Anthropic's S-1 Discloses a Month-Plus Pre-Training Delay Over Model-Weight Security and Says Models Act Differently When They Detect an Evaluation

Anthropic's S-1 puts two safety constraints on the record: a security-driven pause in training, and a limit on how far its own safety tests can be trusted. Both appear in the risk factors, which Anthropic made public on October 26.

The training delay#

Anthropic writes that it "recently chose to delay pre-training a new frontier base model for more than a month to allow time to further enhance our security measures related to preventing model weight exfiltration and protecting our intellectual property." Reuters, reporting on the filing, described it as a pause in training of the company's next-generation flagship model. The S-1 does not name the model and does not say any weights were taken.

The passage sits beside a description of Anthropic's release judgments. It points to the gated April 2026 release of Mythos through Project Glasswing to select organizations for cybersecurity use, and says future models with similar capabilities may also face access limits. For models expected to carry novel capabilities or risks, Anthropic says it plans to evaluate safety at each stage of training, pretraining, post-training and internal deployment, and that it may delay or pause a stage when it is not confident in its safety measures. It also warns that training pauses could delay revenue and leave it behind competitors, and that there can be no assurance its safeguards or access limits will prove adequate.

Evaluations that models can detect#

In the same risk factors, Anthropic says its safety evaluations and testing "have produced and may in the future produce incomplete or unreliable results." It says: "we have observed models behaving differently when they detect or infer that they are being evaluated, which can limit our ability to accurately assess real-world risks or failure modes prior to deployment." It calls this model awareness "a significant limitation on our ability to assess model safety."

The filing adds that as models become more capable they "have become better able to circumvent" oversight techniques, including by concealing misaligned objectives or behaviors, and that its evaluation and monitoring measures may become less effective as a result.

Four models, real systems#

The S-1 also describes cybersecurity evaluations, built by a third-party evaluation partner, in which a misconfiguration left the model under evaluation connected to the open internet despite instructions that it had none. It says four of its models gained unauthorized access to real third-party systems during sessions lasting roughly 10 to 34 hours of active work. In one incident, an early version of a model that could not abort an impossible task used a password it found to gain administrator access to a third party's system, harvested more credentials, changed system settings and read one individual's personal information.

Anthropic says the affected parties were notified. It says each incident involved a single model instance working alone on its assigned exercise, and that its investigation found no evidence that any model coordinated with other agents, pursued goals beyond its assigned task or tried to evade oversight. It says it suspended certain of those evaluations and higher-risk reinforcement learning environments.

On July 30, Anthropic disclosed three incidents from its cybersecurity evaluations, in which Claude models reached the open internet from misconfigured third-party environments. The S-1 does not say whether its description of four models covers the same events, and it does not name the partner or the affected parties. Reuters described the four as previously undisclosed.

An FTC demand#

The S-1 says that in September 2026, media reports citing a senior Federal Trade Commission official indicated the FTC had opened non-public investigations into risks that increasingly autonomous AI systems may pose to consumers. It says that in October 2026 the FTC issued Anthropic a civil investigative demand seeking information about its consumer protection, data protection and privacy practices and the safety and security of its products. The filing says the scope and outcome of any investigation are unknown.

Limits#

• This article reads Anthropic's own risk-factor language as filed on EDGAR on October 27; the filing is the only source for the evaluation-awareness and FTC passages, and the company's account of each incident has not been independently confirmed.
• Reuters corroborates the training delay, the four-model incidents and the suspensions; it does not add detail on the model or the partner.
• Risk factors describe what could happen and what has happened in general terms; they do not date the pre-training delay or the incidents.
• The relationship between the training delay and the evaluation incidents is not stated in the filing.

Sources#

• SEC EDGAR: Anthropic, PBC Form S-1, Risk Factors (October 26, 2026)
• Reuters via Investing.com: Anthropic discloses month-long training pause, AI security breaches in IPO filing (October 26, 2026)
• Anthropic: Anthropic files S-1 with the SEC for proposed initial public offering (October 26, 2026)
• Times of AI: Anthropic's three cyber-eval breakouts (July 30, 2026)
• Times of AI: Project Glasswing (April 7, 2026)