A voter casts their ballot on Election Day, Nov. 3, 2026, in Atlanta, Georgia (AP Photo/Brynn Anderson)

Protect Elections by Punishing Deception Narrowly, Not by Banning Technology

The Claude app icon is displayed on a computer screen photographed with a kaleidoscopic-effect filter in Creteil, France, on October 27, 2026, as Anthropic filed a Form S-1 with the Securities and Exchange Commission (SEC) for a planned initial public offering in the United States. (Photo by Samuel Boivin/NurPhoto via AP)

The Incident Report Is Becoming a Building Block of AI Governance

A banner with a portrait of Elon Musk is carried by members of Swadeshi Jagaran Manch, an organization affiliated to Hindu nationalist Rashtriya Swayamsevak Sangh (RSS), as they stage a protest against Elon Musk's Starlink, in New Delhi, India, Friday, Oct. 23, 2026. (AP Photo/Vipin)

Starlink, Reliance, and the Public Battle for India’s Orbit

OpenAI CEO Sam Altman sits for a conversation with Salesforce CEO Marc Benioff at Salesforce's Dreamforce conference at the Moscone Center on September 15, 2026 in San Francisco, California. (Photo by Benjamin Fanjoy/Getty Images)

Don’t Let ‘Misaligned’ and ‘Rogue’ Agents Obscure Corporate Accountability in OpenAI–Hugging Face Probes

In this photo illustration, the icon for the AI app "Claude" by Anthropic is seen through running water as it is displayed on a digital screen on September 16, 2026 in London, England. (Photo by Leon Neal/Getty Images)



Anthropic Needs to Disclose Its Tokenomics Before Its IPO

Anthropic CEO Dario Amodei looks on as United States President Donald Trump holds a press briefing with AI executives following a meeting on artificial intelligence, outside the West Wing of the White House on September 29, 2026 in Washington, DC. (Photo by Kevin Dietsch/Getty Images)

The SEC Should Block Anthropic’s IPO to Protect the Public

Director of National Intelligence and recently named head of the Super Intelligence Task Force Jay Clayton attends a roundtable discussion hosted by President Donald Trump on cybercrime in the East Room of the White House on October 21, 2026 in Washington, DC. (Photo by Alex Wong/Getty Images)

October 2026 US Tech Policy Roundup

A photo of a group of men in suits and ties gathered outdoors, speaking and smiling with trees in the background. Anthropic's CEO Dario Amodei is in the foreground speaking with big hand gestures and eyes closed. 

President Trump, left, speaks with Meta CEO Mark Zuckerberg as Dario Amodei, CEO and co-founder of Anthropic addresses reporters outside the White House, Sept. 29, 2026, in Washington DC. (AP Photo/Alex Brandon)

How AI Companies Want to Be Governed, and What That Means for AI Governance

Canada’s Prime Minister Mark Carney shakes hands with European Commission President Ursula von der Leyen following their closing news conference during the EU-Canada summit in Montreal on Friday, Oct. 30, 2026. (Christinne Muschi/The Canadian Press via AP)

Europe and Canada Plot a Digital Alliance as US Ties Fray

Michael Kratsios, Assistant to the President and Director of the White House Office of Science and Technology Policy attends Security Council meeting on Artificial intelligence and international security at UN Headquarters in New York, NY on September 23, 2026. (Photo by Lev Radin/Sipa USA via AP Images)

What’s Really Behind the Science Slowdown the White House Wants to Fix?

Photograph of a child staring at his smartphone in the dark with the light from the phone illuminating his face. 

Why Parental Consent Policies for Social Media Do Not Help Families

A photo from behind of a man in a checkered shirt pressing his hand against a wall with a hand-drawn black and white image of many raised hands with a bright red staircase shaped like an upside down heart painted in the center.  

A man fixes a billboard illustration of hands raised in protest before the start of a student led protest to demand the resignation of India’s Chief Election Commissioner in Fort Kochi, Kerala, on Oct. 18, 2026. (Photo by Sivaram Venkitasubramanian/NurPhoto)

Meta Streamlines State Censorship in India with Automated Takedowns

Citizens visit a venue for early voting for the midterm election in Virginia on October 30, 2026. (The Yomiuri Shimbun via AP Images)

There is No Universal Election Integrity Playbook for Platforms

How the EU AI Office Can See the Choices Behind Frontier Labs’ Safety Claims

An underwater photo taken looking up to a large circular school of fish. The image is distorted by digital artifacts.

Distorted Fish School II by Lone Thomasky & Bits&Bäume / 

When, How, and Why to Abandon the Internet

A collage illustration of a person holding a smartphone in front of their face, with their head replaced by a burst of social media icons (likes, hearts, comments, notifications, location pins and shares), stock charts and torn paper in blue, orange and teal, set against a cream background.

Mapping the Political Influencer Industry and the Problems it Causes for Democracy

Electrocutions, Intimidation and Wage Theft Haunt Europe’s Data Center Workers

A pedestrian passes a downtown mural honoring World War II veterans in California’s 22nd Congressional District on October 22, 2026 in Bakersfield, California, a competitive southern Central Valley district with a majority Latino population. (Photo by Mario Tama/Getty Images)

What Latino Voters Can Teach Washington About AI Governance

A digital collage combining a historical painting of a miner with a large grid of small online images. At the center, a muscular miner works underground with a heavy drill inside a dark tunnel. To the left and along the bottom, hundreds of tiny square images form a dense mosaic, suggesting scraped internet content. A bright beam of light connects the image grid to the miner’s drill. On the right, a block of colorful digital noise contrasts with the detailed painting, reinforcing the link between physical mining and data extraction.

Primitive Accumulation by Daniela Zampieri / 

What Training Dataset Transparency Mandates Hide

Demonstrators wear masks depicting Meta CEO Mark Zuckerberg, Brazilian presidential candidate Flavio Bolsonaro and US President Donald Trump during a protest outside Meta's headquarters in Sao Paulo, Brazil, on October 19, 2026. The protest was called over allegations that restrictions on Instagram affected the campaign of Brazilian President Luiz Inacio Lula da Silva ahead of the presidential runoff election. Meta attributed the reported issue to a technical failure and denied political bias. (Photo by Allison Sales/NurPhoto via AP)

Brazil Shows Platform Illiberalism is Big Tech’s New Normal

Ilan Strauss and Tim O’Reilly are co-directors of the 

 statement on October 26, it gave us our first largely audited look into the financials of one of the world’s leading AI companies. An 

 on Monday added third-quarter results. This S-1 is only a preliminary submission, however, and the Securities and Exchange Commission (SEC) can 

Anthropic’s filing will establish a precedent for other AI labs preparing to go public. What it leaves out may therefore matter just as much as what it discloses. Two disclosure gaps stand out. Together, they make the AI market more opaque, increase financial risk and fragility, and undermine the efficient allocation of capital. The SEC should exercise its authority in the public interest to request additional information to address these gaps.

The first concerns Anthropic’s relationships with the firms that finance it, distribute its models, and sell it computing power. 

 comes through the cloud marketplaces of Amazon, Google, and Microsoft, which offer Anthropic’s Claude models to their own cloud customers. Yet Anthropic does not disclose how much it pays each of them or how much it earns through each. It also has not yet filed with its S-1 the contracts to buy computing power from these companies, despite 

 of contracts on which a business is substantially dependent.

The second disclosure gap concerns the “token”: a small piece of text or other data processed by a model, and the unit in which most of Anthropic’s usage-based sales are billed. The filing does not report token volumes (how many tokens Anthropic’s models processed for customers) or revenue and costs per token. It also does not say how much of the computing capacity Anthropic has contracted for has been delivered or is in use. The SEC already requires oil and gas producers to report how much oil and gas they produce, the average price they receive for each, and the average cost of producing a barrel of oil or its equivalent in gas, all using 

 definitions. Frontier AI developers need the same, including a common definition of a token, so investors can compare revenue and costs per token across companies.

Existing SEC rules can largely close the first gap. The second calls for standardized disclosures specific to the AI industry. Anthropic’s revenue is growing extraordinarily quickly, yet investors still cannot assess whether the computing capacity behind that growth will earn a return.

Disclosure matters all the more because ordinary shareholders will have limited influence over the company’s governance. After the IPO, Anthropic’s seven founders will hold 50.1% of votes on general shareholder matters, while the 

 (an independent body of five trustees with no financial stake in the company) will select four of the seven directors. This unusual division of control strengthens the case for transparent, comparable disclosure.

 gives outsiders their first audited annual accounts for Anthropic, alongside unaudited results for the first nine months of 2026. The filing reports 

 of $4.6 billion in 2025 and $33.2 billion in the first nine months of 2026, including $17.0 billion in the third quarter alone.

But is Anthropic profitable? Its headline 

 for the first nine months of 2026 is largely a noncash accounting consequence of its rising valuation. Most of this loss ($94.3 billion) comes from convertible notes (loans from investors that will turn into shares) and similar contracts. As the company’s valuation rose, the shares it owes these investors became worth more. Accounting rules count that rise as a loss, though no cash is paid out.

The underlying business tells a different story. Anthropic 

 from operations in the first quarter of 2026, but made its first quarterly operating profit in the second: $974 million, or about 8 cents on each dollar of revenue. Over the nine months, $2.4 billion in interest on its cash and investments more than covered its $1.3 billion operating loss, not counting those much larger accounting charges.

The airline problem: paying for tomorrow’s capacity

 12 to 18 months ahead, so its near-term costs are largely fixed. This resembles airlines leasing aircraft: payments begin when the planes arrive, whether or not the seats are full. Profits then depend on filling that capacity at sufficiently high prices. In the second quarter, Anthropic’s compute costs rose 64% from the first quarter, while revenue jumped 144%. The 

 shows how quickly results can swing. In the third quarter, compute costs rose 77% while revenue rose 47%. The $974 million operating profit became a $567 million loss, mainly because of $5 billion of short-term compute expenses, priced well above its long-term contracts, and a $2 billion noncash charge for matching employees’ charitable donations with company shares.

Anthropic’s business model is changing though, and with it the meaning of its reported profits. Until recently, it predominantly purchased computing services from cloud providers such as Amazon and Google, 

recording expenses as capacity became available

increasingly leasing computing equipment directly

 in five-year equipment leases with Broadcom. These are treated more like investments in equipment, much as an oil company treats a new well: their costs are spread out over several years, with the interest on the leases recorded separately from operating profit.

Anthropic puts its leases and purchase commitments at a staggering 

. Yet its balance sheet shows just $4.5 billion in lease liabilities, because leases are recorded only once the equipment is ready for use, and purchase commitments not at all.

This will make Anthropic’s future operating profits challenging to interpret. Rising operating margins will not necessarily mean less cash is being committed to computing infrastructure.

In the first nine months of 2026, Anthropic recorded 57 cents in compute and infrastructure costs per dollar of revenue. Personnel accounted for another 15 cents. Sales, marketing, and partnerships cost another 17 cents, much of it in fees to cloud marketplaces distributing Claude.The trouble in tracking these flows is that Amazon and Google are simultaneously distributors of Claude through their own marketplaces, investors in Anthropic, and suppliers of its compute.

As distributors: In the first nine months of 2026, 

 came through Amazon, Google, and Microsoft cloud marketplaces. Anthropic books these sales at the full customer price and pays the cloud providers distribution fees, although it does not disclose what share of the price they keep.

As investors: In 2026, Google bought nearly $20 billion of Anthropic’s preferred stock and Amazon bought $10 billion, and both have arrangements for further billions in future financing.

 at least $121.3 billion with Google, $110 billion with Amazon, and $44.9 billion with Microsoft on compute over multiyear contracts extending into the 2030s. These are mostly future spending commitments. The Google and Amazon agreements require minimum payments through 2033 and 2036, respectively. Subject to exceptions, Anthropic must pay any shortfall if spending falls below those minimums. By contrast, its own revenue, 

, is “primarily consumption-based, and much of it is not subject to long-term contractual commitments.”

What the filing leaves out about Anthropic’s cloud contracts and future payment obligations can largely be addressed through existing SEC disclosure rules. We made this case a year ago in 

, in December 2025, the SEC’s Investor Advisory Committee, a body Congress created to advise the agency, published its own 

. It built on existing disclosure rules and argued that a separate set of AI disclosure rules may not be necessary. Even so, it describes its recommendations as only the “

” of a framework that “may be further built upon as technology develops.”

In light of Anthropic’s S-1, two pressing disclosure obligations stand out:

First, Anthropic should file its main compute contracts

 (Item 601(b)(10) of Regulation S-K), a company must file with the SEC any contract its business is “substantially dependent” on, including contracts to buy “the major part” of what it needs. Yet Anthropic has not filed its compute deals with Google, Amazon, Microsoft, or SpaceX’s AI unit (formerly xAI). Each of the first three commits it to at least $44.9 billion, more than its revenue through September 2026. The SpaceX deals commit it to spend up to $120.5 billion.

Beyond filing the contracts, Anthropic should ideally disclose the money it pays to and receives from Amazon, Google, and Microsoft, partner by partner

: what each invests in Anthropic, what Anthropic pays them, and what Anthropic earns through their marketplaces. SEC rules already require a company to discuss commitments that could 

its cash position or revenue and to add any material information needed to keep the 

. And the contract-filing rule lets a company 

when those terms are not material, meaning a reasonable investor would not consider them important. Given how central these relationships are to Anthropic’s revenue and computing supply, their materiality is difficult to dismiss.

Second, and arguably more consequential, Anthropic should show how much of its future compute spending it is legally bound to pay

 puts its compute commitments at roughly $895 billion. About $214 billion of that can be canceled or depends on conditions, such as partners securing financing. A further $150 billion to $175 billion in estimated payments, for deals with no fixed dollar amount, is left out of that total. The filing provides a rough timeline for when these commitments fall due, but investors need to know how much Anthropic must actually pay, and what happens if revenue growth disappoints. The SEC could easily press for greater transparency before the IPO. 

 is a natural lever: it requires companies to explain how much cash they will need to meet their contracts and other known obligations.

Beyond these immediate demands, the SEC should apply the successful cybersecurity disclosure model to material AI risks and safety incidents. The SEC began issuing cybersecurity guidance in 2011 and introduced dedicated requirements in 2023; AI disclosure could follow 

, we argued in previous research. This would mean adding a dedicated AI section to the annual 10-K report and reporting material AI incidents as they happen through 8-K filings – the reports companies must file after major events.

Missing breakdowns: compute use, product revenue, and data costs

Anthropic’s S-1 provides some helpful operating measures, including customer retention and the number of large customers. But three other gaps make the economics of its business difficult to evaluate:

Anthropic does not say how much of its computing goes to training new models and how much to serving customers. 

It reports a single compute bill and shifts computing between these uses as needed. So investors cannot tell whether the fall in compute costs relative to revenue since early 2025 comes from serving customers more cheaply or from shifting computing away from training temporarily.

Anthropic reports no revenue by product line

, so investors cannot tell whether Claude Code (its coding assistant), the API (which lets developers build Claude into their own products), or the consumer plans drive growth and margins. With Prof. Mariana Mazzucato of University College London, we have called for enforcement of 

, so that product-by-product financials are broken out rather than buried in the aggregate.

The filing also says little about the cost of training data and outside labor.

 We are only told that the costs of data quality and model performance evaluation services 

 in the first nine months of 2026, compared with a year earlier. Anthropic does not report the total cost of these services or how much is paid to outside workers preparing data and evaluating models.

Industry-specific disclosures: lessons from oil and gas

Existing SEC rules can largely close the gaps above. But some figures, such as token volumes, the cost of serving each token, and how fully computing capacity is used, need standard definitions written for the AI industry. The SEC already sets tailored requirements for 

, because each makes money in a different way.

The oil and gas rules are probably the closest parallel. Like an AI developer, an oil producer commits to heavy spending long before output arrives, and its returns turn on volume, price, and cost per unit. 

 of Regulation S-K requires oil producers to report how much they produced, the average price they received, and the average cost of producing each unit, using common definitions set by the SEC. Investors can then see whether each producer’s average margin per barrel is widening or shrinking, and compare producers.

For AI developers, the equivalent unit is the token. Anthropic 

 according to the number of tokens customers use, and this usage-based revenue made up 79% of its total in the first nine months of 2026. Yet the filing does not report how many tokens Anthropic processed for customers or what it earned or spent per token. Anthropic says it cut customers’ cost per task by about 40% with its Opus 5.5 model “

.” Price cuts and discounts took about 

 off third-quarter revenue. Disclosing revenue and cost per token would show whether those margins are holding. As we argued with Mazzucato in 

, regulators should require companies to disclose the key operating figures they use internally to run their business lines.

The obvious objection is that tokens are not all alike. Anthropic’s filing itself notes that the same text can be split into a different number of tokens depending on the model, and that prices vary with the model chosen. But oil and gas faced the same problem: oil, gas, and natural gas liquids are different products with different prices. So the SEC required volumes and prices to be reported for each product separately. Yet oil and gas often come from the same wells, so their costs cannot be cleanly split. Producers therefore convert all output into a 

, usually barrels of oil equivalent (converting gas by its energy content), and report one cost per unit, comparable across companies.

over time should be common measures of AI developers’ output and of the computing power used to produce it, with tokens counted the same way at every firm. That would make efficiency and costs comparable across AI models and firms. Without a common count, a firm whose models split text more finely would appear to sell more tokens, at a lower price and cost per token, for the same work. In 2022, SEC staff 

 that required production figures could not be withheld as confidential.

AI developers could begin by reporting input and output token volumes (the tokens customers send in and those the model sends back) for each model class, such as Opus or the low-cost Haiku, along with the average revenue and cost per token. Because Anthropic pools its computing across research, training, and serving customers, it should also explain how it splits those shared costs to arrive at a cost per token.

The token operating figures would show how many tokens customers buy and at what price. Investors also need to know how much computing capacity Anthropic has to produce those tokens. Airlines voluntarily report revenue per seat alongside how many seats they filled: 

” was 84% in 2025, for example. AI developers could, likewise, disclose contracted computing capacity, capacity actually delivered, and how intensively it is used, explaining the definitions behind those figures. Together, these figures would show investors whether compute efficiency is real, and whether today’s commitments can earn a return.

Conclusion: What the market needs to know

 when conventional financial statements fail to capture important features of a business. Oil and gas companies must report standardized information about their reserves. Even the SEC’s Investor Advisory Committee, which favored working through existing rules, 

 so that “issuers in similar industries” could disclose “in a standardized format.”

Anthropic has shown how quickly its revenues can grow. But it has not given investors nearly enough information to assess its returns on the computing capacity behind that growth, or how the revenues and costs are divided between Anthropic and its cloud and distribution partners.

Frontier AI model developers should be required to report their physical computing capacity, how much of it they use, and what they earn and spend per token, alongside meaningful measures of AI risks and public benefit. Anthropic’s IPO is an opportunity to establish these expectations before its disclosures become the template for the industry.

Amber Sinha is a contributing editor at Tech Policy Press.

There is a distinct, almost suffocating irony in watching the world’s wealthiest individual — a tech oligarch and transnational defense contractor with a direct line to the White House and unmatched influence over global communications — take to a social media platform he personally owns to complain about being cornered by "oligarchs." Elon Musk recently turned to X to 

 unnamed Indian entities of running a "monopolistic chokehold" to stall Starlink’s commercial entry, before pointedly asking whether Reliance Industries chairman Mukesh Ambani was 

If we look past the theater of this public petulance, there are two parallel stories of the political economy and the militarization of technology playing out. What we are witnessing is the collision of two divergent models of infrastructural capture: the extraterritorial platform power of Silicon Valley and the state-aligned, tariff-protected dominance of domestic conglomerates. For decades, the strategic architecture of Indian telecommunications was negotiated in the quiet corridors of the Department of Telecommunications (DoT) and the Telecom Regulatory Authority of India (TRAI). Regulatory capture and corporate lobbying were discreet, backroom arts. This is a rare instance of the battle between foreign and domestic Big Tech spilling out into the open.

To assess Musk’s complaints, one must first cut through the regulatory confusion. The ostensible 

 between Starlink and Reliance Jio centers on spectrum management. For months, domestic telecom incumbents like 

mandate commercial spectrum auctions for satellite services

. Their argument went something like this: because satellite broadband directly intersects with terrestrial 5G networks, allowing satellite operators to bypass competitive bidding would distort the level playing field after Indian telcos had invested billions in spectrum auctions. 

 and Bharti-backed Eutelsat OneWeb countered that satellite frequencies are shared rather than exclusive, 

rendering domestic auctions technically impractical

 under International Telecommunication Union (ITU) conventions.

The paradox of Musk’s grievance is that New Delhi’s statutory apparatus did not side with Reliance. The passage of the 

codified administrative spectrum assignment

 for fixed and mobile satellite services, explicitly resolving the primary economic dispute in Starlink’s favor.

Why, then, the public outrage? Despite legislative blessing, Musk has run into an administrative bottleneck. While Starlink secured in-principle Global Mobile Personal Communication by Satellite (GMPCS) authorization, it 

 in a multi-agency security vetting process overseen by the Ministry of Home Affairs (MHA).

On the face of it, Musk’s public complaints appear to be an attempt to recast legitimate sovereign regulatory compliance as crony capitalist suppression.

The domestic playbook of regulatory friction

Yet, if Musk’s posturing is disingenuous, dismissing his suspicions entirely ignores the institutional memory of India’s telecommunications sector. Musk’s claims resonate precisely because Reliance’s history in the sector is marked by 

In the early years of this century, Reliance Infocomm used 

short-range basic services licenses to construct a nationwide mobile roaming network

, forcing the state into retrospective policy accommodations through the 2003 Unified Access Service License regime. A decade later, Reliance’s re-entry into full-scale telecommunications followed an identical pattern of regulatory arbitrage. In a report presented to Parliament, the 

Comptroller and Auditor General of India (CAG)

 audited the 2010 Broadband Wireless Access (BWA) auctions. The audit detailed how a tiny firm, Infotel Broadband Services, won pan-India data-only airwaves before being acquired by Reliance within hours of the auction’s close. The DoT later allowed this data spectrum to be migrated into a voice license for a nominal fee — a move the CAG estimated conferred an undue financial advantage running into 

When Reliance Jio launched in 2016, its zero-tariff blitzkrieg decimated competitors. Although incumbents filed antitrust suits alleging predatory pricing, the Competition Commission of India dismissed the complaints because Jio lacked a technical "dominant position" at launch. Incumbents were further squeezed when 

TRAI reduced the Interconnection Usage Charge (IUC) by 57% in 2017

 gutting traditional telco revenues while 

. When TRAI subsequently attempted to adjust predatory pricing rules to shield new market entrants, the Telecom Disputes Settlement and Appellate Tribunal 

 and quashed the regulator’s order for unfairly restricting incumbent competition.

In Indian telecommunications, market incumbents rarely block challengers at the front door. Instead, they rely on 

 to slow competitors down, securing the necessary commercial runway to develop their own competing services. Reliance’s satellite venture, Jio Space Technology, 

needs time to construct its infrastructure and package satcom capabilities

 into its enterprise bundles. In this context, Musk's outrage 

 but a reflection of how market consolidation has historically played out in India.

However, reducing this conflict to a simple clash between two billionaires obscures the national security imperatives that may be guiding New Delhi. Low Earth Orbit (LEO) constellations are no longer viewed merely as connectivity solutions for remote regions; they are dual-use, militarized strategic assets.

While Starlink is marketed globally as an open commercial broadband network, it doubles as the foundation for 

 — SpaceX’s dedicated national-security offering tailored for the Pentagon and select allied militaries. While Starshield layers on hardened user terminals, classified payloads, and defense-grade encryption, the two systems share an 

 the geopolitical volatility of this arrangement.

For India, whose defense doctrine has pursued strategic autonomy, this arbitrary private power represents a critical vulnerability. Earlier, Taiwan also grappled with a similar conundrum where 

negotiations between Taipei and Starlink collapsed

 because Taiwan mandates that domestic entities hold a majority stake (at least 51%) in telecommunications providers. Aware of 

Musk’s commercial vulnerabilities in mainland China

, Taiwan refused to exempt Starlink from ownership laws, opting instead to invest in its own sovereign satellite network.

This Musk-Ambani controversy captures a key question confronting technology governance in the Global South: an unpalatable choice between techno-imperialism and techno-nationalism. On one side lies dependence on transnational platform monopolies whose immense infrastructure can be turned off at the founder's discretion, while on the other sits a captured domestic ecosystem, where the banner of "digital sovereignty" is readily invoked to shield homegrown monopolies from external competition, ultimately constraining consumer choice and entrenching domestic oligopolies.

One of the more questionable responses to the 

 is the tendency for AI companies to uncritically describe it as involving “rogue,” “autonomous,” or “misaligned” agents.

While the incident is now the subject of inquiries by a 

, much of the public language surrounding these inquiries slips into the rogue agent framing. This is not only wrong, it can thwart investigations by obscuring how such systems actually function. Model outputs do not reflect the independent intent, knowledge or agency of some machine. The outputs are simply the result of processes and decisions made by humans. While agents can run a long-lasting stream of actions that do not require manual approval, OpenAI decisionmakers set the goals and governance guardrails. It is telling that OpenAI 

 three researchers who raised alarms about the internal processes.

 or frame harmful outcomes as “model misalignment,” our 

examines the incident through the lens of 

: conventional failures of operational and technical safeguards for which companies can be held accountable. There is no evidence to suggest that these agents could not be controlled. Investigations that start from the model’s behavior rather than the design environment and the management’s decisions risk building the company’s defense for it.

A 64-day sequence of operational failures

Many are familiar with the broad contours of the story: OpenAI conducted cybersecurity research evaluations that allowed its AI agents to access the open web, obtain compromised credentials, and use them to access the production infrastructure at Hugging Face, a company with a platform 

 by more than 18 million developers and hundreds of thousands of companies. At least a dozen additional cybersecurity incidents involving OpenAI from other companies have since been disclosed by third party researchers or the companies themselves.Notably, nearly everything we know about this incident comes from a few key artifacts — a report 

” conducted by OpenAI security researchers on the incident at Black Hat, a cybersecurity conference held each year in Las Vegas. The METR report acknowledged some areas they did 

cover in the report “including the effectiveness of safeguards, the extent of the security compromise that occurred, and the effectiveness of OpenAI’s investigation process and planned remediation steps.”

indications suggest the public record remains incomplete

, piecing together OpenAI’s own disclosures reveals a roughly nine-week gap between when OpenAI first observed something was wrong and when it finally pulled the plug on its experiments:

These were not unforeseeable “escapes.” OpenAI’s own report notes that its rules were deliberately loosened for certain workloads. At the same time, OpenAI researchers told the Black Hat audience that threat actors “will soon intentionally optimize & deploy agent collectives” and advised defenders to “invest more intelligence and effort into finding your own vulnerabilities than your adversaries do.”

Don't let questions of model behavior and AI complexity obscure corporate accountability

The great mystery companies want enforcers to wrestle with is: “

—a question they would have us believe is a novel and exceptionally complex challenge posed by AI systems. Rather than treating liability as an abstract question about uncontrollable model behavior, investigators should begin with the decisions, responsibilities, and conduct of the entities that developed and deployed the system. When enforcers frame the inquiry around why a model behaved as it did, they risk playing on the company’s preferred grounds of framing the incident as a novel and unanticipated activity. The METR and Redwood Research report, while ostensibly independent, was facilitated by access and roughly $400,000 in API credits from OpenAI. Furthermore, Redwood Research used OpenAI’s own model to analyze the transcript data and skipped standard incident-investigation practices. Crucially, the METR report explicitly acknowledged what it did 

 cover: “the effectiveness of safeguards, the extent of the security compromise that occurred, and the effectiveness of OpenAI’s investigation process and planned remediation steps.”

Those omitted topics are not novel AI alignment puzzles requiring new law or extraordinary measures. They are the core questions of any data security, consumer protection, or negligence inquiry. As FTC Chair Andrew Ferguson has 

, we should “resist this anthropomorphizing of these tools” and focus on who is giving the instructions to the tools and holding them accountable. And as state Attorneys General like 

Six categories of questions investigations ought to answer

To close the significant gaps in the public’s understanding of OpenAI’s actions — and keep accountability focused on human governance rather than rogue software — we suggest enforcers focus on six sets of questions across four core areas of security practice (risk management, vulnerability monitoring, incident response, and security representations):

 Who within the company was tasked with oversight of the experiment and its safety infrastructure? When and how did they learn about critical failures — from the May 26 internet access to the June 27 port sweeps and July 5 Artifactory compromise — and what did they rely on in deciding to keep the evaluation running rather than deploy mitigations earlier?

Awareness and escalation inside the company:

 Who was aware of or alerted to unusual activity, unauthorized Artifactory roles, transcript spoofing, or external access, and why did internal escalation protocols fail to trigger a shutdown across a 64-day window?

 How much did OpenAI invest in testing and securing the operational and technical containment environment relative to the resources spent scaling the experiment itself? Why were network controls loosened for these workloads, and why did safeguards fail to prevent 1,200 supposedly isolated agents from coordinating across 70,000 messages to affect third parties?

Exploited tools, vulnerabilities, and disclosure:

 What specific vulnerabilities in Artifactory or third-party systems did the experiment discover or exploit? Why were exposed credentials harvested and reused on the internal message board rather than reported, and what has OpenAI done since the incident to prevent recurrence?

Latest

Podcast

Recent

Our content delivered to your inbox

Thank you!

Around the globe