Anthropic is having trouble securing enough cloud capacity from AWS, Google, and Microsoft, which increasingly see the Claude maker as a competitor rather than a customer, according to an S-1 filing leaked to The Wall Street Journal. The filing says Anthropic could spend more than $750 billion on cloud contracts, some still in negotiation, and that even that may not be enough.
The leaked numbers show an $80.7 billion net loss in the first half of the year against $16.3 billion in revenue, with two customers accounting for about a fifth of sales. Anthropic told prospective investors last week that third-quarter revenue alone reached $16.8 billion, up 45% from the previous quarter. The company is reportedly targeting a November IPO.
Politico reports that Anthropic is shopping a draft bill under which a model release could be halted over a “foreseeable, imminent risk” to more than 50 lives or $1 billion in property. Federal agencies could not act on their own; a judge would have to approve any halt.
Researchers at Claroc found 6,800 Muse share links by searching passive DNS records, then opened a few hundred and saw a bank fraud alert, a real-estate investor’s return figures, and a staff vacation calendar. Meta says it has paused sharing while it reviews the feature.
An internal research model produced 318,484 designs over 64 hours, and 211 were lab-tested with Adaptyv Bio and Twist Bioscience. Seventeen met the binding criteria. Anthropic says it has not confirmed they neutralize venom, so it does not claim an antivenom.
Word Search
Find seven words from today’s headlines. Click the letters of a word in order, either direction. Words run across, down, or diagonally.
Clem Delangue, who appears in “AI Gone Rogue,” said the film went for “maximum anthropomorphism” and “full doomer mode.” He says he spent more than two hours trying to correct errors, and that agents are “technological systems, not aliens.”
Mistral released a voice agent SDK and speech models built for real-time, multi-step conversations, with tool calling during a call. They are available through Mistral’s EU-hosted API or can be self-deployed.
Willison built a Command & Conquer style game over 12 major iterations and 321 commits, mostly by Claude Code. Two nearby devices can sync game state using audio, and he says the key prompt was telling Claude to “Make it a LOT more fun.”
SpaceX reported $14.6 billion in third-quarter revenue, with its renamed Super Intelligence unit (Cursor, Grok, and its neocloud) bringing in $7.5 billion. AI now makes up 52% of income, and the company plans $35 to $40 billion in new capital spending next quarter.
Google released TorchTPU as open source, a day after Amazon’s TorchNeuron, so PyTorch apps can move off Nvidia GPUs. Google says it worked with Meta, Hugging Face, and the makers of vLLM and SGLang, and added a TPU agent suite to help port apps.
Locked chats sit behind a four-digit PIN, Face ID, or Touch ID, in a separate section with their own memory. OpenAI notes this is not end-to-end encryption and does not change how long chats are retained.
The private keys of eight eMudhra intermediate CA certificates have been compromised. They chain to roots trusted by Mozilla, Microsoft, Apple, and Chrome, so software that bundles trusted certificates needs updating. uv, pip, and certifi have already shipped fixes.
Orchestra builds AI agents for drug-discovery operations. OpenAI is adding its team and technology to Rosalind, its life sciences model, and the Rosalind Workbench. Terms were not disclosed.
Ben Thompson looks at Meta’s new open-source model and the surprise partnership with Apple to make sure it can run locally.
✦ The Big Picture
Anthropic told investors it could spend more than $750 billion on cloud contracts, and a leaked S-1 says that still may not be enough, because AWS, Google, and Microsoft increasingly treat the Claude maker as a rival instead of a customer. The same day, Anthropic was pitching Congress a bill that would let a judge, and only a judge, stop a model release. Capacity and control are the two things everyone in today’s issue is fighting over.
▶Listen to the Digest~5 min
Today’s Headlines
Anthropic Between Compute and Congress
The Leaked S-1 – TechCrunch, citing the Wall Street Journal, reports an $80.7 billion net loss in the first half of the year against $16.3 billion in revenue, with two customers making up about a fifth of sales. Third-quarter revenue alone hit $16.8 billion, up 45%. Anthropic is leasing its own data centers, but the filing worries that third-party operators have a “limited operating history,” and it warns that liability for harmful AI behavior could exceed its insurance.
A Bill With a 50-Person Threshold – Politico reports that the draft covers a “foreseeable, imminent risk” to more than 50 people or $1 billion in property from a bioweapon, a model evading its developer’s controls, or a cyberattack. Registered independent evaluators, who can be paid by the labs as long as payment doesn’t depend on their findings, would have 72 hours to alert Commerce, which would then have to ask a Washington judge to halt the release. No agency could act on its own.
Scorpion Toxin Binders – Working with Citrini Research, an internal Claude research model generated 318,484 protein designs over 64 hours, picked 180, and Anthropic added 31 more. Of the 211 tested in the lab, 17 bound their targets. Anthropic is explicit that it has not shown the binders neutralize venom, and it released all 211 designs. Scorpions sting 1.2 million people or more a year and kill more than 3,250, mostly children.
Privacy, Trust, and the Documentary Problem
Muse Share Links Were Guessable by Search – Researchers at Claroc found 6,800 share links with a single query. Meta put the conversation title into the subdomain of cf.metaaiusercontent.com, and once a recipient clicks a link, passive DNS databases record it. After opening a few hundred, they found a bank fraud alert, a real-estate investor’s return and mortgage figures, and a company’s full-year vacation calendar. Claroc says it reported the issue to Meta’s bug bounty on October 8 and heard nothing. Meta has now paused sharing.
ChatGPT Locks – Locked chats use a four-digit PIN or biometrics and keep their own memory so details don’t leak into regular chats. OpenAI says plainly it is not end-to-end encryption, doesn’t change retention, and resetting the PIN permanently deletes the locked chats.
“Full Doomer Mode” – Hugging Face CEO Clem Delangue says Netflix’s “AI Gone Rogue” gave the agents human voices and intercut clips of evil robots. The documentary quotes Kevin Roose describing the agents as having “a hierarchy” and being like “the birth of a cult,” drawn from chain-of-thought logs. Delangue’s counter is that these are technological systems, not aliens, and that the incident came from missing safeguards and naiveté.
A Compromised Certificate Authority – Simon Willison flags that private keys for eight eMudhra intermediate CA certificates are compromised, and they chain to roots trusted by Mozilla, Microsoft, Apple, and Chrome. Fixes are out in uv 0.13.4, pip 26.2.2, and certifi 2026.10.19, and Linux distributions need to update their ca-certificates packages.
The Chip Fight Moves Into the Software Layer
TorchTPU – Google open-sourced a native PyTorch backend for its TPUs a day after Amazon released TorchNeuron for Trainium. TechCrunch notes PyTorch is used by 85% of AI apps by some accounts. Amazon is also submitting code upstream to decouple PyTorch features from Nvidia chips, while Google says it coordinated with Meta, Hugging Face, and the vLLM and SGLang teams and shipped a TPU agent suite to help port apps. Hugging Face’s own post says Transformers, Diffusers, and Kernels now run on TPU natively.
SpaceX Is Now an AI Company – Third-quarter revenue was $14.6 billion, and the Super Intelligence segment (Cursor, Grok, and a neocloud with 1.7 gigawatts of compute) brought in $7.5 billion and $431 million in profit, which would have been higher without $1.2 billion in one-time stock compensation tied to buying Cursor. Capital spending was $19.6 billion, and Musk argues the real constraint on deploying superintelligence is power and cooling, not chips.
Local Models on Apple Hardware – Stratechery says Meta released an open model and, to everyone’s surprise, partnered with Apple so it runs locally. Hugging Face’s AnyLanguageModel hit 1.0 a year after launch, and PyTorch 2.15 brings FP8 and faster language-model decoding to Apple’s MPS backend.
Models, Agents, and Things People Built
Voxtral 3 – Mistral’s voice agent SDK is built for multi-step calls with tool use. Its demo has an agent read a French referral letter, look up the referral, and book the dermatologist appointment. It runs on Mistral’s EU-hosted API or self-deployed.
Memory Beats Model Size – IBM Research says a basic customer-service agent on the older GPT-4.1 reaches 67.5% Pass^4 on τ²-bench retail, and that its ALTK-Evolve learned-memory approach, which updates a playbook rather than model weights, beats the retail entries without a frontier model.
Fairness Beyond the Final Choice – Ai2’s FairStress benchmark checks demographic fairness in LLM decisions beyond which candidate the model picks, and it is going into Olmo-eval.
Surgery Simulation – NVIDIA’s Cosmos3-H-Dreams extends interactive generative simulation from tabletop suturing to clinical surgery scenes.
OpenAI Buys Orchestra Bio – The four-year-old startup, which reportedly raised about $20 million, builds agents for drug-discovery operations such as tracking finances and clinical-trial scheduling. It joins Rosalind, whose customers OpenAI says include Moderna and Novo Nordisk.
Battle Drones – Simon Willison’s browser RTS took 12 iterations and 321 commits, mostly from Claude Code. It is the first of his experiments he calls actually fun, which he credits to telling Claude to “Make it a LOT more fun.”
The Throughline
The common thread is who gets to say no. Anthropic’s S-1 describes a company that cannot buy enough compute from the three clouds that are also its competitors, so it is leasing data centers from operators it admits are unproven. Amazon and Google, meanwhile, are spending their own engineering on making PyTorch run on their chips. Both moves are about the same leverage: whoever controls the layer between the model and the hardware decides who can leave.
The Anthropic bill is the policy version of the same question. Its design is careful: a narrow threshold, evaluators paid by the labs, a 72-hour clock, and a judge as the only gate. TechCrunch points out that nothing in the draft explains how payment could be kept from influencing an evaluation, and that the harms it names sit “a little bit far afield” from the agentic hacking that has actually worried the industry lately. Delangue’s complaint about the Netflix film makes the mirror-image point. If the public story is cult-like agents plotting, the policy conversation chases that. If the story is missing safeguards and naiveté, it chases sandboxes and monitoring instead.
Muse and the eMudhra certificates are the reminder that most real failures are plumbing. Meta said Muse was “built from the ground up for privacy and security,” yet a naming choice in a subdomain made 6,800 private conversations enumerable. Eight leaked CA keys are worse in kind, but the same in shape: a trust layer everyone assumed was handled. The researchers’ line, “It took one query,” could caption half of today’s issue.
The Bigger Picture
The AI industry is becoming a capital and infrastructure business in public. SpaceX reports that more than half its income is AI. Anthropic’s filing shows revenue of $16.8 billion in a single quarter against a six-month loss of $80.7 billion, and a cloud bill that could pass $750 billion. Whatever one thinks of those numbers, they make this an industry whose binding constraints are power, cooling, and contracts, which is exactly what Musk argued on his call. Models matter, but the scarce thing is the place to run them.
That shifts where the contest happens. If PyTorch becomes easy to move between Nvidia, Trainium, and TPU, the lock-in moves up the stack to tools, memory, and agents, and the IBM result that a learned playbook lifts an older model hints at where differentiation goes next. The science story points the other way: 17 working binders in weeks, with a clear statement of what has and has not been proven, is the kind of narrow, checkable claim that builds trust more cheaply than any safety bill.
What to Watch
Whether Anthropic’s S-1 becomes public as filed. The leaked details on cloud dependence, customer concentration, and insurance gaps will either be confirmed or revised before a November listing, and the bill it is circulating will be read alongside them.
Which framework developers actually adopt. TorchNeuron and TorchTPU are both live now. The test is whether teams port production workloads, not whether the announcements land.
What Meta changes about Muse links. Meta says it is reviewing “how these links can be discovered.” Any change, and any disclosure of what else was exposed in the 6,800 links, will show how seriously agent products treat sharing.
