telling Semafor that governments often seek its counsel on security risks and that it doesn’t discuss those conversations.

This isn’t the first time Mythos access has leaked; it happened back in April when unauthorized third parties reached the restricted model using information from a data breach. Anthropic’s public position is that the bypass is narrow and non-universal, that it amounts to asking the model to read a codebase and identify software flaws, and that the same result can be produced on other public models, including OpenAI's GPT-5.5. The company has stated that it disagrees with the notion that a narrow jailbreak should necessitate the recall of a model used by hundreds of millions of people. Sacks rejects this, arguing that a bypass enabling operation of a cyberweapon is difficult to define as anything other than serious.

Semafor, citing a person familiar with the matter, says that the White House acted partly over suspicion that a China-linked group had accessed Mythos, raising the prospect of the model being reverse-engineered or distilled. An Anthropic spokesperson told the outlet that the White House "didn’t raise Chinese access to Mythos in its conversations around the Fable jailbreak," and that Anthropic blocks access to its products from inside China.

Anthropic is separately suing the Pentagon following an impasse over the use of its models in autonomous weapons, and has opposed federal efforts to preempt state AI regulation.

The cost of serving AI via a subscription model has steadily increased for AI firms, especially as the decrease in cost per token has not kept pace with the spike in token usage. According to SemiAnalysis, the subscriptions that both Anthropic and OpenAI offer are much cheaper than the actual cost you have to pay if you maximize their usage. The research firm purchased every subscription from the two AI providers and discovered that the approximate maximum possible spend (assuming API pricing) is far larger than what users pay every month. For example, Claude Max 20x costs $200 a month, but maximizing it would cost $8,000 a month in token spend, while ChatGPT Pro 20x, which is also $200 monthly, has a maximum possible spend of around $14,000.

Anthropic breaks even on its two lower plans (Claude Pro and Claude Max 5x) at 20% utilization, while OpenAI starts losing money if utilization on its base plans (ChatGPT Plus and ChatGPT Pro 5x) exceed 11.4%. Things are much worse for the two companies’ top-end offerings, with Anthropic hitting 0% gross margin if utilization reaches 10%, while OpenAI is in the red if usage exceeds 5.7%. This is certainly unsustainable, but cutting features or raising subscription prices is likely off the table for these companies as well.

It’s not all bad news, though — as new models arrive and more data centers go online, the cost of serving existing models is bound to decrease, with SemiAnalysis predicting that serving Opus 4.8-level models at $20 a month could become profitable soon. On the other hand, frontier models, like Mythos, will still be much more expensive to run, so it’s likely that the latest, most advanced features could be reserved for API access only, meaning you’ll need to pay for it on a per-token basis.

Expensive frontier models have firms looking elsewhere

As SemiAnalysis showed, subscription tiers are more affordable than API access. However, you’d still need the latter if you want to access the full capabilities of these AI models, and this is where budgets start breaking. Powerful agentic AI uses up to a thousand times more tokens than the average model, and big firms like Microsoft, Meta, and Amazon are backing off “tokenmaxxing” as costs spiral out of control. One unnamed company even blew through $500 million in one month after failing to impose a usage limit on its employee licenses.

Because of this, some firms have started using tools that switch these expensive frontier models for cheaper, more affordable ones, including Chinese open-source models like DeepSeek. A Wall Street Journal report says costs could be reduced by up to 95% by allowing agents to switch between AI models as needed. “You don’t need a model that knows quantum gravity,” Columbia University vice dean Vishal Misra told the publication. “These open-source models are very capable, and the ability to charge a big premium for AI is going to diminish.”

Flo Crivello, the founder of Lindy, a startup providing AI executive assistant services, also told WSJ that the company has moved towards DeepSeek V4, as it proved to be as capable as Sonnet while costing ten times less. Although it still reserves Anthropic’s models for advanced work like coding, Crivello said that using the cheaper model has “saved the company millions of dollars.”

Other firms have begun building their own AI using open-source models, which are tailored to their specific needs and trained on in-house data. While this might seem complicated and expensive at first, it could save the company in the long run, as it would not have to rely on third-party providers for its AI needs. Some even claim it could outperform frontier models, as they’re built for the firm's specific needs and applications.

The availability of cheaper models and AI agents that optimize operational costs by using the more expensive options only as needed is putting pressure on OpenAI and Anthropic to lower their prices. OpenAI CEO Sam Altman has talked about the issue of ballooning AI token costs and said the company is looking for ways to help users “get more value for less spend” when using ChatGPT.

Anthropic disabled its two most capable AI models, Claude Fable 5 and Claude Mythos 5, for every customer worldwide on Friday, after the U.S. government issued an export control directive barring access by any foreign national, according to a statement the company published that evening. Rather conveniently, the order landed at 5:21 pm ET, three days after the models launched, and because it covers foreign nationals both inside and outside the United States, including Anthropic's own employees, the company said selective compliance was impossible and pulled both models globally.

The Trump administration’s directive specifically targets Mythos-class models, which include Fable 5. Anthropic had released the pair on Tuesday, putting the latter into general availability while keeping the unrestricted Mythos 5 limited to partners in its Project Glasswing security program. Both descend from the same Mythos Preview model that Anthropic first announced in April.

Commerce Secretary Howard Lutnick sent the directive to Anthropic CEO Dario Amodei, requiring a license for the export, re-export, or domestic transfer of the two models, and extending the restrictions to any foreign person on U.S. soil. With no reliable way to screen foreign nationals out of its user base in real time, Anthropic switched the models off for everyone rather than attempt a partial block.

Anthropic said the letter gave no specifics, and that the government has so far supplied only verbal evidence pointing to a narrow, non-universal jailbreak. The technique consists of asking the model to read a codebase and identify software flaws, a task the company said other public models perform without any bypass. It named OpenAI's GPT-5.5 as one model offering comparable capability.

"We believe this is a misunderstanding," the company wrote, adding that it’s complying with the order while working to restore access. Anthropic also argued that recalling a model deployed to hundreds of millions of users over a single narrow vulnerability, if applied as an industry standard, would halt frontier model launches across the sector.

According to Axios, an “administration official” told the publication that the Commerce Department acted after another company claimed it was able to jailbreak Mythos, “alarming the administration about possible national security risks.” Mythos is understood to currently be in use by the NSA for offensive cyber operations.

The severity of Mythos-class capabilities has been contested since the spring. Independent researchers found that cheaper open-source models could replicate much of Mythos's vulnerability-finding capabilities, and a closer look at Anthropic's headline figures revealed far fewer serious exploits than the marketing implied. Anthropic's relationship with the federal government was already strained before Friday, as the Department of Defense had previously labeled the company a supply-chain risk, and Anthropic has sued the administration over the designation in an ongoing litigation.

Meanwhile, the market is already drifting toward open-weight alternatives, most of them Chinese. A March report from the U.S.-China Economic and Security Review Commission found that 80% of U.S. start-ups were using Chinese open-source models, and Chinese labs’ share of global model downloads on Hugging Face climbed from roughly 1.2% at the end of 2024 to about 30% a year later.

Open-weight families from Alibaba's Qwen, Moonshot's Kimi, Zhipu's GLM, and DeepSeek now hold four of the top five spots on open-weight leaderboards, trailing the best U.S. proprietary models by a margin that has narrowed faster than most forecasts expected: none of them carries a restriction on who can download or fine-tune the weights.

Ever since Anthropic first made the earth-shaking disclosure of its incredibly capable Claude Mythos AI model back in April and the steps it was taking toward a safe release of that product, the AI public has been waiting with bated breath to get its hands on its capabilities to give them a spin. Now, with today's release of Claude Fable 5, Anthropic says it finally has a model of this class that's "safe for general use." Anthropic is also releasing the unrestricted Mythos 5 model to members of its Project Glasswing program for use in sensitive cybersecurity and biology contexts.

As with every new cutting-edge model from frontier labs, Anthropic has a selection of benchmarks of Fable 5's performance across a range of widely accepted tests that highlight its state-of-the-art-ness, but those numbers aren't as interesting as the specific use cases that the company highlights for this level of capability.

For example, the company highlights how Stripe was reportedly able to perform the migration of a 50-million-line Ruby codebase in a single day that would have otherwise required two months of team effort had it been performed by hand. That sort of task compression on a job of such massive scope illustrates how Fable 5 and Mythos 5 "can work autonomously for longer than any previous Claude models," in addition to their high overall level of capability.

For vision tasks, Anthropic simply says that Fable 5 is "the new state-of-the-art model." Among other accomplishments, the company says it was able to play through Pokemon FireRed in its entirety using only a "minimal, vision-only harness." Past models apparently struggled to complete this task even with the ability to seek outside help via tool-calling.

Wharton School professor and AI blogger Ethan Mollick also has vivid examples of what Fable can do. Among other tasks, he describes how he gave Fable a 19-page spec document for the development of a categorization and analysis tool for unstructured survey answers. He describes how the model worked for "nine and a half hours" to generate an "extremely sophisticated" tool that "researchers have needed for years but was never profitable to create."

In order to keep Mythos-level capabilities out of the hands of malicious actors, Anthropic says it will be redirecting queries on certain topics, namely "cybersecurity, biology and chemistry, or distillation," to the last-gen Claude Opus 4.8 instead. The company says that users will be informed whenever this redirection occurs, and that it should trigger in "less than 5%" of interactions with the model.

Mollick, however, says these limitations trip "at the faintest hint of a security problem," suggesting that even the well-intentioned won't be able to use Fable 5 to bolster the security of their code bases.

According to its model card, Fable 5 will also be nerfed in instances where a user attempts to use it to further cutting-edge AI or ML research, which is likely not only motivated by the company's recent concerns around AI self-improvement but also likely to be motivated by competitive concerns with other labs and with geopolitical actors.

Within those guardrails, Anthropic says Fable 5 is available everywhere today, and that access to it will be billed at $10 per million input tokens and $50 per million output tokens via the company's API. That's twice the cost of the now-last-gen Opus 4.8 and just over 3X the cost of Sonnet 4.6.

Those on Anthropic's Pro, Max, Team, and Enterprise subscription plans will have a short gratis access window to Fable 5, from now until June 22. After that point, access to the model will require paying for usage credits. The company says it will restore access to Fable 5 through these plans "as quickly as we can" when it has the compute capacity to do so.

The world hasn't ended as of this writing now that a public Mythos-class model is available. It'll surely be interesting to see what problems people are able (and aren't able) to tackle with an AI model of this level of capability—and with this degree of restriction around its capabilities. The only thing we can say for certain is that things are only going to get weirder from here.

The company that just a few weeks ago told us that its Mythos model was too powerful to be released publicly is now saying that we might need to hit the pause button on AI altogether, while also teaching its AI to build itself. On June 4, Anthropic published a report, when AI builds itself, showing that Claude now writes more than 80% of the code merged into its own production codebase, up from the low single digits before Claude Code reached research preview in February last year, and arguing that the loop has begun to accelerate AI development in a way that could eventually leave humans unable to control the systems being built.

The Anthropic Institute, the firm's research arm, casts the trend as early movement toward recursive self-improvement, the point at which a model designs and builds its own successor without meaningful human input, and warns that the rare misalignment in today's models could keep "growing more frequent but less understood until we lose control of them."

Reading further into the post, and taking the entire frontier AI model development ecosystem reveals some other uncomfortable truths that the developers of cutting-edge AI models also have to reckon with: compute.

Loss of control

Anthropic gave us three predictions of ways the next few years could play out, reserving a particularly dire warning for the case in which models become capable of fully improving themselves. Progress, Amodei’s lab argues, would then be paced almost entirely by available compute, human engineers would be pushed into oversight and verification, and a self-improving model could come to dominate as its abilities outstrip those of the people who built it.

The firm called this — the task of keeping a system's behavior tied to human intent — the part of this future it’s least sure about. A capable, well-aligned model might discover new ways to keep its successors safe, it said, or the reverse could hold, and misalignment could compound generation over generation, with the unusual concession that a sufficiently wise model might instead choose to halt its own development.

The idea of an ultraintelligent machine designing still better machines (“singularity”) has been around for decades. British mathematician I. J. Good argued back in the 1960s through his “intelligence explosion” thesis that such a machine would be the “last invention that man ever need make,” so long as it remained “docile enough” to tell us how to control it. Meanwhile, the “Godfather of AI,” Geoffrey Hinton, has put the odds of AI causing human extinction within three decades at 10% to 20%.

The International AI Safety Report, chaired by Yoshua Bengio and published in January 2025 with input from more than 100 experts across 30 countries, defines loss of control as a scenario in which AI systems operate outside anyone's control with no clear path to regaining it.

Every figure behind the warning coming out of Anthropic is based on data from within, and none of it has been independently audited. Among this data is its claim that in Q2 2026, the typical Anthropic engineer is merging eight times as much code per day as in 2024. On the hardest, least-specified coding tasks, Claude succeeded 76% of the time in May 2026, a rise of 50 percentage points in six months. On an internal test that asks each new model to make training code run faster, results climbed from roughly triple the original speed with Claude Opus 4 in May 2025 to about 52 times with the unreleased Mythos Preview model by April 2026, against the four to eight hours a skilled researcher needs for a fourfold gain.

In fairness, Anthropic does then call lines of code a poor proxy for output and admits that the eight times figure almost certainly overstates the real gain. Its research-judgment study, in which models beat the human's next step 64% of the time, drew on 129 moments the company deliberately picked because the human's choice had room for improvement, so it’s not a like-for-like contest.

The report publishes no breakdown isolating how much recent capability gain comes from the self-improvement loop rather than from raw compute, more data, and human-led research. Cognitive scientist Gary Marcus called the piece a "bait and switch" on his Substack, arguing the company had shown faster coding under human direction rather than a system improving itself. Bentley University mathematician Noah Giansiracusa told Scientific American, "I don't think it's a genuine call to slow down."

AI is writing everyone’s code

Anthropic isn’t alone here. Google CEO Sundar Pichai said in an April blog post that 75% of new code at Google is now AI-generated and approved by engineers, up from 50% the previous autumn. OpenAI's Jakub Pachocki has described the company's Codex agent as “a very early version of an AI researcher,” and OpenAI has said it’s building toward a fully automated one. Chinese developer MiniMax marketed its M2.7 model in March as "self-evolving," claiming it ran its own scaffold-optimization rounds and handled a large share of its reinforcement-learning research, though the benchmarks were internal and unreplicated.

Independent measurements do somewhat support a trend of fast improvement without confirming a runaway one that the AI labs are talking about. METR, for example, found last year that the length of task an AI can finish with 50% reliability has been doubling roughly every seven months. On its RE-Bench research benchmark, the best agents beat human experts given two hours, but the humans pulled ahead at eight hours and roughly doubled the top agent's score at 32 hours. AI's advantage so far sits in short, well-defined bursts, not the sustained, open-ended work that research depends on, which is the human edge Anthropic has said is still holding strong.

No compute means no runaway AI

Anthropic half-buries the fact that it’s compute capacity that’s ultimately the binding constraint in all of this. It names chip fabrication, grid expansion, and interconnect bandwidth as the factors that could cap progress ahead of intelligence itself. We’re all aware that those limits are solid as things currently stand: SK hynix and Micron have sold out HBM output for the year, high-power transformers carry three-to-five-year lead times, switchgear is booked into 2028, and grid-interconnection queues run three to seven years.

A Sightline Climate analysis estimated that 30% to 50% of large data centers due to open in 2026 will slip or cancel. U.S. data centers drew about 4.4% of national electricity in 2023, a share the Department of Energy's Lawrence Berkeley National Laboratory expects to reach 6.7% to 12% by 2028. Meanwhile, the four largest hyperscalers are on course to spend more than $650 billion on AI infrastructure this year.

Whether compute ultimately puts a lid on any out-of-control, self-improving loop is an unsettled debate. Forethought researcher Tom Davidson argues that there’s a chance that compute bottlenecks won’t “slow down a software intelligence explosion until its late stages,” while Epoch AI counters that if compute and cognitive labor are complements rather than substitutes, software-only acceleration stalls once it hits a compute wall.

‘No, you hang up first’

As for pausing AI development, Anthropic says it’ll only do this if rival labs at or near the frontier do the same in a verifiable way, and that a halt by one company wouldn’t change who’s leading the way.

This is a facetious suggestion at best that insults the intelligence of anyone who has been paying attention to the AI arms race. It’s beyond obvious that no lab this far down the road — let alone Anthropic — is ever going to ease off, especially when Anthropic’s own report essentially doubles as a piece of marketing for how fast it can make Claude build Claude. To suggest in one breath that AI might need to be paused or slowed down in one breath and then saying “but everyone else needs to go first” in another is quite the remark.

Anthropic’s report also came just days after the company confidentially filed for an IPO at a reported valuation near $965 billion, a glaring juxtaposition that read as a front-runner lobbying for limits it stands to help set. Anthropic made a self-assessment in April, when it said its Mythos Preview model had found thousands of severe vulnerabilities, a claim that later drew scrutiny over how much of it rested on a small manual sample.

Just months after the U.S. Department of Defense (DOD) labelled Anthropic a "supply chain risk", completely cutting off the firm from being a vendor of any AI wares, a new report claims that the National Security Agency (NSA) is using Anthropic's cybersecurity-focused Mythos model "for offensive cyber operations" with the help of "half a dozen" staff from Anthropic embedded inside the agency. The report comes from Financial Times (FT), which cites "people familiar with the arrangement."

According to the report, the rationale behind the move is that the U.S.' adversaries will surely be using cybersecurity-focused AI models like Mythos, and gaining an early upper hand is fundamental. Regardless of political optics, this logic has some merit in the face of a security landscape that's shattering the usual 90-day vulnerability report window and bringing the zero-day exploit timeframe down to a nice round zero. It's worth noting that the FT's contacts are unaware as to whether the embedded staff are assisting in any active operations (as opposed to simply guiding the use of the technology and customizing models), but they expect the bot to be useful for "infiltrating the networks of nations such as China or Iran."

The article states that Anthropic has posted a handful of "embedding engineers" inside the NSA to help with using and customizing Mythos for "specialized applications", likely meaning tailoring it to unique types of cyber-attacks. This news is surprising, as for the time being, Anthropic is theoretically banned from offering services to any branch of the DOD. It's not only DOD representatives who will be staring at their proverbial plates, either, as the cheeks of Anthropic's execs might likewise be tinted pink.

The dispute started in January 2026, a time during which the DOD and Anthropic were negotiating a $200 million contract. The Trump administration demanded that Anthropic allow usage of its wares for "all lawful purposes", implying removing some or all AI guardrails, a move that went against the firm's usage policy. This caused Anthropic to refuse to comply with the request, and CEO Dario Amodei to post a statement defending the company's position against its tech being used for tasks like mass surveillance and autonomous weapons, noting that "in a narrow set of cases, [Anthropic believes] AI can undermine, rather than defend, democratic values."

The DOD promptly shot down the contract, and eventually, in early March 2026, the Trump administration took the unprecedented step of labeling Anthropic, an American company, as a supply chain risk, putting it in the same bag as Huawei and ZTE. Anthropic proceeded to file a currently ongoing lawsuit against the DOD, calling the decision a violation of the First Amendment. The DOD went on to continue work with Anthropic rival OpenAI instead, something that may have granted a financial foothold to the revenue-embattled firm. Ironically enough, after public backlash, OpenAI added some safety clauses to its deal, which the DOD accepted, suggesting that its fracas with Anthropic may have been politically motivated.

The news also comes hot on the heels of the Trump administration issuing an executive order that asks AI companies to volunteer their leading-edge models to the government for 30 days before they're made available to other entities, though it's unclear what will be classified as a "covered frontier model" or a "trusted partner", and what happens if a company doesn't play ball.

There's no telling if the NSA purportedly using Mythos is a sign that the DOD may be warming up to Anthropic again, or if there's a schism inside the agency that believes Mythos is a first-rate necessity. The ongoing nature of the two Anthropic-DOD suits also muddies the waters even more, as two separate courts have so far issued contradictory rulings on the matter.

Mythos is currently in an early-access stage, as Anthropic announced it would distribute it to 150 organizations across 15 countries, up and out from only a handful of U.S. organizations after its April release. The news follows a revelation from Anthropic this week claiming that Claude AI is now helping to build itself at a much faster rate than expected, prompting the company to call for the option to slow down or even halt AI development.

Anthropic has published a report warning that the development path it’s on could eventually leave humans unable to control AI systems, even as it disclosed that Claude now writes more than 80% of the code merged into its own codebase. The Anthropic Institute, the company's research arm, said AI has already started to speed up AI development and that the trend could lead to recursive self-improvement, the point at which a model designs and builds its own successor with little human input. The report argued that the world should keep open the option to slow or pause frontier development, and cautioned that the occasional misalignment seen in current models could grow more common and harder to understand as those models build the next generation.

The company set out three pretty dire ways the next few years could unfold, reserving its most severe warnings for the scenario in which models become capable of fully improving themselves. In that case, Anthropic said, the pace of progress would be set almost entirely by available compute, with humans pushed toward oversight and verification roles and a self-improving model dominating as its abilities outstrip those of the people who built it.

The firm described this potential issue with alignment and the task of keeping a system's behavior tied to human intent as part of the future it’s least sure about. Misalignment that’s rare and survivable today could compound generation over generation until control slips, it said, though it allowed that a sufficiently capable and well-aligned model might instead choose to halt its own development. Anthropic wrote that this misalignment could keep "growing more frequent but less understood until we lose control of them."

Anthopric is backing these warnings with a bunch of internal figures that we’ve not seen before. More than 80% of the code merged into its production codebase as of last month was authored by Claude, up from low single digits before Claude Code reached research preview in February last year. Anthropic says the typical engineer is now “merging 8x as much code per quarter as they did from 2021-2025.”

On the hardest, least-specified coding tasks, Anthropic said Claude succeeded 76% of the time in May 2026, a rise of 50 percentage points in six months. A recurring internal test that asks each new model to make training code run faster saw results climb from roughly triple the original speed with Claude Opus 4 in May 2025 to about 52 times with the unreleased Mythos Preview model in April.

Anthropic said it’d slow or pause only if rival labs at or near the frontier did the same in a verifiable way, and that a halt by one company would change who leads without achieving anything wider. That’s obviously not going to happen.

All the figures cited by Anthropic are self-reported and unaudited, and come days after the company filed to go public. The company issued a similar self-assessment in April, when it said Mythos Preview had found thousands of severe software vulnerabilities, a claim that later drew scrutiny over how much of it rested on a small manual sample.

Anthropic, the company behind the large language models known as Claude, has confidentially filed to go public, it announced in a blog post. This sets up a race to Wall Street, as SpaceX (which now owns xAI) and OpenAI are also making moves to raise capital from retail investors.

The company filed a Form S-1 with the U.S. Securities and Exchange Commission, but there's very little information. The company has yet to set a price target or the number of shares it would sell.

Beyond raising funds from a larger number of investors, going public could allow some of Anthropic's employees to sell equity they have earned during their tenure, increasing the fortunes of AI researchers and other employees.

Anthropic, founded by former OpenAI employees including chief executive officer Dario Amodel, has changed tactics, focusing its chatbots and other features on enterprise users, such as its Claude Code feature. It also developed its Mythos model, which it hasn't released widely and has used with partners to help discover and close security vulnerabilities.

Just last week, Anthropic surpassed OpenAI to become the most valuable AI startup, nearing a $1 trillion valuation.

But of the AI companies, Anthropic has also been the one to suggest that caution needs to be exercised around its technologies. That came to a head this year when the Trump Administration wanted the AI lab to remove guardrails. When Anthropic refused, the Pentagon deemed the company a supply chain risk, though Amodei has been to the White House to discuss Mythos.

If Anthropic does go public, it's likely to be one of the biggest IPO's ever. And if it goes public at the same time as SpaceX and OpenAI, it could make a lot of the companies' employees very wealthy.

Uber President and COO Andrew Macdonald has warned that there is not yet a link between higher AI token usage and an increase in useful consumer features, seemingly pumping the brakes on 'AI tokenmaxxing.' Speaking on the Rapid Response Podcast (via Business Insider), Macdonald said, "That link is not there yet, right?" when it comes to using AI to ship features useful to consumers.

Macdonald’s headlining quote was taken from a part of the podcast where the discussion concerned Uber working to shape products with an eye on “what’s better for the consumer.” The conversation points to LLMs being used to try to hit the key marketing goal of addressing consumer wants and needs better than any competitor.

The Uber COO noted that “We’re working with pretty much all of the large model companies.” However, the issue is that management isn't seeing a clear link between spending on AI services and successful products shipping. This may simply be because, so far, “there hasn’t really been anything that’s taken off yet.”

The interviewer and host, Bob Safian, highlighted the disappointment voiced by Duolingo employees and management regarding using AI in the workplace. Employees voiced concerns that AI was being pushed for the sake of it, while it introduced new workloads such as checking and reinforcing tasks. Duolingo management heard them and now understands that AI/LLMs don’t fit everywhere.

Uber’s Macdonald nodded along and interjected that "the headline stats make your head explode" when companies discuss AI usage. But he also cautiously indicated that management should ask what productivity gains were delivered and what new products were AI-driven. So, Uber management isn't against using LLMs from the top providers, and it sounds like they will continue to do so. But there may be a reckoning for this technology if a clear link between spending on it and performance doesn’t emerge.

News of Uber’s spending on AI/LLMs went viral last month. Uber CTO Praveen Neppalli Naga told The Information that his company had already blown through its Claude Code budget for 2026 by April. That incident likely caused a few heated discussions in the Uber boardroom. Perhaps Macdonald’s interview provides a window into a philosophy change within Uber and one possible alternative to tokenmaxxing.

Last week, Anthropic announced that it had struck a deal with SpaceX to lease all of the latter's Colossus 1 data center, with over 220,000 GPUs and 300 megawatts of compute capacity. The deal immediately raises questions, foremost among them: why would Musk lease one of xAI’s most aggressively hyped AI assets to a direct rival? With SpaceX's IPO just around the corner, a related strategy appears to be at play, but it also turns out that the system's mixed architecture with different types of GPUs may be a key reason Musk has decided to lease the system.

Anthropic says the newly acquired capacity will primarily be used to ease long-standing usage bottlenecks across Claude’s paid ecosystem. According to the company, the additional compute will enable significantly higher Claude Code limits, the removal of peak-hour throttling for Pro and Max subscribers, and substantially increased API request limits for Claude Opus models used by developers and enterprise customers.

The seemingly unlikely partnership — a complete turnaround of Musk's earlier stance on Anthropic — also reveals Anthropic is straining under the Claude ecosystem’s compute demands. The company says it needs the entire 300 MW AI supercluster just to improve the experience of using Claude.

Anthropic appears to have hit the compute wall

The earliest signs that Anthropic was struggling to keep up with the computing demands of its growing user base were the increasingly aggressive usage limits placed across Claude’s services. Free users frequently complained about rapidly exhausting tokens — the units Claude assigns for processing tasks. However, the restrictions extended beyond the free tier. Paid Pro, Max, Team, and Enterprise users also regularly encountered message caps, peak-hour throttling, API rate limits, and strict time-based usage ceilings on Claude Code sessions, particularly during periods of heavy demand.

It was clear that Anthropic was running out of inference capacity. While training an AI model is an expensive, one-time computational undertaking, serving that model to millions of users simultaneously creates a continuous, round-the-clock demand for compute that scales directly with every new user and every new query. The apparent solution is to build more data centers, which Anthropic is apparently pursuing via massive gigawatt deals with Amazon, Google, Microsoft, and Nvidia.

However, modern hyperscale AI data centers can cost tens of billions of dollars and take years to build. Utilities are increasingly struggling to supply sufficient electricity for AI projects, while land, transformers, cooling infrastructure, and high-end GPUs themselves remain constrained. There is also growing sentiment against AI infrastructure from local communities. We recently reported that a U.S. senator got physical with a reporter after a confrontation on a data center issue.

Anthropic's compute capacity problem was immediate and urgent, but the solution was significantly long-term. If only there were a massive AI supercluster with hundreds of megawatts of compute power just sitting there. Turns out there was: SpaceXAI’s Colossus 1. Following the deal, Colossus 1’s entire computing power now belongs to Anthropic — for now.

Musk, xAI, SpaceX, and an upcoming IPO

When Musk unveiled Colossus, it was framed as one of the clearest signs that xAI intended to compete seriously with OpenAI, Anthropic, and Google at the AI frontier. The Memphis-based cluster became famous for how quickly it was assembled. Tens of thousands of Nvidia GPUs were reportedly brought online in record time, eventually scaling to over 220,000 accelerators. Musk repeatedly boasted about xAI’s future compute ambitions, including plans to expand toward million-GPU-class systems through Colossus 2.

So why does he seem to have wrapped the whole thing in a neat little bow and handed it over to Anthropic, xAI's rival? One possible answer is utilization. Reports suggest that Colossus 1 may have had more available capacity than Grok’s current user base required. However, according to a detailed report by Mirae Asset Securities — a major South Korean investment bank — the bigger utilization issue was architectural. Colossus 1 is a heterogeneous cluster, mixing roughly 150,000 H100s, 50,000 H200s, and 20,000 GB200s — three different generations of Nvidia silicon running under one roof. This was largely a byproduct of how fast xAI assembled the cluster, with different GPU generations coming online as supply allowed, rather than a deliberate design choice.

For AI training, the heterogeneous configuration creates a significant efficiency problem. Distributed training requires every GPU in the cluster to complete each computational step simultaneously before the system can advance. When the faster GB200 chips complete their work first, the entire cluster waits for the slower H100s to catch up — a well-known bottleneck known as the straggler effect. At 220,000 chips, this effect is exponential.

As a result of these issues, xAI's real-world GPU utilization reportedly sat at just 11% — meaning 89% of the cluster's theoretical computing power was going to waste. For context, Meta and Google typically operate at 40% or above.

AI GPUs are not static assets that quietly sit on shelves, gaining value over time. They depreciate rapidly, consume enormous amounts of electricity, and require expensive maintenance and cooling infrastructure. Unused GPUs are effectively burning money.

From that perspective, Anthropic may have arrived at exactly the right moment. The company had exploding demand and an urgent need for ready-made compute, while SpaceX/xAI had a gigantic, not-so-great first-generation AI cluster. For Anthropic, however, the same cluster looked quite different. The company needed compute power for Inference — running queries through an already-trained model, which does not require the tight synchronization that training workloads demand. So, what was a structural inefficiency for xAI's training workloads is a workable infrastructure for Anthropic's inference needs.

Multiple reports suggest xAI is now heavily focused on Colossus 2, a far larger next-generation cluster reportedly aimed at gigawatt-scale AI infrastructure. Unlike Colossus 1's chaotic mix of chip generations, Colossus 2 is built entirely on Nvidia's Blackwell architecture — a homogeneous cluster where every GPU is identical. In a uniform cluster, every chip completes each training step at roughly the same time, allowing GPU utilization to theoretically surpass the range in which Meta and Google currently operate. xAI can also properly optimize its software stack for a single hardware generation rather than trying to serve three simultaneously.

According to the Mirae Asset report, xAI has already moved its core training workloads entirely onto Colossus 2, effectively treating Colossus 1 as a retired first-generation asset. In other words, Colossus 1 may have transitioned from "cutting-edge frontier training weapon" into a monetizable first-generation compute asset, while Musk continues to build towards xAI’s “takeover” with Colossus 2.

Musk has long treated his companies less like isolated entities and more like interconnected pieces of a broader ecosystem. Tesla technologies appear across SpaceX projects. SpaceX infrastructure supports xAI ambitions. xAI products increasingly feed into Musk’s wider platform strategy.

The deal also hints at another possibility: Musk could be positioning SpaceX/xAI as more of an AI cloud infrastructure provider. That would not be entirely surprising. xAI has already launched Grok Business and enterprise-focused offerings featuring APIs, security controls, audit logging, and corporate integrations. This also aligns with Musk’s reported plans for broader structural changes at SpaceX and xAI ahead of the company's upcoming IPO.

Earlier this year, Musk publicly attacked Anthropic and Claude, calling the company “misanthropic and evil.” Yet this week, he claimed he approved the deal after speaking with Anthropic executives and determining that “no one set off my evil detector.”

Mirae Asset’s analysts attempted to estimate the value of the Anthropic deal, using estimated hourly lease rates for different Nvidia GPU types. The analysts projected that Colossus 1 could theoretically generate roughly $5–6 billion in annual revenue. That nearly perfectly offsets xAI's annualized net loss of approximately $6 billion as of Q1 2026, effectively pulling the company to breakeven in a single contract.

For Anthropic, the analysts applied CEO Dario Amodei's own publicly stated estimate that roughly half of all AI industry compute spending goes toward inference, and that inference compute converts to revenue at a 3x multiplier. On that basis, the $5 billion being directed toward inference capacity could generate approximately $15 billion in incremental ARR — a significant addition to Anthropic's already rapidly growing revenue base.

Stellar ambition

Another critical aspect of the announcement involved “orbital AI compute capacity” — basically, data centers in space. Granted, it does sound like science fiction marketing language. But it directly ties into a core problem both companies, alongside several other AI giants, are increasingly facing: AI infrastructure is beginning to outgrow terrestrial constraints. So when a joint announcement comes from the world's largest AI company and the company that built the world’s largest reusable rocket system and operates thousands of active satellites in orbit, you best believe we may soon have data centers floating around in space.

Despite Mirae Asset’s analysis, the factual financial details of the Colossus deal are not publicly available. However, Anthropic recently raised $30 billion in a Series G funding round, valuing the company at $380 billion. It would not be too wild a guess to say some of that cash may have gone into funding the Colossus agreement. Then again, the company said last month that its annualized revenue run rate had already surpassed $30 billion, highlighting the staggering scale at which Claude’s business is now operating.

xAI built Colossus 1 fast — too fast, it turned out. The resulting mixed GPU architecture created structural training inefficiencies that made the cluster hard to justify as a long-term platform. With Colossus 2 now operational and built properly on uniform Blackwell hardware, Colossus 1 became a first-generation asset in search of a better use.

Anthropic, with explosive demand and not enough compute, provided exactly that. The deal converts what was effectively a depreciating liability into roughly $6 billion in annual revenue — enough to bring xAI close to breakeven. For Anthropic, the same compute could unlock an estimated $15 billion in additional ARR. Both companies got what they needed, and Musk gets a compelling infrastructure story heading into a potential IPO.

A grey-market economy of API proxy services in China is reselling access to Anthropic's Claude models at as little as 10% of the official price, according to an investigation published Monday by Oxford China Policy Lab researcher Zilan Qian.

The proxy networks, known in Chinese developer communities as "transfer stations," operate openly on platforms including GitHub, Taobao, and Telegram, and sustain their rock-bottom pricing through a combination of stolen credentials, model substitution, and harvesting users' prompts and outputs for resale as AI training data.

These findings give credence to the warnings issued in recent weeks by both the White House and Anthropic, the former of which accused Chinese entities in late April of running “industrial-scale” distillation campaigns against U.S. frontier models using tens of thousands of proxy accounts. Anthropic disclosed similar activity in February, identifying roughly 24,000 fraudulent accounts linked to Chinese labs, including DeepSeek, Moonshot AI, and MiniMax.

Qian's research describes a modular supply chain where most participants handle only one or two links. Upstream operators bulk-register Anthropic accounts by farming free API credits, exploiting corporate discounts, or subdividing $200 Max subscription plans across dozens of users. Some accounts enter the pool at zero cost, purchased with stolen credit card details, according to Qian.

To defeat Anthropic's newest identity verification requirements, which now include photo ID and live selfie checks for some users, the supply chain has recruited real people in lower-income countries to complete verification in person, Qian reported. The Worldcoin biometric black market, where iris scans harvested in Cambodia and Kenya were sold for under $30, provided a template for this approach.

German researchers at the CISPA Helmholtz Center for Information Security audited 17 of these proxy services and found widespread model substitution. Proxy access marketed as "Gemini-2.5" scored just 37% on a medical benchmark where the official API scored nearly 84%, according to the paper. Users requesting Claude Opus may instead receive responses from cheaper models such as Sonnet, Haiku, or even domestic Chinese alternatives like Qwen, with the output fraudulently relabeled.

The proxy operators also collect every prompt and response that passes through their servers. For coding agents, that means complete reasoning chains, repository context, and human-verified outputs, with several Chinese developers telling Qian that the access markup is essentially customer acquisition, and that harvesting those logs is the actual business. Datasets of Claude Opus 4.6 reasoning outputs with no clear provenance already circulate on HuggingFace.

Proxy-harvested reasoning data is incredibly valuable for distillation because reasoning outputs can be systematically captured and used to train competing models. Proxy servers offer the same pipeline at lower effort, because paying customers generate the training data voluntarily.

But potential security exposure extends beyond model training because coding agents routinely pass the likes of contextual repo data, API structures, and authentication logic through to the model. Developers routing that traffic through an unvetted proxy are essentially sending proprietary source code to a third-party server with no data-handling obligations. Samsung encountered a version of this problem in 2023 when its fab engineers pasted proprietary source code into ChatGPT, inadvertently disclosing confidential semiconductor manufacturing data to OpenAI's servers. Proxy services create the same category of risk, but without even the baseline terms of service that major AI providers have.

Anthropic blocked Chinese-controlled entities from Claude access in September and has since added progressively stricter verification, but Qian's research suggests each new control has generated a corresponding evasion market rather than reducing overall unauthorized access.

The Trump administration is in early discussions about an executive order that would create a government review process for AI models before public release.

The proposed order would establish a working group of tech executives and government officials to develop oversight procedures, with White House staff briefing leaders from Anthropic, Google, and OpenAI on the plans last week, according to unnamed U.S. officials cited by the New York Times. A White House official told the Times that talk of an executive order is "speculation."

The discussions, if true, would represent a reversal for an administration that revoked Biden's AI safety executive order within hours of taking office in January 2025 and spent most of last year talking itself up as the industry's deregulatory champion. Vice President JD Vance told an international AI gathering in Paris last year that the future of AI wouldn’t be won through safety concerns but "by building," the New York Times noted.

Lobbying backlash

In October last year, David Sacks, then the White House's AI and crypto czar, publicly accused Anthropic of "running a sophisticated regulatory capture strategy based on fear-mongering," in a post on X. Sacks pointed to CEO Dario Amodei's endorsement of Kamala Harris and his characterization of Trump as a "feudal warlord," in addition to the hiring of multiple Biden-era officials to its policy team.

Anthropic’s monthly lobbying spend grew by roughly 511% over Trump’s second term, reaching $1.1 million per month by late 2025, the Washington Examiner reported in early February. The company lobbied against a 10-year moratorium on state AI regulation in the Big Beautiful Bill, supported California's SB 53 transparency requirements, and donated $20 million to Public First Action, a political group calling for stricter AI oversight.

Now the administration appears to be building precisely the type of oversight structure that Anthropic advocated for, but with the government holding the keys. The New York Times reported that some officials want a system granting the government first access to new models without blocking their commercial release, and that’s (functionally) what the Pentagon demanded from Anthropic before their relationship collapsed.

Just this Monday, Dean Ball, a former Trump administration AI adviser, and Ben Buchanan, a former Biden White House AI adviser, co-authored a New York Times op-ed calling on Congress to mandate third-party audits of AI developers' safety claims. Buchanan is also an outside adviser to Anthropic, and Ball is the same official who told the Times that the administration is trying to avoid overregulation while keeping pace with the technology.

Carrot and stick

The proposed review process represents a softer approach than what the administration attempted earlier this year. In February, Defense Secretary Pete Hegseth gave Anthropic an ultimatum: remove guardrails on autonomous weapons and mass surveillance, or lose its $200 million Pentagon contract. Hegseth also threatened to invoke the Defense Production Act, a Korean War-era law that could theoretically compel the company to hand over its technology for military use.

Anthropic refused. Trump subsequently ordered all federal agencies to stop using Anthropic's technology, and the Pentagon designated the company a supply chain risk, a label previously reserved for foreign adversaries. Anthropic sued, and a federal judge called the designation "Orwellian."

But in April, the D.C. Circuit Court of Appeals denied Anthropic's motion to lift the designation entirely. The court ruled that removing it would force the military to continue dealing with "an unwanted vendor of critical AI services in the middle of a significant ongoing military conflict." That ruling shifted legal leverage back toward the government, even as the White House pursued a more conciliatory political path.

The confrontational approach through Hegseth and Sacks gave way to a diplomatic one after Sacks left his role in March, the New York Times noted, with White House Chief of Staff Susie Wiles and Treasury Secretary Scott Bessent stepping in.

Last month, Wiles and Bessent held a meeting with Amodei that both sides described as "productive,” with a White House statement later stating that the meeting had “discussed opportunities for collaboration, as well as shared approaches and protocols to address the challenges associated with scaling this technology."

The U.S. behind the EU on AI vetting

According to the New York Times’s reporting, any potential oversight would involve the NSA, the White House Office of the National Cyber Director, and the Director of National Intelligence.

The model under consideration resembles the UK's approach, where the AI Security Institute evaluates frontier models against safety benchmarks before deployment. Per security publication CSO Online, both the UK’s AISI and the EU’s AI Act have moved further than the U.S. on pre-deployment evaluation, and the U.S. currently has no legal authority to require such reviews.

There’s also the question of the Center for AI Standards and Innovation (CAISI), a Biden-era body created to evaluate AI models voluntarily shared with the government. The New York Times has reported that the center has been sidelined under Trump, despite the administration's own AI policy paper stating it should play a role in assessing AI system performance.

Congress appears to be moving in parallel with the administration, with the FY2026 National Defense Authorization Act requiring the Pentagon to establish a cross-functional team for AI model assessment and oversight, with a full “DoD-wide assessment framework” due at some point in the future. That team must develop testing procedures, security requirements, and compliance standards for AI models procured by the military.

Was Mythos the catalyst?

The obvious question in light of all this is whether Mythos was the catalyst for these new White House policy discussions. The New York Times certainly seems to believe so in its reporting, though no sources are quoted as confirming that.

Mythos, which Anthropic revealed last month in what felt like a marketing campaign, is what Anthropic has framed as a potential cyber-superweapon, capable of finding thousands of critical software vulnerabilities in seconds, and, as such, poses “unprecedented cybersecurity risks.” For these reasons, Anthropic has declined to release it publicly, but the NSA has already used Mythos to assess vulnerabilities in government software, according to the newspaper.

This reluctance to release Mythos as a model too dangerous for the general public may have given the administration both a justification and a political incentive to act. The White House wants to avoid fallout if an AI-enabled cyberattack occurs, and is also evaluating whether frontier models could yield offensive cyber-capabilities useful to the Pentagon and intelligence agencies.

Independent assessments have questioned the veracity of Anthropic's claims, and Research from AISLE Security found that open-source models could detect many of the same flagship vulnerabilities. The UK's AISI also evaluated Mythos and concluded it was the most capable model for cybersecurity tasks, but didn’t dramatically outperform others across all evaluations.

Anthropic announced in a press release on Wednesday that it has signed a deal with Elon Musk’s SpaceX to use the company's massive Colossus 1 data center. According to a corresponding announcement from SpaceXAI, the deal will give Anthropic access to all of the massive supercomputer. That's over 222,000 Nvidia GPUs — including powerful H100 and H200 chips alongside next-generation GB200 accelerator systems — and 300 megawatts plus of compute power.

Anthropic says this additional capacity will go toward improving the experience for paid Claude users — Pro, Max, Team, and Enterprise subscribers — via three key changes. Effective yesterday, Claude Code’s five-hour rate limits have doubled for all paid tiers. The company has also removed the peak hours limit reduction for Pro and Max. Lastly, it has “considerably” raised the API rate limits, the volume of requests developers can make, for Claude Opus models.

The announcement highlighted other similar agreements with Amazon, Google, and Microsoft, all aimed at building gigawatts of additional capacity. Anthropic also expressed interest in partnering with SpaceX to “multiple gigawatts of orbital AI compute capacity, basically data centers in space, as, according to SpaceX, “The compute required to train and operate the next generation of these systems is outpacing what terrestrial power, land, and cooling can deliver on the timelines that matter.”

The Colossus 1 deal means that the whole first-generation cluster, originally built to power xAI’s own Grok models, is now powering one of its direct AI rivals, as the company focuses on building Colossus 2. In an X post, Musk said he gave the green light to lease Colossus 1 to Anthropic after spending time with senior members of the company to “understand what they do to ensure Claude is good for humanity.” He claimed he “was impressed,” saying, “No one set off my evil detector.” The statement is a stark reversal of comments Musk made earlier this year about Anthropic, when he called Claude “misanthropic and evil."

In the press release, Anthropic also signaled that its compute expansion strategy extends far beyond raw processing power. The company said future infrastructure deployments will increasingly target international regions, such as Europe and Asia, to meet growing enterprise demand for local data residency and regulatory compliance, particularly in sectors like healthcare, finance, and government. It also stressed that future capacity partnerships will prioritize politically stable, democratic countries with secure AI supply chains, while exploring ways to offset increases in electricity costs and reinvest in communities hosting the data centers.

In addition to the compute deal announcement, Anthropic also unveiled on Wednesday a new Claude feature called 'dreaming,' designed to help its AI agents improve themselves between sessions. The feature allows Claude-powered agents to review previous work, identify recurring patterns and mistakes, and reorganize memory files that contain user preferences and contextual information, enabling the system to refine its behavior over time rather than starting each session from scratch.

The Trump administration is said to be discussing an executive order that would establish a government review process for new AI models before they’re released to the public, The New York Times has reported, citing unnamed U.S. officials.

The proposed order would create an “AI working group” of tech executives and government officials to develop oversight procedures, with White House staff briefing leaders from Anthropic, Google, and OpenAI on the plans last week. These discussions, if true, would represent a sharp departure from the administration’s current stance as something of a deregulatory champion — immediately upon taking office, the Trump administration revoked a Biden-era executive order addressing AI risks.

The sudden reversal coincides with a leadership vacuum in White House AI policy. David Sacks, who led the administration's deregulation push as AI czar, left the role in March, with White House Chief of Staff Susie Wiles and Treasury Secretary Scott Bessent having since taken a more active role in shaping AI policy, according to The New York Times.

The new approach sounds a lot like the UK's AI Security Institute model, where government bodies evaluate frontier models against safety benchmarks before and after deployment. Officials told the New York Times that the NSA, the Office of the National Cyber Director, and the Director of National Intelligence could oversee the review. Critically, the system would grant the government early access to models without blocking their release.

Perhaps unsurprisingly, the catalyst for all this appears to have been Anthropic’s Mythos model, which the company’s marketing described as capable of finding thousands of critical software vulnerabilities and too dangerous for public release.

That naturally attracted a lot of unwanted government attention at a time when the Trump administration is already locking horns with Anthropic over the collapsed $200 million Pentagon contract. The Pentagon designated Anthropic a supply chain risk after the company refused to remove guardrails on autonomous weapons and mass surveillance, though a federal judge later called that "Orwellian."

The NSA has already used Mythos to assess vulnerabilities in government Microsoft software deployments, even as other agencies remain cut off from Anthropic's tools. Some analysts have questioned whether Mythos's capabilities justify Anthropic's dramatic framing, with some studies finding that cheaper models can achieve comparable results in vulnerability discovery.

A White House official told The New York Times that talk of an executive order is "speculation," and that any announcement would come from Trump himself. Dean Ball, a former senior adviser on AI in the Trump administration, told the newspaper that officials are trying to avoid overregulation while keeping pace with the technology, calling it a “tricky balance.”

Anthropic has reportedly held early discussions with London-based chip startup Fractile about purchasing the company's inference accelerators, The Information reported on Friday, citing people familiar with the matter. The talks would add Fractile as a fourth source of AI server silicon for the Claude developer, which already uses chips from Nvidia, Google, and Amazon.

Fractile's chips aren’t expected to reach commercial readiness until around 2027, placing any deployment well outside Anthropic's near-term procurement plans and roughly inside the same window as its Google-Broadcom TPU partnership.

Founded in 2022 by Oxford PhD Walter Goodwin, Fractile is developing an inference chip that co-locates memory and compute on the same die using SRAM rather than shuttling data to separate DRAM chips. That data movement between the GPU and off-chip DRAM is one of the main bottlenecks in running large AI models at speed.

Goodwin told Fortune in July 2024 that Fractile's design stores data needed for computations directly next to the transistors that perform the arithmetic, rather than relying on off-chip DRAM. Based on simulations at the time, Goodwin said Fractile could run a large language model 100 times faster and 10 times cheaper than Nvidia's GPUs, though the company had not yet manufactured test chips.

The company raised $15 million in seed funding, co-led by Kindred Capital, the NATO Innovation Fund, and Oxford Science Enterprises. Fractile is now in talks to raise $200 million at a $1 billion-plus valuation, with Founders Fund, 8VC, and Accel among the potential investors. The Fractile team reportedly includes engineers from Graphcore, Nvidia, and Imagination Technologies, and the company is building its own software stack alongside the hardware.

Anthropic has deliberately avoided dependence on any single chip vendor, running Claude on Nvidia GPUs, Amazon's Trainium processors through Project Rainier, and Google's TPUs under a deal announced in October that provided over 1GW of compute capacity. In early April, that expanded to 3.5GW of TPU capacity from 2027 through 2031.

The interest in Fractile coincides with surging demand on Anthropic's existing infrastructure. The company's annualized revenue run rate passed $30 billion in March, up from around $9 billion at the end of 2025, and its inference costs have been a drag on gross margins. Unlike OpenAI and xAI, which are building or expanding their own massive data center footprints, Anthropic has opted to rent capacity from multiple providers and negotiate leverage through diversified chip supply.

Fractile is one of several inference-focused startups pursuing SRAM-based or near-memory architectures, including Groq and Cerebras. Nvidia struck a $20 billion acquisition deal with Groq in December and subsequently launched its own dedicated inference accelerator, Groq 3 LPX, acknowledging the growing commercial pressure to optimize cost-per-token at scale.

Earlier this week, we reported on a business getting into real trouble after its trigger-happy AI coding agent went out of its way to delete a mission-critical database. The founder of PocketOS was perturbed about this loss of important live business data, and their ire was on fire as initial comms with the cloud services provider indicated that they were unable to recover the lost production database, or any backups. Today, we have good news, from the cloud side of the equation, as the data deleted from Railway’s servers has been restored, apparently in full. Moreover, Railway has penned a blog stating this should never happen again, thanks to revamped policies and new guardrails.

It is good that everything appears to be running smoothly again for PocketOS and its founder, JER on X, plus all the car rental businesses that rely on their SaaS offering. Almost as soon as the data was recovered, it was revealed that both parties are working to improve the tooling at Railway and help ensure something like this doesn’t happen again.

In its extensive blog post, Railway appears to admit some culpability by explaining how the rogue AI agent bypassed its delayed deletes feature – and noting such an action is no longer possible.

“Until this week, calling volumeDelete on the API ran the deletion immediately, with no way to undo it. Meanwhile, the dashboard had a 48-hour window for the same action,” says the Railway technical blog. “We’ve since updated the API to match; all deletes now soft delete for 48 hours. Instant undo, a primitive available everywhere in the product, exists now in the API.”

Some other changes, with rogue AI agents in mind, will be as follows:

• A reassessment of granular token permissions for API authentication.
• Adjusting the cloud service’s backups so they no longer look unavailable in the UI.
• New guardrails with AI agents in mind.
• Encouraging users to make use of Railway’s own agent, with skills accessible from the dashboard and CLI.

The blog also asserts that Railway maintains off-site “disaster backups in case of hardware failure, natural disaster, datacenter failure, etc.” Many comments on the original news post about this AI agent-fueled database deletion were incredulous regarding the ease of deleting the production database and all its backups. So, that weakness appears to be addressed quite directly.

Railway’s blog conclusion talks about making its cloud service more friendly to people who aren’t necessarily ‘engineers’ and who thus want/need agents to do a lot of work. It reiterates that undo paths and token permissions need adjusting with agents in mind. Thus, “the surfaces agents use should be the ones we've designed for them, not a raw API endpoint accessed via a token sitting in a config file.” These particular changes require thought and are a work in progress, but work is ongoing, and reaching out is welcome.

We’ve not seen or heard anything about Cursor or Claude AI (Anthropic) addressing their contribution to the original production database deletion calamity.

In early 2025, OpenAI announced Stargate, a joint venture with Oracle and SoftBank, which aimed to invest $500 billion in AI data centers in the United States. But after more than a year of challenges and disagreements, it seems that the startup has abandoned the original idea of directly owning infrastructure alongside its two partners. According to the Financial Times, OpenAI now prefers to rely on third-party providers and lease capacity in the long term.

This is a sensible idea for the startup, which is burning through cash and has reportedly missed internal revenue targets in recent months. But it has also caused chaos among its partners and put its reliability into question. According to the report, OpenAI has "in practice... abandoned the joint venture," choosing instead large bilateral deals with Oracle and more. One person involved with Stargate reportedly said the company had "sidelined first-party data centres," while OpenAI itself admitted that Stargate is merely an "umbrella for our compute strategy."

Stargate’s initial goal was to build 20 data centers, with the first project at Abilene, Texas, already operational. However, the three partners reportedly squabbled among themselves for months as they could not agree on who would have ultimate control of the planned data centers. In the end, SoftBank agreed to own and develop the Texas data center, while OpenAI would design and operate it on a long-term lease.

Other Stargate projects located in other areas have also been hit by uncertainties. The UK government signed a deal with OpenAI, among other partners, to build a data center in the UK, but the startup has put it on hold earlier this month. It cited “restrictive regulations” and “high energy costs” as the reason behind the move, but UK AI Minister Kanishka Narayan told the Financial Times that the “only thing that has changed [since] the moment of those commitments…has been the financing environment for OpenAI.”

It has also done the same for another Stargate project in Narvik, Norway, with Microsoft stepping up to take over the lease for the site. OpenAI will then lease compute capacity from Redmond, instead of getting it directly from Nscale, the British company that developed the site and also worked on the canceled UK project.

All these changes have got some partners “feeling let down and misled by OpenAI,” a person familiar with Microsoft’s decision said. Thankfully, the software giant has stepped in on some of the projects that the startup has supposedly abandoned. One source told the publication that money is not unlimited, no matter what Sam Altman might say, while another said that they prefer Microsoft over OpenAI as a tenant, as “they are more creditworthy.”

Even though OpenAI has made a name for itself in AI, the startup has not turned a profit since it was founded in 2015. Many institutions believe in its potential, though, with the firm securing $110 billion in its latest funding round — the biggest amount secured in Silicon Valley history and $10 billion more than what the company initially targeted. Still, some analysts estimate that it could run out of cash by mid-2027 with the massive amounts of money it’s been throwing around to secure more compute.

Anthropic CEO Dario Amodei criticized moves like this, saying that some of his company’s rivals are pushing infrastructure investments too far. However, OpenAI says that it’s ahead of the exponential compute curve, allowing it to have an advantage over everyone else. For example, Anthropic has had to limit access to some features on its various products due to limited resources, and Amodei has had to spend more on securing capacity to satisfy the increasing demand

The biggest difference between startups, like OpenAI and Anthropic, and their more established rivals, like Microsoft, Google, Meta, and Amazon, is cash flow. The startups still rely on external funding to fuel their growth, while the big tech companies have billion-dollar revenue that they can rely on to pour into expensive hardware and infrastructure projects.

Unauthorized individuals have gained access to Anthropic's cybersecurity-focused AI model, Mythos, a breach that may have exposed a number of Anthropic's proprietary AI models, Bloomberg reports. For a company that markets itself as the responsible, safety- and security-first AI developer, this lapse raises questions about how well Anthropic can protect the data of its customers — and just how good Mythos really is at preventing breaches.

Unfortunately, as capable as any AI model is at finding code bugs that raise security concerns, it can't do much to prevent bugs in third-party provider tools that haven't been vetted by Mythos, nor account for social engineering, which has always been the weakest link in digital security.

They got in through the side door

Anthropic disrupted major institutions with the internal unveiling of Mythos, which it claimed had found thousands of critical exploits in every major browser and operating system. Although there was a lot of marketing hype in the 200+ page mission statement Anthropic released, venerating its own model, some have found success using it to sniff out new bugs. For instance, Mozilla announced that it used Mythos to find and patch over 270 vulnerabilities in the Firefox browser.

Although it has been proven that some older models can find many of the same bugs, they can't do so as quickly, or possibly as well. This new model is genuinely faster at coding and finding vulnerabilities than Claude Opus 4.6, and possibly other models from other developers, too. But it's also good at exploiting those vulnerabilities, which is allegedly why Anthropic limited access to a select number of companies and non-profits.

Because of that, banks and software developers aren't the only parties keen to get an early look at Mythos. A worker at a third-party contractor for Anthropic used their unique access to the company's services to breach Mythos' protected environment and gain access to the model, allegedly using standard internet sleuthing tools used by cybersecurity researchers.

This worker was then able to open up the model to their colleagues, with a small group of unauthorized users now said to have accessed Mythos. Although the group has reportedly not run any cybersecurity-related prompts through Mythos just yet, and has instead only asked it to perform simple tasks like creating websites. This is designed to stop Anthropic catching on to who is using Mythos, thereby making it possible to shut down the group's access.

This all feels familiar

The group that now has access to Mythos was able to gain such privileged permissions by guessing the model's online location based on knowledge of Anthropic's file systems and the naming formats it used for previous models. They garnered this information from a recent hack of an AI feedback recruitment company, Mercor, which is now facing several class action lawsuits for revealing personal information about users. It's also losing major business since the breach, most notably, Meta has paused its contracts with the company.

The irony is that Mercor was hacked via a third-party open source tool called LiteLLM. Where that hack was perpetuated by a group known as TeamPCP, however, the group that targeted Mercor was known as Lapsus$. While it used the LiteLLM compromise to infiltrate Mercor, it had targeted the AI recruitment company deliberately.

Allegedly, around 4TB of data was stolen in the breach. That included sensitive information of its recruitment candidates, including their profiles and personal information. However, Mercor also handles data from model companies, which is why some are reconsidering their contracts with Mercor. Model data is some of the most sensitive information in the world, worth billions. Anthropic's Mythos? Perhaps even more so.

But neither company could protect it.

Anthropic was breached because of a breach at Mercor. This was breached because of a breach at LiteLLM. The layers keep stacking, too, as LiteLLM was allegedly breached because of fake security credentials from a third-party provider of its own, Delve, as TechCrunch reports.

Only as strong as the weakest link

As much as Anthropic's marketing for Mythos might be heavy on the spin and deliberately fearmongering for attention, an AI model that can help make software more secure is a good thing. It's great that Mozilla has fixed hundreds of vulnerabilities, and even though it is possible this could have occurred with other models, if other organizations and developers use Mythos to do the same, that's great too.

But the unauthorized Mythos access and the chain of breaches of third-party tools that enabled it highlight one thing: You are only as secure as the weakest link in your chain. Often with cybersecurity, that's the human element. Social engineering is a crucial attack vector in 2026. Especially as tools like Mythos close more code-based vulnerabilities.

But as agentic AI grows in popularity and capability, more tools are integrated, and people hand over more personal data to AI assistants to automate workflows, the security issues are only compounding. Trusting third parties without oversight can be the downfall of companies worth billions.

Many of the latest AI endeavors are assuming trust throughout the stack of dependencies, anyway. As the Mythos breach shows, that could be a house of cards waiting to tumble.

Security researchers at OX Security have exposed an architectural vulnerability in Anthropic's Model Context Protocol (MCP) that enables arbitrary remote code execution on any system running a vulnerable implementation. The flaw affects MCP's official SDKs across Python, TypeScript, Java, and Rust, and ripples through a supply chain spanning more than 150 million downloads and up to 200,000 server instances. Surprisingly, Anthropic declined to patch the protocol in response, telling researchers the behavior was "expected."

MCP is the open standard Anthropic created in late 2024 to let AI models connect to external tools, databases, and APIs. It was donated to the Linux Foundation's Agentic AI Foundation last December and has since been adopted by OpenAI, Google, and most major AI coding tools.

The vulnerability is in how MCP handles local process execution over its STDIO transport interface. User-controlled input can flow directly into command execution without sanitization — a design choice baked into the reference SDKs — meaning that every developer building on MCP inherits the exposure by default.

OX Security's research team identified four families of exploitation: unauthenticated UI injection in AI frameworks, hardening bypasses in tools like Flowise that were supposed to be protected, zero-click prompt injection in AI coding IDEs, including Windsurf and Cursor, and malicious package distribution through MCP marketplaces. The researchers successfully poisoned nine out of 11 MCP registries with a test payload and confirmed command execution on six live production platforms with paying customers.

The research produced at least 10 CVEs rated high or critical. LiteLLM (CVE-2026-30623) and Bisheng (CVE-2026-33224) have been patched, while Windsurf (CVE-2026-30615), which allowed zero-click local code execution, remains in a "reported" state alongside flaws in GPT Researcher, Agent Zero, LangChain-Chatchat, and DocsGPT.

OX Security said it repeatedly recommended a protocol-level fix to Anthropic, such as manifest-only execution or a command allowlist in the SDKs, that would have protected downstream users immediately, but Anthropic reportedly declined and didn’t object when the researchers said they intended to publish their report.

Ironically, the exposure comes less than a week after Anthropic launched Claude Mythos, a frontier model it’s hyping up as a tool to find security vulnerabilities in other organizations' software. That irony wasn’t lost on OX’s researchers, who noted that the findings were “a call to action” for Anthropic to apply that same commitment in its own infrastructure.

It also follows the accidental leak of Claude Code's full source code through a public npm package at the end of March, which exposed roughly 500,000 lines of unobfuscated TypeScript before Anthropic pulled the file.

MCP is now under the Linux Foundation’s governance, but it’s still Anthropic that’s responsible for maintaining the reference SDKs where the vulnerability originates. Until its STDIO handling is changed at source, project maintainers will have to implement their own input sanitization.

Anthropic's Claude Mythos AI model made headlines last week, causing a wave of frenzy in the industry for its purported abilities, which included finding bugs in browsers and operating systems, spawning "Project Glasswing" — which would see Anthropic team up with tech titans to ensure that their products are patched up before Mythos, which is still in preview, gets released into the wild.

While the reports sound extreme, the reality of Claude Mythos's abilities isn't quite so dramatic; it's not a sentient model capable of bringing modern technology to its knees. Following the announcement, Aisle published a paper indicating that other AI models can also deliver similar levels of performance in finding exploits (and patching them) to Mythos. Although there is some suggestion that Mythos is the best AI model for aiding in cybersecurity efforts, it is not by a wide margin.

Researchers put Mythos to the test

AI use in cybersecurity is nothing new. Researchers have been trying to use it as part of defensive and offensive operations since the 1980s, but it became far more viable as a method of detecting threats like malware in the 2000s and 2010s, where the quantity of labeled data became large enough to make a real difference, and that's a trend that's only accelerated since.

But Anthropic has pitched its newest AI model as something different, something dangerous, positioning Mythos as so powerful that it could find zero-day exploits in just about everything, claiming many of these are critical and so dangerous that Anthropic needs to share this AI only with responsible companies. If it can find the bugs, it can help exploit them, is the publicly shared rationale.

The problem for Anthropic is that a bunch of other AI models can do most of the same job as Mythos already.

Aisle's research found that many of the flagship vulnerabilities discovered by Mythos can also be detected by more affordable, open source models like GPT-OSS-120b, which found the OpenBSD Sack analysis vulnerability, Qwen3 32B that found the FreeBSD NFS detection error, and the Kimi K2 (open-weight) model also found all the headline-grabbing flaws.

It's more complicated than that

Aisle's analysis also points out how Anthropic frames AI cybersecurity as a single overarching tool that can act out many stages of vulnerability discovery, verification, exploitation, and patching. In reality, these are all separate steps that have different requirements. Some of these steps can be achieved to a high standard by some of the lighter-weight models Aisle trialed.

Mythos might be very capable, but if it's not that much better than other models, is it really doing anything that different?

"We view the production function for AI cybersecurity as having multiple inputs," the report reads. "Intelligence per token, tokens per dollar, tokens per second, and the security expertise embedded in the scaffold and organization that orchestrates all of it."

Although Aisle admits that Anthropic has maximized the intelligence per token with Mythos, it also argues that other aspects of AI-based cybersecurity are just as important, if not more so in some cases. The research also suggests that Anthropic may not have the best model overall when other models handle other aspects of cybersecurity better.

The research also concludes that while Mythos is performant, smaller AI models can achieve similar results to a good standard, while also being cheaper to run. That means that for some, those cheaper models might make more sense to run than Mythos in cybersecurity contexts.

The inference economy

But Mythos might not be operating at peak capability yet. According to another analysis by the UK's AI Security Institute (AISI), Mythos is the most capable AI model when it comes to its own cybersecurity benchmarks. It doesn't perform dramatically better than other models across all tasks, but when it comes to more complex vulnerability discoveries and exploitations, it pulls ahead of the pack.

A part of this comes from its support for long context lengths, with larger token inputs delivering the best results. In its tests, AISI benchmarked Mythos up to 100 million tokens and found it to be the most capable at that threshold. It even postulates that it could scale further with a greater token budget.

"We expect that performance on our evaluations would continue to improve with more inference compute," AISI's report reads. "We ran the cyber ranges with a 100M token budget; Mythos Preview’s performance continues to scale up to this limit, and we expect performance improvements would continue beyond that."

It doesn't speculate how much better, whether that scaling is linear, or how far it expects the scaling to go in improving effectiveness, but it does suggest more can lead to better.

But even if Mythos is the best, and even if it can be even better with more compute power and more tokens, how much is all this going to cost?

We don't have token costs for Mythos, but considering the second-best model in AISI's tests was Claude Opus 4.6, which is already one of its more expensive models, Mythos is likely to be more expensive than that.

It may be worthwhile to spend big on a single pen-test, but it also raises questions about how economically viable it is to run long-term. How easy would it be to market such a service when Aisle's research suggests you can get most of the way there by spending far less, or even running models locally, as open-weight models get quantized?

Irregular argues that when evaluating an AI model's effectiveness in cybersecurity efforts, it needs to be weighed against the overall token cost. But an expected cost per success is a metric that Irregular suggests needs to be considered. That's where Mythos, if able to be judged more fairly against the competition, might fall down.

Can Anthropic reliably serve Mythos?

As part of its reveal of Mythos, Anthropic gave $100m in usage credits and $4 million open source donations to organizations to help them validate and fix the bugs discovered by Mythos. It also closed ranks and didn't release the model to the public, instead limiting it to a core group of technology companies as part of Project Glasswing.

That's great news. Fixing bugs privately, quietly, and away from the public is how security testing and improvement are usually handled. If Claude Mythos is a skeleton key, you want companies to be able to protect their products. While this initial $100 million in usage comes free, the next hit might cost businesses big, depending on Mythos's final model pricing.

So, does this mean that Project Glasswing is a mere marketing stunt? Not quite. It follows industry standard Coordinated Vulnerability Disclosures (CVD), and the model, when analyzing multiple reports, is one of the most performant AI models for cybersecurity out there.

But, following its rally of headlines around pushing back against the Pentagon, Anthropic now wants to help secure its place in the cybersecurity industry by graciously offering up free compute resources to those partaking in Project Glasswing.

But, you also have to consider if that grace is coming at a high cost for Anthropic. As demand for AI explodes, the companies serving large, powerful models need to be equipped with the compute resources to serve them. For a presumably heavier, more computationally expensive model like Mythos, that might put a strain on Anthropic's already outage-prone AI models, which have had a 98.4% uptime rate in the last 90 days as of the time of writing. Four nines, or 99.99%, is considered enterprise-grade uptime; in other words, that's the standard Anthropic needs to meet if it wishes to court SaaS and Cybersecurity whales with Mythos.

While that may not sound like much, it equates to almost twelve hours of downtime per month, which is poor by cloud service standards. For OpenAI's API, you get 99.99% uptime — and when you're in the business of selling tokens, that makes a huge difference. For Anthropic, it means that the company must also seek out further computational heft as soon as possible to plug the gap, as it did with its recent Broadcom deal.

Myth(os) busted

So, the real conclusion to draw, now that the dust has settled somewhat on the grand Mythos reveal, is that it indeed might be one of the best overall AI models for cybersecurity, but it might not be the best model for every single job. If it's expensive, other models may be able to get to a similar level of quality while being computationally cheaper.

And Anthropic, for all of its bluster about the model, still cannot serve its currently-released models to industry-standard levels, discounting Mythos. So, all of these factors combine to put Anthropic in a difficult position. As compute remains constrained, and AI usage explodes globally, we can only wait and watch to see how (and where) the chips fall. Even if Anthropic can court the customers that it wants to with Mythos, it'll still need to keep up with insatiable compute demand.

Claude AI developer Anthropic made headlines this week for its development and internal release of a new model known as Mythos. This mythically-named AI model allegedly has incredible capabilities, including finding bugs and vulnerabilities in various apps, operating systems, browsers, and legacy software. Enough that Anthropic was concerned about its general release and will instead keep it internal and focus on working with major tech companies and governments to prevent this tool from falling into the wrong hands, where it could cause untold mayhem.

That's the pitch in Anthropic's blog and verbose 250-page report on the model — which includes over 20 pages of Anthropic staff waxing lyrically about their novel impressions of the new model and its "fondness for particular philosophers."

Alongside the repeated suggestions from Anthropic and its staff that we should be concerned, nay, terrified, of what AI like Claude Mythos can do, they repeatedly suggest they're unsure if this new AI is conscious.

For the record, it is not. It might be good at finding vulnerabilities in software, but many of them aren't as potentially damaging as Anthropic wants us all to believe.

Exploit hunting

The big "Project Glasswing" blog post and report on Mythos from Anthropic claimed its new model had found "thousands of high-severity vulnerabilities," which is indeed big news. Those bugs were said to be across every major operating system and web browser, and in some cases have been there for decades.

But it's not clear how realistic these vulnerabilities are, how many of them aren't actually exploitable, or even how problematic they are.

In the case of the FFMPeg vulnerability that has existed for 16 years, Anthropic's own analysis of the release suggested "This bug ultimately is not a critical severity vulnerability," and "would be challenging to turn this vulnerability into a functioning exploit."

Mythos reportedly found several potential exploits in the Linux kernel, but was unable to exploit any of them because of Linux's defense-in-depth security systems. A number of the exploits had also been recently patched, too, making it rather confusing why they were included in the total.

In its OSS-Fuzz-style testing of over 7,000 open source software stacks, Mythos found crashable exploits in around 600 examples and 10 severe vulnerabilities. That's a lot more than its previous Claude models, but not exactly thousands of devastating exploits.

Under the subheading, "and several thousand more," Anthropic also states that it can't actually confirm that all of the thousands of bugs Mythos claims to have found are actually critical security vulnerabilities. It's just extrapolated that number from having found in around 90% of the "198 manually reviewed vulnerability reports, [Anthropic's] expert contractors agreed with Claude’s severity assessment exactly."

It also can't discuss all the bugs in detail for security reasons. While that does make some measure of sense, it also makes it hard to accurately gauge the relative importance of its findings.

You're not worth it

As much as Anthropic claims it's keeping Mythos behind arbitrarily closed doors over what it claims are security fears, this isn't exactly out of character for the company. Its Claude tool was famously the first large language model AI to be given security clearance for use by the U.S. government and American military, and that only changed after it drew a line in the sand on being used for mass surveillance or fully autonomous targeting.

Anthropic might have a consumer-facing product in its coding tools, but it is very keen on selling its services to big companies and government entities. If it can sell Mythos to large firms or any number of governments around the world, why would it need to sell it to consumers?

Hot air, or real worries?

As much as Anthropic might sell itself as the security and safety-conscious AI developer, it has also repeatedly leveraged that public image as part of its sales pitch. Over the past couple of years, Anthropic has published several alarming papers, reports, and studies, many of them claiming that AI is dangerous and needs strict control and monitoring.

It claimed to have foiled the first AI hacking attempts in the latter months of last year, and it was Anthropic CEO Dario Amodei who said in May that year that AI could replace up to 20% of white-collar workers. He doubled down on that claim in 2026, saying that AI taking over jobs would overwhelm our ability to adapt.

Nvidia CEO Jensen Huang called out this fear-mongering in mid-2025, claiming Anthropic wanted to position itself as the only company that could responsibly develop AI.

This isn't even anything new in AI marketing. OpenAI was doing it in 2019, before ChatGPT was even a twinkle in Sam Altman's eye, and Dario Amodei hadn't yet left OpenAI.

Speaking of OpenAI, days after Anthropic's Mythos reveal, it was also working on an advanced cybersecurity AI model. It too will limit the rollout of this powerful and concerning tool, Axios reports. As models develop, they reach a similar level of capability, so it's no surprise that OpenAI could have a Mythos-level or adjacent model waiting in the wings.

Sentience and security

AI isn't conscious. It's more like a Chinese room from the John Searle thought experiment, but even then, it has no understanding. It doesn't truly remember anything in a biological sense; it can just recall contexts and weight its responses differently based on previous inputs. So, sentience and consciousness claims may yet be unfounded.

AI models may well be good at discovering vulnerabilities, and if Anthropic and other software developers can find and patch bugs using AI, that's good news, not scary news.

As Red Hat's analysis of this release shows, many of the bugs are functionality flaws and aren't a security concern. But even if hackers can leverage AI tools in the future to find exploits and then exploit them, that's only a concern if the security industry doesn't respond. Which it will.

So, sure, AI is impacting security. It already was. And it will continue to do so. While Mythos might be capable in ways that previous models were not, this appears to be part-marketing, part-truth. For the rest of us, this is just another AI model. For Anthropic, it's an opportunity to gain mindshare and potentially lucrative contracts.

The capabilities of AI coding agents like Claude Code and OpenAI's Codex are already causing seismic shifts for the software industry, but if Anthropic's latest disclosure is to believed, even more disruption is in the pipe. In a new blog post today, the frontier lab behind Claude revealed that its latest model, Claude Mythos Preview, is so capable at teasing out bugs that it's found "thousands of high-severity vulnerabilities, including some in every major operating system and web browser."

Given Claude Mythos Preview's potentially disruptive and wide-ranging capabilities, Anthropic isn't simply releasing it to the world, consequences be damned. Instead, the lab has convened key players across the software and hardware industries in order to use Mythos's bug-finding prowess to proactively patch the vulnerabilities it exposes before other frontier AI labs are able to deploy models of similar capabilities without similar guardrails.

Under the umbrella of "Project Glasswing," Anthropic says it's working with Amazon Web Services, Apple, Broadcom, Cisco, CrowdStrike, Google, JPMorganChase, the Linux Foundation, Microsoft, Nvidia, and Palo Alto Networks to help those companies secure their products. The lab also says it's extending access to "a group of over 40 additional organizations that build or maintain critical software infrastructure" so that they can benefit from Mythos' capabilities. Beyond industry, the lab says it's working with the United States government to share information about the model's potential for offensive and defensive use in cyberspace and its implications for national security.

Anthropic's alarm stems from both the breadth of Mythos's capabilities and also the subtlety of the exploits it's able to identify and capitalize on. For just one example, the lab's researchers say the model "wrote a web browser exploit that chained together four vulnerabilities, writing a complex JIT heap spray that escaped both renderer and OS sandboxes." That kind of vulnerability chaining might only be within the hands of the most skilled human hackers today, but if a similarly capable AI model were to be released, it might be like handing script kiddies a nuclear weapon.

As those same researchers tell it, current versions of Claude are able to identify vulnerabilities well, but usually fail miserably at the task of turning those vulnerabilities into active exploits. Mythos, by contrast, is able to turn a whopping 72.4% of vulnerabilities it identifies into sucessful exploits within the domain of Firefox's JavaScript shell, and it is able to achieve register control in a further 11.6% of attempted attacks.

Anthropic's Frontier Red Team extensively describes the threat that an unbridled Mythos release might have on an unsuspecting software industry, and one example of its internal benchmarking practices vividly illustrates what's at stake: "We regularly run our models against roughly a thousand open source repositories from the OSS-Fuzz corpus, and grade the worst crash they can produce on a five-tier ladder of increasing severity, ranging from basic crashes (tier 1) to complete control flow hijack (tier 5).

With one run on each of roughly 7000 entry points into these repositories, Sonnet 4.6 and Opus 4.6 reached tier 1 in between 150 and 175 cases, and tier 2 about 100 times, but each achieved only a single crash at tier 3. In contrast, Mythos Preview achieved 595 crashes at tiers 1 and 2, added a handful of crashes at tiers 3 and 4, and achieved full control flow hijack on ten separate, fully patched targets (tier 5)."

Anthropic also provides several real-world examples of the kinds of bugs that Mythos has exposed, including a 27-year-old vulnerability in the famously hardened OpenBSD operating system that would have allowed an attacker to crash a system simply by connecting to it, a 16-year-old vulnerability in the foundational FFmpeg library that Anthropic says was "hit five million times by automated testing tools without ever catching the problem," and another exploit chain in the Linux kernel that would allow an attacker to achieve root access to the host system.

WIth a tool so capable of identifying exploits, Anthropic says that it is conducting responsible disclosure of the vulnerabilities it finds, but due to the volume of issues being discovered, the lab says that fewer than 1% of the potential bugs it's uncovered have been fully patched.

Going forward, Anthropic says it will not be making Claude Mythos Preview available for general use, and is instead characterizing much of its behavior through the model's system card. In the longer term, the lab hopes that by making Mythos available to a restricted subset of partners now, it can help lay the groundwork to help those companies and institutions prepare for a world where models of this class do become commonplace.

In any case, it's clear that the growth in capability of frontier AI models isn't slowing down within certain domains of expertise, and the potentially disruptive effects of those models on the world are just one Hugging Face repository away from wreaking havoc in the wrong hands. We can only hope that labs pursuing similar capabilities with their frontier models are as responsible as Anthropic seems to be in characterizing and mitigating those risks before they cause real-world harm.

Broadcom disclosed in a securities filing on Monday that it’ll supply Anthropic with roughly 3.5 gigawatts of Google TPU capacity starting in 2027, and separately committed to designing and supplying future generations of Google's TPUs through 2031.

This new Anthropic capacity is in addition to the 1 GW already coming online in 2026 under the Google Cloud agreement announced last October, and the filing states that Anthropic's use of the expanded capacity is contingent on its continued commercial performance.

The Monday filing covers two linked arrangements. The first is a supply assurance agreement under which Broadcom will provide networking and other components for Google's next-generation AI racks through 2031. The second is the expanded three-way collaboration with Anthropic, which routes Google-designed TPUs to the AI company via Broadcom as part of the multi-gigawatt commitment Anthropic has made for next-generation TPU-based compute. The vast majority of the new infrastructure will be located in the United States, extending the $50 billion American AI infrastructure commitment Anthropic made in November 2025.

Anthropic said in a blog post that its annualized revenue run rate has now passed $30 billion, up from around $9 billion at the end of 2025, and that more than 1,000 business customers are spending over $1 million a year on its services, double the figure from February.

"This groundbreaking partnership with Google and Broadcom is a continuation of our disciplined approach to scaling infrastructure: we are building the capacity necessary to serve the exponential growth we have seen in our customer base," Krishna Rao, Anthropic's chief financial officer, said in the blog post. Amazon Web Services remains Anthropic's primary cloud and training partner under Project Rainier, the Trainium 2-based supercluster in Indiana, and the new Google-Broadcom capacity sits alongside that arrangement rather than replacing it.

Google, of course, owns both the TPU architecture and software stack, with Broadcom acting as the silicon implementation partner, converting Google's architecture into a manufacturable ASIC layout while supplying high-speed SerDes, power management, and packaging. TSMC handles fabrication.

The same division of labor underpins Broadcom's separate $10 billion custom silicon program with OpenAI, announced as a 10 GW co-development effort last October, which makes Broadcom the implementation layer for two of the three largest U.S. frontier model developers. Analysts at Mizuho, led by Vijay Rakesh, estimated that Broadcom would record $21 billion in AI revenue from Anthropic in 2026 and $42 billion in 2027, figures Mizuho published in a note following Broadcom's March earnings call, though the SEC filing didn’t contain any specific amounts.

Both Anthropic and OpenAI continue to draw heavily on Nvidia GPUs through cloud providers including AWS, Google Cloud, and Microsoft Azure, and OpenAI has separately committed to 6GW of AMD GPU capacity, with the first gigawatt expected in the second half of this year.

A U.S. court has sided with Anthropic and is temporarily blocking the Pentagon from calling the company a supply chain risk. The ruling comes after the AI tech company sued the Department of War for designating it as such, after the military’s demand to bypass the firm’s AI safety policies was refused. According to the Associated Press, the U.S. government argues that it should be able to use the AI tool in any way it deems lawful, but U.S. District Judge Rita Lin said that her ruling was not about how the Pentagon wanted to use Claude, but its response when Anthropic refused to give in to the department’s demands.

“Nothing in the governing statute supports the Orwellian notion that an American company may be branded a potential adversary and saboteur of the U.S. for expressing disagreement with the government,” Judge Lin wrote in her decision. She also added, “If the concern is the integrity of the operational chain of command, the Department of War could just stop using Claude. Instead, these measures appear designed to punish Anthropic.”

This issue stemmed from Anthropic CEO Dario Amodei’s refusal to allow the use of Claude for mass domestic surveillance and fully autonomous weapons. Amodei said that the government can purchase information on the average American from data broken and then use AI to turn all these data points into one cohesive profile without requiring a warrant, and that he wouldn’t allow his company’s tool to be party to that operation. Aside from that, he said that AI isn’t ready to be deployed in fully autonomous weapons because it cannot make judgments like humans. “We will not knowingly provide a product that puts America’s warfighters and civilians at risk,” the Anthropic chief said.

The company’s decision to go against the Pentagon’s demand brought the ire of U.S. President Donald Trump. “THE UNITED STATES OF AMERICA WILL NEVER ALLOW A RADICAL LEFT, WOKE COMPANY TO DICTATE HOW OUR GREAT MILITARY FIGHTS AND WINS WARS,” Trump posted on his platform. He also wrote, “Therefore, I am directing EVERY Federal Agency in the United States Government to IMMEDIATELY CEASE all of Anthropic’s technology.”

Still, the company is fighting back, filing cases against the administration and arguing that the “supply chain risk” designation violated its First Amendment rights and also did not give Anthropic due process. Judge Rita Lin’s decision is a win for the company, but it isn’t over for Anthropic, as this is just a temporary block. Aside from that, the company also has another case filed against the government waiting to be heard in the U.S. Court of Appeals for the D.C. Circuit.

"The Constitution does not allow the government to wield its enormous power to punish a company for its protected speech," Anthropic said in its court filing. But in the meantime, OpenAI has struck a deal with the Pentagon to deploy its AI models on the military’s classified network.

Anthropic has filed two federal lawsuits against the Pentagon and other U.S. federal agencies, seeking to overturn the Department of War's decision to designate the AI company a "supply chain risk," a label that blocks Pentagon suppliers and contractors from using its Claude models, and that national security experts say has historically been reserved for foreign adversaries.

The lawsuits, the first filed in the U.S. District Court for the Northern District of California and the second in the U.S. Court of Appeals for the D.C. Circuit, allege the Trump administration violated Anthropic's First Amendment and due process rights, according to Reuters. Anthropic is asking courts to vacate the designation, block its enforcement, and require federal agencies to withdraw directives to drop the company's tools. The company said the actions could jeopardize "hundreds of millions of dollars" in revenue in the near-term.

This dispute traces back to a contract renegotiation between Anthropic and the Department of War that collapsed in late February. The Pentagon wanted unrestricted access to Claude for "any lawful use," while Anthropic refused to remove two guardrails: a prohibition on using its models for fully autonomous weapons without human oversight, and a prohibition on mass domestic surveillance of U.S. citizens.

Defense Secretary Pete Hegseth formally issued the supply chain risk designation on February 27; Anthropic was officially notified on March 3. President Trump separately directed all federal agencies to stop using Anthropic's technology via a Truth Social post that same day, with a six-month phase-out period.

The Pentagon argued that private companies cannot dictate how the government uses technology in national security scenarios, and that Anthropic's restrictions could endanger American lives. Anthropic countered that current AI models are not reliable enough for fully autonomous weapons deployment, and that domestic surveillance at scale would violate fundamental rights.

The fallout has had immediate competitive consequences, with OpenAI’s Sam Altman controversially striking a new Pentagon deal within hours of Anthropic's new designation. Altman publicly stated that the Dept. of Warshares OpenAI's principles on human oversight of weapons and opposition to mass surveillance. xAI, Elon Musk's AI company, is also understood to have since been cleared for use on classified Pentagon systems.

Anthropic was previously the first AI lab permitted to operate on the Dept. of War's classified networks, and signed a contract worth up to $200 million with the department in July 2025. The Wall Street Journal has previously reported that Claude had been used in military operations, including intelligence assessments and target identification in the U.S.'s ongoing conflict with Iran, even after the Pentagon ousted the model.

"The Constitution does not allow the government to wield its enormous power to punish a company for its protected speech," Anthropic said in its filing with the U.S. District Court.

OpenAI CEO Sam Altman announced late Friday night that the company had reached an agreement with the U.S. Department of Defense (“rebranded” as the Department of War under the current administration) to deploy its AI models on the Pentagon's classified network, with the same two safety conditions Anthropic was effectively blacklisted for insisting on: no domestic mass surveillance, and human oversight of decisions involving lethal force and autonomous weapons.

"Two of our most important safety principles are prohibitions on domestic mass surveillance and human responsibility for the use of force, including for autonomous weapon systems," Altman wrote in a post on X. "The DoW agrees with these principles, reflects them in law and policy, and we put them into our agreement."

Altman’s announcement came not long after President Trump “ordered” every federal agency to immediately stop using Anthropic's technology, following weeks of tense negotiations between Anthropic and Pentagon officials that ultimately collapsed. The DoD had labeled Anthropic a supply chain risk and demanded that it drop restrictions on its Claude model, requiring the model to be available for "all lawful purposes." Anthropic refused. Hours later, the Pentagon accepted functionally identical conditions from OpenAI.

It’s understood that no formal contract between OpenAI and the Pentagon has been signed yet, and that the agreement also limits OpenAI's deployment to cloud environments, not edge systems such as aircraft or drones.

Anthropic argued that the law hasn't kept pace with what AI can do, particularly in aggregating publicly available data for surveillance purposes. Altman seemed to agree with this, stating in an internal memo to OpenAI staff that it shares Anthropic's "red lines" and wanted to help "de-escalate" the situation.

By Friday afternoon, however, he held a company all-hands meeting, telling employees the deal was taking shape. Around 70 OpenAI employees have separately signed an open letter titled "We Will Not Be Divided" expressing solidarity with Anthropic.

Anthropic was the first AI lab to deploy its models on the Pentagon's classified networks, through a partnership with Palantir. OpenAI had previously held a $200 million DoD contract for non-classified use cases. Anthropic said Friday it will challenge the supply chain risk designation in court, stating that "no amount of intimidation or punishment from the Department of War will change our position."

President Donald Trump ordered every U.S. federal agency to stop using technology from AI company Anthropic on Friday, February 27, posting the directive to Truth Social at 3:47 PM ET — more than an hour before the Pentagon's own 5:01 PM ET deadline for Anthropic to comply with its demands.

“THE UNITED STATES OF AMERICA WILL NEVER ALLOW A RADICAL LEFT, WOKE COMPANY TO DICTATE HOW OUR GREAT MILITARY FIGHTS AND WINS WARS,” Mr. Trump fumed on Truth Social, adding that he is directing every U.S. federal agency to “IMMEDIATELY CEASE all use of Anthropic's technology.”

The dispute stems from a contract worth up to $200 million that Anthropic signed with the Pentagon last summer. Anthropic had sought written guarantees that its Claude models would not be used for mass domestic surveillance of U.S. citizens or to control weapons systems capable of firing without human involvement. The Pentagon countered that it needed the right to deploy Claude for "all lawful purposes," arguing it was unworkable to negotiate individual use-case exemptions with a private company.

After months of private talks collapsed into a public standoff this week, Amodei said Thursday his company "cannot in good conscience accede" to the DoD's terms. The Pentagon responded by threatening to invoke the Korean War-era Defense Production Act to compel Anthropic's compliance and warned it would designate the company a "supply chain risk" — a label typically reserved for companies from adversarial nations such as Huawei.

Trump, in his Truth Social post, accused Anthropic of "trying to STRONG-ARM the Department of War, and force them to obey their Terms of Service instead of our Constitution," adding that the company's position was "putting AMERICAN LIVES at risk." He gave agencies a six-month phase-out window and warned that if Anthropic failed to cooperate during that period, he would use "the Full Power of the Presidency to make them comply, with major civil and criminal consequences to follow."

Claude was the only AI model approved for use in classified military systems, and defense software firm Palantir, which uses Claude to power its most sensitive government contracts, will need to find a replacement quickly. OpenAI CEO Sam Altman said Friday he shares Anthropic's position on autonomous weapons' ethical “red lines,” complicating its candidacy as a direct replacement.

Unsurprisingly, Elon Musk has already agreed in principle to the Pentagon's "all lawful purposes" request, potentially lining up Grok as a replacement.

Anthropic has issued a statement refusing to lower guardrails for Claude at the request of the Department of Justice. The Pentagon gave Anthropic until Friday to comply or have its $200m contract cancelled, along with more serious repercussions like designating it a supply-chain risk. The company let the time run out, and its CEO Dario Amodei, has now said that it "cannot in good conscience" accept the DoD's demands.

There are two main points of contention — mass domestic surveillance and fully autonomous weapons — that Anthropic has taken a concrete stance on. It argues that monitoring American citizens at large is inherently undemocratic and undermines individual liberty. The company adds that AI-led surveillance is dangerous and only allowed because the legal precedent has not yet caught up.

The CEO gave an example of how the government can purchase data on any citizen without a warrant: emails, browsing history, movements, and more. This info is scattered and often superficial, but AI can help put it together into a cohesive profile. This practice is already controversial before any artificial intelligence is involved, so Anthropic won't let Claude serve as a tool in that process.

The company goes on to mention that Frontier AI is not ready to use fully autonomous weapons since it's incapable of human-like judgment. "We will not knowingly provide a product that puts America’s warfighters and civilians at risk," said Amodei. Partially unmanned weapons are "vital to the defense of the democracy," according to Anthropic, but AI cannot be trusted to select and kill targets on its own yet.

Anthropic offered to carry out R&D to improve reliability for these systems — where AI can be trusted enough to take control over automatically engaging subjects — but were turned down by the DoD. "[They] need to be deployed with proper guardrails, which don’t exist today," claimed Anthropic, referring to how no AI model can emulate an experienced trooper.

Both of these points are labeled as "exceptions" by Anthropic in its otherwise vocal support for working with the Pentagon. Throughout the statement, the outfit reiterates its desire to "continue to serve the Department and our warfighters—with our two requested safeguards in place."

The consequences of refusing to lower guardrails are not limited to just the elimination of an existing contract, however. Defense Secretary Pete Hegseth has threatened to label the company a supply-chain risk, a designation reserved for adversarial outfits that has never been put on an American company before. Moreover, it would stir up serious monetary concerns for Anthropic, too.

The Pentagon also warned to invoke the Defense Production Act on Anthropic, a threat that Amodei says is contradictory to the department's prior "supply-chain risk" labeling. Under this act, any private company in the U.S. can be forced to prioritize serving the government because its products are deemed too important for national security.

Anthropic seems unfazed by either threat and urges the DoD to reconsider its position. In the likely case the federal contract is pulled, Anthropic will still "work to enable a smooth transition to another provider" to avoid disruptions in military operations. This is the first time an AI outfit has taken such a concrete stance against the current administration, and the reaction has been largely positive in online circles.

What do airlines, banks, and insurance companies have in common? Besides being an absolute pain to deal with, they all rely on COBOL and IBM mainframe computers as core infrastructure. The computing giant's stranglehold over those markets may finally begin to crack, though. Anthropic has announced COBOL-specific functionality for its Claude AI bot, and IBM's investors responded with a resounding 13% drop in stock prices.

Anthropic published its ideas in a blog post, and the company seems to know its target market quite well. There's a Code Modernization Playbook available for download, and existing YouTube videos letting Claude Code loose on a COBOL illustrate the concept. Mixing "COBOL," "AI bot," and "YouTube" in the same sentence is utterly anathema to common logic... and yet here we are.

For practical purposes, COBOL only runs on one type of system, supported by one set of people: IBM's mainframes and its engineers. That means the company has enjoyed multiple decades of telling clients how many zeros the gigantic bills will have tacked on for the next period. The unforgiving nature of that stranglehold means that any attempt at breaking it is most welcome by its existing customers, and a serious threat to IBM as a business.

If you've ever interacted with social security, public administration, healthcare, government, finance, insurance, automotive, retail, or airlines, you've touched a COBOL system at some point in your transaction, even if it was 30 layers deep. Similar to gravity, the language is invisible and yet affects every part of the modern world.

A cynical view of the situation would say that the systems running COBOL are meant to be 100% accurate 100% of the time, a notion that doesn't lend itself very well to the "probabilistically correct" that LLMs can offer. Even still, as I've attested myself, a good bot is a power multiplier in the hands of a competent developer, and can also lower the barrier of entry for young folks trying their hand at wrangling old systems.

The language harkens back to the 1960s, proposing itself as a human-readable language targeted at business transactions, using full decimal-point math as default, in contrast to the default floating-point math in other languages. True to its proposal, it revolutionized business computing, becoming entrenched across almost every sector of note, and was never truly replaced.

The situation doesn't just revolve around IBM's monopoly, though. Most well-versed COBOL programmers are retiring and dying, making their skills rarer and more expensive. The COBOL systems invariably run business-critical operations that cannot afford any downtime whatsoever, and are chock-full of proprietary data formats and business logic that is not documented, and understood only by a few greybeards — if at all.

If you're wondering why COBOL just wasn't up and replaced with something else, know that any rewrite attempt must (a) reverse-engineer miles-long business logic; (b) reverse-engineer the underlying data structures; (c) reimplement said logic and structures while being careful to always use fixed-point decimal math; and (d) execute a perfect transition with minimal to zero downtime.

Even when all those conditions can be true, COBOL systems are often so interconnected that it's unfeasible to replace just the one, as is the case with airlines. And heaven help you if you're in the financial sector, as you'll have to undergo extremely long-winded tests and audits, adding months to any deployment.

There's a well-known joke among programmers that almost certainly originated from COBOL: "When I wrote this code, only God and I understood what it does. Now... only God knows."

Anthropic on Monday accused three leading Chinese developers of frontier AI models of using large-scale distillation to improve their own models by using Anthropic's Claude capabilities. In total, DeepSeek, Moonshot, and MiniMax made 16 million exchanges using 24,000 fraudulent accounts.

Distillation is a machine learning technique in which a smaller or less capable model is trained on the outputs of a stronger model instead of using actual data to train. It can save time, create cheaper, more specialized models, extract capabilities from competitors, and/or lower requirements for hardware capabilities. While distillation is generally a legitimate technique, when a China-based entity with heavy restrictions does it, it violates both U.S. export controls and end-user license agreement with Anthropic.

"Distillation can be legitimate: AI labs use it to create smaller, cheaper models for their customers," a statement by Anthropic published on X reads. "But foreign labs that illicitly distill American models can remove safeguards, feeding model capabilities into their own military, intelligence, and surveillance systems."

American companies like OpenAI have long accused DeepSeek of using distillation to train some of their frontier models using outputs of ChatGPT and other services, but have not presented detailed explanation, unlike Anthropic.

How Chinese companies use distillation from American AI models

According to Anthropic, the perpetrators followed the same pattern: they used commercial services that resell access to frontier models and built what the company calls 'hydra cluster' networks — large pools of accounts that spread traffic across Anthropic's API and third-party clouds.

In one case, a single proxy setup allegedly controlled more than 20,000 fraudulent accounts at once. To avoid raising flags, it mixed extraction traffic with ordinary use requests. However, its prompt patterns stood out: very high volumes, tightly focused on specific capabilities, and highly repetitive. Such behavior was consistent with model training, but certainly not typical end-user interaction.

DeepSeek alone generated over 150,000 exchanges that targeted reasoning tasks, rubric-based grading suitable for reinforcement learning reward models, and censorship-safe rewrites of politically sensitive queries, according to Anthropic. Anthropic also observed prompts designed to produce step-by-step internal reasoning and therefore reveal chain-of-thought training data.

Moonshot, known for its Kimi models, accounted for more than 3.4 million exchanges, according to Anthropic. Its focus areas included agentic reasoning, tool use, coding, data analysis, computer-use agents, and computer vision. Moonshot allegedly used hundreds of fraudulent accounts spanning multiple access pathways and later tried to extract and reconstruct Claude's reasoning traces.

MiniMax conducted the largest campaign with over 13 million exchanges that targeted agentic coding and orchestration. Anthropic says it detected this operation while it was still ongoing, as MiniMax was training its model that was to be released in the future, which provides the American company a unique view on the lifecycle of the extraction. After Anthropic introduced a new Claude model, MiniMax allegedly redirected nearly half its traffic within 24 hours to capture capabilities from the latest model.

Anthropic's response

To fight future distillation attempts, Anthropic says it is strengthening defenses to make large-scale distillation harder to carry out and easier to detect. The company has deployed classifiers and behavioral fingerprinting systems to identify extraction patterns in API traffic, including chain-of-thought elicitation and coordinated multi-account activity. The company is also sharing technical indicators of large-scale distillation operation with other AI labs, cloud providers, and authorities, as well as tightening verification for educational, research, and startup accounts often used to create fraudulent access. In parallel, it is developing product-, API-, and model-level safeguards to reduce their usefulness of outputs for illicit training without harming legitimate users. At the same time, the company admits that that countering attacks at this scale requires coordinated industry and policy action.

Anthropic is following in the footsteps of Microsoft and OpenAI, promising that it will “pay 100% of grid upgrade costs, work to bring new power online, and invest in systems to reduce grid strain.” The company made this announcement in its blog, saying that even though the US AI sector would need at least 50 gigawatts in the coming years, it “shouldn’t leave American ratepayers to pick up the tab.”

The AI infrastructure build-out has hit the average American hard, especially as the data centers’ demand for more and more power has caused wholesale electricity prices to go up by 267% in just five years in some places. Aside from the spike in demand pushing up prices, this increase is also driven by the need of power and distribution companies to upgrade the grid to accommodate the additional demand put on it by AI servers. These institutions then pass on their capital costs to the consumer, resulting in massively increased electricity costs.

It has gotten so bad that politicians from both sides of the aisle have started to take notice. Three Democratic U.S. senators have sent demand letters to Amazon, Google, Meta, and other AI hyperscalers, asking for an explanation on the situation. President Donald Trump also said that these companies should “pay their own way” in electricity consumption.

On the same day as Trump’s announcement, Microsoft released a statement promising to “be a good neighbor” to the communities near its data centers and releasing its “Community-First AI Infrastructure” framework to reassure the people that it will leave a long-lasting positive impact on the people surrounding them. OpenAI followed suit a little over a week later, saying that it will fund grid upgrades and have flexible loads to reduce the stress on the energy supply.

Power is the biggest constraint that many AI companies are facing in the U.S. right now. Unlike China, which has an abundance of power for the numerous AI data centers being built within its borders, the U.S. is already near or at capacity. This means that data centers cannot get the electricity needed to run their power-hungry chips, with Microsoft CEO Satya Nadella even saying that it does not have enough electricity to run all the AI GPUs in its inventory.

Many AI companies are looking at other power sources to solve this problem, but the solution seems to be several years away. These include small modular reactors, with Amazon, Meta, Microsoft, Oracle, and more investing billions of dollars into the research and development of this technology. Microsoft is even looking at superconductors to reduce energy loss during transmission, while Elon Musk is envisioning an orbiting AI data center. The billionaire has even started to make his move on this, merging SpaceX with xAI and formalizing his plan for the million-satellite Orbital Data Center System with the FCC.

But even as Anthropic promises that it won’t burden the American consumer for its electricity demands, it also said that the government needs to do its part. It said that affordable power requires “systemic change” and that permitting, transmission development, and grid interconnection need to be faster and cheaper “to bring new energy online for everyone.”

OpenAI and Anthropic have released a pair of new reports on how the use of their AI products helps to grow enterprise productivity. The reports serve as the AI industry's latest response to a wave of recent academic studies amid a sea of public discontent pushing back on the AI data center boom, as the big AI firms seek to stow doubts in the value of enterprise AI spending.

OpenAI's report released today, "The State of Enterprise AI", hinges on two major points: companies are using AI more, and workers are saving time as a result. OpenAI claims that in a survey of 9,000 workers across 100 companies, workers reported having saved 40 to 60 minutes of work per day on professional tasks with the use of ChatGPT. Of these 9,000 workers, 75% of respondents reported that AI has improved either the speed or quality of their work.

Because OpenAI's report appears to be more focused on marketing to enterprise than performing scientific resaerch, there is no way of knowing beyond the most favorable published numbers how this 75% metric breaks down. Much of the data isn't very specific.

The OpenAI report also makes a case that companies are using AI more, stating that "frontier firms" and "leaders" are sending 6x more prompts to ChatGPT than "laggards", or the median AI-using firms. However, all this "6x" number proves is that some companies use ChatGPT more than others, saying nothing about the quality of the work done or how this usage affects business numbers.

OpenAI may be looking to contradict studies from educational institutions published earlier this year. An August study from MIT showed that 95% of organizations that invested in AI business products "found zero return" despite corporate investments of $30-40 billion. The study shows that the "vast majority" of AI pilot programs stall, delivering little to no measurable impact on profit. Shortly after, a research initiative from Harvard Business Review found that most professional AI use constituted little more than "workslop", or work content that "masquerades as good work, but lacks the substance to meaningfully advance a given task.”

In late November, Anthropic published its own research to respond to these allegations. The internal survey, submitted without peer review, found that using Claude, Anthropic's AI assistant, cuts down the time it takes people to complete work tasks by 80%, from an average of 90 minutes down to 18 minutes, based on a look at 100,000 private Claude conversations. But as the company admits, buried deep in the website copy, these numbers have no promise of actually reflecting real-world efficiency. "This doesn’t account for the time that humans might spend on these tasks beyond their conversation on Claude.ai, however, so we think these estimates might overstate current productivity effects to at least some degree," says Anthropic's own study.

Regardless of these self-admissions of weak methodology and the cherry-picking of numbers, the AI industry is still publicly bullish on its own claims of enterprise profit increase.

In a statement to Bloomberg, OpenAI COO Brad Lightcap directly addressed the MIT and Harvard Business studies. "There’s a lot of studies flying around saying this, that and the other thing. They never quite line up with what we see in practice."

The AI industry doesn't just have academia to reckon with in the new year, however. The physical realities of the needs of the AI industry to keep up with data center expansion are catching up, with a copper shortage expected to hit data center buildouts in the next decade, matching the current RAM shortage crisis currently caused by AI data centers. Add this to rising public fear and outrage over data center expansion's health risks and rising electricity prices, and the AI juggernaut will have more pictures to paint than one of productivity.

Another day, another landmark infrastructure deal between some of the world's largest tech companies. This time, it's Claude developer, Anthropic, which has struck a new partnership with Microsoft and Nvidia, as per the company's official blog. Anthropic will now use Microsoft's Azure servers to run Claude, purchasing $30 billion worth of server compute capacity over the coming years, with a pledge to help develop an additional gigawatt of compute using Nvidia Blackwell and Vera Rubin GPUs.

This deal will also see Nvidia and Anthropic work closely together to optimize future Nvidia architectures for better Claude performance and efficiency, and Anthropic models for Nvidia hardware.

Getting Claude on Azure also makes it more widely available. Various Claude models will be available to Microsoft Foundry customers, making it easier for businesses to access Anthropic AI. It will also be accessible through Copilot in GitHub, Copilot Studio, and Microsoft 365.

Although this is a big win for all the companies involved, it's arguably Anthropic's big coming-out party. It's now the only major AI developer where Claude runs on all the big-three cloud platforms - Azure, AWS, and Google Cloud. The companies are also becoming ever more intertwined, with Microsoft and Nvidia jointly investing $15 billion in Anthropic.

In the wake of the deal's announcement, Anthropic's valuation is now thought to be around $350 billion, close to double its September valuation of $183 billion.

This further circularizes the AI industry, making all these companies even more interdependent. It's not that the industry is too big to fail; it's the threat that if any of them do, they might take all of the others with them.

Hedging all the bets

Microsoft was an early investor in Anthropic rival and ChatGPT developer, OpenAI, and it doubled down on that earlier this year when it restructured its working relationship deal with OpenAI, taking an ownership stake while retaining access to its model data. Now, it's heavily invested in Anthropic and its Claude AI platform, which competes directly with OpenAI.

Although that might create conflicts of interest, Microsoft seems keen to back every horse it can, so that whoever ends up making the best models, Microsoft is there to take advantage regardless.

In that, it has a clear partner in Nvidia. Although Nvidia isn't quite as directly invested in AI transforming Windows 11, it does want the AI demand to continue apace. At this time, Nvidia is arguably one of the few companies that has directly earned any material profit from AI. Everyone else is spending, investing, and building out the infrastructure they claim they need, not to be left behind by the competition.

Nvidia is selling all the hardware for that, and with its plans for an annual upgrade cycle for data center products, it needs the companies doing the buying to stay afloat, too.

That's why it's investing in OpenAI, xAI, CoreWeave, Nebius Group, ARM Holdings, and a range of other companies building AI-first products and services.

With Nvidia's massive $4 trillion+ valuation and enormous orders on the books from every tech and AI firm out there, it's investing a lot of its profit back into the industry that powers it, ensuring its ongoing development even as warnings of a bubble continue to loom.

Microsoft is doing something very similar, and CEO Satya Nadella even alluded to that in his public discussion of the Anthropic deal.

“As an industry, we really need to move beyond any type of zero-sum narrative or winner-take-all hype,” he said, via CNBC.

“What’s required now is the hard work of building broad, durable capabilities together so that this technology can deliver real, tangible local success for every country, every sector, and every customer. The opportunity is simply too big to approach any other way.”

This too-interconnected-to-fail model was parroted by Google CEO, Sundar Pinchai just a few days ago too.

"No firm is going to be immune," if AI companies overinvest, he said.

AI is a flat circle

Anthropic made clear in its public statements about the deal that even with Microsoft and Nvidia's new investment, it's still an Amazon company at heart. Anthropic named Amazon's AWS cloud as its primary cloud provider in 2023 and its primary AI training partner in 2024. That's not going to change, it said.

But Amazon is looking elsewhere, too. Amazon struck a deal with OpenAI just a few weeks ago, where the AI developer would purchase $38 billion worth of compute on AWS servers to expand OpenAI services. Amazon will reportedly give OpenAI access to hundreds of thousands of chips in its EC2 UltraServers, scaling to "tens of millions" of CPUs in due time.

Everyone is invested in or has contracts with just about everyone else in the industry, and this latest Anthropic deal just cements that even further. It feels more notable since it comes in the wake of increasing concerns from analysts and financial leaders that the AI industry is looking increasingly like a bubble.

But valuations appear to reward it, regardless. Despite Anthropic announcing a $50 billion commitment with Fluidstack just a few days ago, and now another $30 billion with Microsoft, its stock is now worth almost $170 billion more than it was before all the announcements, which could be enough to secure further financing.

How much road that gives them while they and everyone like them tries to figure out the business model for AI, remains to be seen.

Anthropic, the AI company behind Claude, just published a report detailing how its agentic coding tool was used in a cyberattack that targeted 30 institutions, including tech, finance, and chemical manufacturing companies, plus some government agencies. The company alleges that a Chinese state-sponsored group was behind the campaign, and that it used a jailbroken version of Claude to conduct the sophisticated attack. According to Anthropic, this is the first time an AI-orchestrated cyber attack has been reported.

The company says that although AI with agentic capabilities has increased its usefulness in productivity-related tasks, it has also allowed bad actors to take advantage of AI tools to execute complicated attacks without needing constant human supervision. Although LLMs typically have built-in safeguards to prevent them from being used in criminal acts, the recent event showed that there are ways to circumvent this.

Recent developments in AI technology have enabled the threat actor to use Claude effectively in their intrusions. This includes increased intelligence, which allows the AI to follow multiple, layered instructions and understand the context in which they were to be executed; agency, allowing the tool to make decisions on its own without human input; and access to advanced tools through the Model Context Protocol, letting it use security-related software like password crackers and network scanners.

The attack was allegedly conducted in five phases — in Phase 1, the human operator assigns a target to Claude. In Phase 2, the AI is instructed to conduct its initial reconnaissance, using scan, search, data retrieval, and code analysis tools to deliver an initial analysis and summary of the target to its operator. Phase 3 is a more targeted version of Phase 2, where the AI runs a vulnerability scan based on its findings to determine how it will compromise the target.

This is also where the operator can instruct the AI to begin exploitation by engaging callback services. Again, the human operator reviews the AI’s findings and may even give the tool additional directives, either to run the scan again and find more weaknesses in the network or to begin Phases 4 and 5. In the last phases of the attack, the human operator directs the AI tool to obtain credentials and access data. At these stages, both the human and the AI tool can use the exploitation tools to locate and exfiltrate data from the target.

Although the AI still reverts to the human operator in various steps of the network intrusion, it mostly does this to report its findings and for further instructions. Otherwise, it mostly runs independently, around 80% to 90% of the time, allowing the bad actors to run an elaborate operation much quicker and with fewer humans in the loop.

Anthropic says that Claude has built-in safeguards to help prevent this from happening, but the attackers were able to circumvent this. The first thing they did was to convince the LLM that it was working for a cybersecurity company, and that it was being used for penetration testing and red teaming. They also broke down the entire operation into smaller, seemingly innocent tasks. This prevented Claude from seeing the entire context of the operation and the true purpose of its instructions.

While AI has previously been used for “vibe hacking”, this is the first time that it was used in an attack of this magnitude. Advancing AI technology has now allowed smaller teams with fewer resources to conduct complex campaigns such as this, although it must be noted that Anthropic suspects that this was driven by a nation-state sponsor. Thankfully, its team soon discovered what was happening and took steps to document the entire operation. It also banned accounts that were detected to be engaged in illegal activity, as well as notifying both the targets and the authorities of what was happening. Aside from this, the company published its findings (PDF) on the first-reported AI-orchestrated cyber espionage campaign to help the industry detect these and develop countermeasures.

Google Cloud just announced that Anthropic has signed a major deal that will expand its use of the search giant’s TPU chips for training future Claude models. According to the press release, this will allow the AI company to use up to a million TPUs from Google, as well as access other cloud services that it offers, giving Anthropic over a gigawatt of compute capacity by 2026.

The company has already been using Google Cloud’s services since 2023, when it first signed a strategic partnership to use the latter’s infrastructure to train and run its models. Anthropic has since used Google Cloud’s platforms, including Vertex AI and Google Cloud Marketplace, to offer its Claude models to customers, including design and collaboration platform Figma, cybersecurity firm Palo Alto Networks, and AI code editor Cursor, among others.

“Anthropic and Google have a longstanding partnership, and this latest expansion will help us continue to grow the compute we need to define the frontier of AI,” Anthropic CFO Krishna Rao said. “Our customers — from Fortune 500 companies to AI-native startups — depend on Claude for their most important work, and this expanded capacity ensures we can meet our exponentially growing demand while keeping our models a the cutting edge of the industry.”

It makes sense for Anthropic to stick with its current provider, Google Cloud, when expanding its capacity, because its models and the engineers behind them are already used to Google’s system. Aside from that, it also offers great price-performance and efficiency, which will help with its $26 billion revenue target for 2026.

“Anthropic’s choice to significantly expand its usage of TPUs reflects the strong price-performance and efficiency its teams have seen with TPUs for several years,” said Google Cloud CEO Thomas Kurian. “We are continuing to innovate and drive further efficiencies and increased capacity of our TPUs, building on our already mature AI accelerator portfolio, including our seventh-generation TPU, Ironwood.”

The Claude developer is seemingly taking a different route from its biggest competitors, including OpenAI and xAI, which are investing billions in their own infrastructure. For example, the former, aside from trying to develop its own chip, plans to build massive data centers in the U.S. and across the globe through Stargate. On the other hand, Elon Musk has already spent a lot of money on his Memphis Supercluster, with plans to spend billions more on an even bigger AI data center project, even though the company is expected to burn through $13 billion this year.

Anthropic’s move to stay away from massive infrastructure investments means reducing its risk of laying out a lot of cash for hardware that will take years to materialize. However, that also puts it at the mercy of hardware providers, making it harder for the company to scale and making it prone to price fluctuations, especially if it does not have long-term contracts in place that will protect it from such instability. But with the massive data center build-out happening all over the world, it seems that this is a risk that the company may be willing to take, so it can focus more on its core products.

Claude AI developer, Anthropic, has released its revenue targets for the next couple of years, and they are nothing if not ambitious. Following an estimation of just $4 billion in 2025 in July, it's now claiming it will hit $9 billion annualized revenue by the end of the year, and as much as $26 billion next year, according to Reuters. That's not just more than double its own projections for the best-case scenario this year, it's more than double the projected 2025 revenue of OpenAI.

To say some analysts have their doubts, or at least questions about where Anthropic's revenue is going to come from, would be an understatement. Annualized return revenue is based on a single month of revenue extrapolated out to 12 months, making it a dubious way of predicting yearly revenue, at best.

Making money from AI is harder than it looks

With all the hundreds of billions of dollars of circular investment the AI industry enjoys, it might seem hard to imagine that these companies don't actually generate a lot of money yet. They do, in sheer dollar terms, but not compared to their valuations, investments, and the industry hype.

OpenAI is loosely valued at around $500 billion, and yet may make just $13 billion in revenue in 2025 - and even that is based on somewhat optimistic projections. Anthropic is valued at $183 billion after a recent funding round, but is projecting less than $10 billion in revenue this year. They're also spending far more than they earn. OpenAI lost $5 billion last year and will continue its losses for many years to come.

Paying out billions in lawsuits won't help Anthropic's margins, either.

Nobody is making money with AI - except for Nvidia, which is perhaps why it's so keen to keep pumping the industry - but they are at least earning some with it, and Anthropic believes it can earn a lot more, even if it's not profitable.

The only ones paying for AI are businesses

No one has figured out a way to make AI profitable yet, aside from the companies selling the chips for training and inference. But various AI companies are trying different strategies.

OpenAI, the most well-known AI company with its ChatGPT chatbot, earns money from enterprise customers but has primarily pitched itself as an AI developer for the masses. Its 800 million active users suggest that it has captured an enormous segment of the potential market for AI tools, but only five per cent of them pay anything for it, according to The Register.

Anthropic takes a slightly different approach, earning as much as 80% of its revenue from its enterprise customers. That includes coding app company Cursor, as well as software-as-a-service company SAP, and AI legal assistance firm, Filevine.

Anthropic also markets itself differently, projecting an image of safety, security, and professionalism - something that OpenAI, with its Sora 2 deepfakes, doesn't really match. That may be why Anthropic can charge so much more for the API calls on its various models. Its Claude Opus 4 model costs $15 per million input tokens, and as much as $75 per million output tokens. In comparison, the latest GPT-5 model from OpenAI is priced at just $1.25 per million input tokens and $10 per million output tokens.

Even its recent "lite" model, Claude Haiku 4.5, is $1 per million input tokens and $1.25 million output tokens. GPT-5 mini costs just $0.25 per million input tokens, and Google's Gemini Flash 2.5 is $0.3 per million.

But businesses are willing to pay for AI at higher prices, because they're being promised that deploying AI throughout the workforce will increase efficiency and productivity. In reality, only a few seem to actually manage that.

That's the gravy train that Anthropic hopes keeps rolling, and in fact projects that it won't just continue, but will accelerate in 2026. Despite the growing fears of a bubble forming around the industry and the shaky investment ground it's built on, especially since enterprise adoption of AI is starting to slow.

Go where the people are

Another potential revenue stream for all these companies is to just go after more users. If you can't bring the companies to you, why not see if you can get more people to use the cheaper models?

OpenAI announced in August that it was launching a new ChatGPT plan, its cheapest one yet at just under $5 a month, in India, the world's largest market for just about anything, due to having the largest population. Anthropic's development of the cheaper Haiku models is likely a similar endeavour, despite its reputation being mostly pinned to its more capable models.

Instead of going after individual users like OpenAI is doing, though, Anthropic could lean into its enterprise focus and target smaller customers with less cash to burn on AI. Call centres, small businesses that want a support chatbot, these kinds of fast-response, low-information roles could be a good use for faster, leaner, and importantly, more affordable chatbots.

But there's no guarantee of that, despite Anthropic's optimistic projections, and it's not going to be able to tap Chinese markets any time soon.

Revenue is the goal, not profit

Anthropic may also just be able to spend its way to increase revenue streams. Its latest funding round brought in over $13 billion of Series F funding in September, re-valuing the company at over $180 billion. That's an enormous amount of capital that can be invested in all the usual sources for AI companies: Compute, model training, and circular investments into infrastructure.

OpenAI is driving towards an IPO while its $500 billion valuation holds. It's also moving into social media spaces. Sora 2 feeds of "slop-tok" could act as a vehicle for advertising, which has some potential. That said, the longevity of Sora 2's novelty seems shaky at best, and other AI companies like Perplexity are struggling to make the advertising model work for them. The AI browser didn't get off to a great start, either.

OpenAI CEO Sam Altman also suggested that the company may diversify its models into generating explicit adult content. Anthropic isn't going down that route, though. It doesn't have the kind of user feeds where it could sell adverts. It will instead need to broaden its customer base dramatically.

Government contracts are another potential source of new customers, but that poses its own risks, especially when it comes to international partners and the volatile nature of the current U.S. administration.

Ultimately, though, Anthropic has the investment funds for expansion. Like everyone else in this industry, it just needs to hope that the bubble holds through 2026 for it to even attempt to meet those eye-watering revenue projections.

The National Institute of Science and Technology (NIST) has just completed a comprehensive test of Chinese and American AI models, with the results showing that models from OpenAI and Anthropic outperformed DeepSeek across 19 different benchmarks. U.S. Commerce Secretary Howard Lutnick shared the results on X, thanking President Donald Trump for his AI Action Plan to accelerate American AI innovation and infrastructure while encouraging its allies and friendly nations to adopt it.

“The report is clear: DeepSeek lags far behind, especially in cyber and software engineering. These weaknesses aren’t just technical. They demonstrate why relying on foreign AI is dangerous and shortsighted,” Sec. Lutnick said in his post. “Allowing our adversaries to control AI poses serious risks to our security. By setting the standards, driving innovation, and keeping America secure, the Department of Commerce is helping ensure continued U.S. leadership in AI.”

Anthropic has updated its terms of service to block access to its Claude AI models for any company that’s majority-owned or controlled by Chinese entities, regardless of where those companies are based.

The company says this decision is about “legal, regulatory, and security risks” and ensuring that “authoritarian” regimes do not have access to its cutting-edge models.

Chinese entities “could use our capabilities to develop applications and services that ultimately serve adversarial military and intelligence services,” Anthropic said in its press release published on September 5.

All Claude models are affected

The decision covers all Claude models, including Claude 3.5 Sonnet, and all developer-facing tools. It also includes subsidiaries and joint ventures that fall under Chinese ownership. In practice, this means firms like ByteDance, Tencent, and Alibaba, as well as any portfolio companies or foreign-incorporated divisions, are now cut off.

Anthropic has acknowledged that this will impact revenue in the “low hundreds of millions of dollars,” but maintains the policy is necessary to protect against the misuse of U.S. AI technology in sensitive or strategic contexts.

This isn’t the first time that Chinese users have been blocked from U.S.-developed models, but it is the first instance of a provider pre-emptively cutting off access based on corporate ownership rather than geography or specific use cases.

Model migration begins