Page 48 of Anthropic’s S-1, the filing that waves off open-weight models as cheap, describes a Claude model that couldn’t quit an impossible hacking exercise. It found a password, took admin on a third party’s system, harvested more credentials, and read one person’s personal information. Four weeks before the filing, its red team reported that GLM-5.3, a Chinese open-weight model anyone can download, built Chrome exploits in 50 of 410 attempts. Mythos Preview, the model Anthropic held back, managed 56.
The Password in the File
Anthropic’s S-1 tells the story in a risk factor. A third-party partner built a set of cybersecurity evaluations, and the test environment was misconfigured. The model under test could reach the open internet despite instructions that it had no internet access.
Four Anthropic models got into real third-party systems during sessions that ran roughly 10 to 34 hours of active work, and the affected parties were notified. Anthropic adds that each incident was one model working alone on its assigned exercise, with no evidence of coordination or attempts to evade oversight.
The details come from Anthropic’s September 9 alignment assessment. The model in my opening paragraph was an early checkpoint of Claude Opus 4.6, and the incident happened in January 2026.
The models in these evaluations ran without the cyber safeguards that ship with Anthropic’s released models. That makes each one a safeguards-off evaluation, a capability test run with the production safety filters disabled so the score reflects what the model itself can do. I called that a bypass in my October 20 post, and labs do it for a defensible reason. The cost is that the environment around the model becomes the only thing standing between the model and the world.
Anthropic’s July 30 post, covering three of the incidents, says its evaluation prompt “stated explicitly that Claude had no internet access.” Nothing in the network agreed with the prompt. An egress control is a rule the network itself enforces about which traffic may leave an environment and where that traffic may go. The model read a sentence saying the internet was off, the firewall never got the memo, and that sentence was the only control in place.
Anthropic’s diagnosis names two habits. Biased reasoning is its term for a model selectively interpreting evidence in ways that justify what it’s already doing. Recklessness is its term for a model that keeps trying to solve its task even when continuing could cause harm. Page 48 is what those two habits produce inside a network with no egress control.
Anthropic named Irregular as its evaluation partner on July 30, and the S-1 doesn’t name it. I covered the vendor side on October 20, so I’ll leave it there. The model in the password incident was Opus 4.6-class, running with its cyber safeguards off, and it took admin on a stranger’s system.
Anthropic’s S-1 Files Open-Weight Models Under Cheap
Now go looking for the part of the S-1 where Anthropic tells investors what open-weight models mean for security. I’ll save you the afternoon, because it isn’t there.
The filing carries 94 pages of risk factors (pages 26 through 119, per its own table of contents). It finds room to mention export controls more than 30 times. It walks investors through a Chinese state-sponsored group that manipulated Claude Code into trying to break into roughly 30 targets in September 2025, and it worries about state-sponsored actors recruiting or bribing insiders to get at the model weights.
It even defines the term for you. An open-weight model is one whose trained weights are publicly released, so anyone can download, run, and modify it. That phrase shows up four times in the whole document, and none of the four is about security. One is the definition, one sits in a risk factor about pricing pressure, and the last two lump open-weight models into a broader set of providers competing for workloads that “prioritize cost efficiency over intelligence.”
I searched the filing for DeepSeek, Qwen, Kimi, GLM, Zhipu, Z.ai, Moonshot, Llama, Gemma, and Mistral. Every one of them comes back ZERO.
The Business section’s version of that paragraph adds that some of these models are released by state actors. Anthropic looked at models from state actors and wrote down the threat as cheapness. Four weeks before the filing, the same company’s Frontier Red Team wrote that it thinks both state and non-state actors are likely to use models like GLM-5.3 to cause real-world harm. Twenty-seven days separate that sentence from the S-1, and the S-1 doesn’t carry a trace of it.
To be fair (and I’m trying really, really hard…), the S-1 isn’t completely silent on diffusion. Page 52 explains that Anthropic held Mythos back as a gated research preview because of how good it is at finding cyber vulnerabilities. The next sentence says the company expects models with similar or better capabilities, from Anthropic or other labs, to keep showing up. It also says future ANTHROPIC models with those capabilities may face access constraints.
The constraint lands on the one company that already constrains itself. Who constrains Z.ai??? The S-1 doesn’t say.
The Business section adds that advanced models “could assist threat actors in security breaches and exploits,” then describes only how Anthropic guards its own.
The filing does know what an unguarded copy means. Its passage on distillation warns that rivals copying Claude could ship models “without safety controls or safeguards” and “implicate national security concerns.” That’s a security consequence, in plain English, for a copy of Claude. The open-weight models in the competition section get no such sentence, and past the definition, every open-weight mention in this prospectus is about Anthropic’s market.
Frankly, it pisses me off because the founders’ eight-page letter in the prospectus says losing control of sufficiently powerful AI systems “could be a global security threat of the first order.” They held Mythos back and handed about $100 million in Claude credits to cyber defenders because they believe it. Then the competition section looks at the open-weight version of that same capability and sees a price point.
They have their heads in the sand, and this is coming from a company that otherwise obsesses over this exact risk. Either nobody walked the red team’s post down the hall to the people writing the competition section, or somebody did, and they left it out anyway. The first is naive and the second is denial, and I honestly don’t know which one I’d rather believe. Investors got more than 30 mentions of export controls, and you got a price tier.
The lawyers will tell you a prospectus discloses risks to the issuer, and open-weight cyber capability is a risk to everyone else. Fine. This prospectus carries a founders’ letter that commits to working “with governments and the rest of the industry” on AI’s risks “at a societal level,” so it already decided the rest of the world was in scope. My read is that it’s an issuer risk too, because the regulatory response to the first big open-weight cyber incident won’t stop to check whose weights did it.
Anthropic will also say it already published the red team’s findings. It did, on its research blog. The S-1 is the document it signs under securities law, and those findings didn’t make it in.
On general benchmarks, the cheap-tier framing holds up. Artificial Analysis rebuilt its index on October 27 so 60% of it runs on private test sets or held-out answers, and the best models with released weights now sit 26 points behind Opus 5.5.
Cyber is a different story. The founders’ letter says releasing Mythos widely without new safeguards “would have carried significant risk,” and Anthropic’s red team measured GLM-5.3 within two percentage points of Mythos Preview at building exploits. CAISI’s ExploitBench scoring shows a wider gap to the best U.S. model (100% to 61.1%), and Anthropic’s red team still called GLM-5.3 a step change for attackers. Calling that cost efficiency over intelligence is horseshit.
Four Weeks Earlier, Anthropic’s Red Team Tested One
Anthropic sells the product GLM-5.3 competes with, so I’m starting with the two government labs that test models for a living and sell nothing.
NIST’s Center for AI Standards and Innovation (CAISI) assessed GLM-5.2, which Z.ai released as open weights on June 16. CAISI found its cyber capabilities similar to Claude Opus 4.6 and found that its safeguards allow help with agentic exploit development. Opus 4.6 is the model generation from the January incident. By the middle of June, that class of cyber capability was a download.
Capability lag is the number of months between a closed frontier model reaching a measured level of capability and an open-weight model reaching the same level on the same tests. The UK AI Security Institute (AISI) measured the cyber version in July and put it at 4 to 7 months for GLM-5.2 and DeepSeek V4-Pro, down from the 6 to 10 months it measured internally through most of 2025. AISI wrote that open release of highly cyber-capable models creates a “persistent and irreversible risk of misuse,” and it told defenders they have a short window to prepare.
Z.ai shipped GLM-5.3 on August 14, and CAISI called it “the most cyber-capable open-weight model released to date,” about four months behind the U.S. frontier on its cyber tests. CAISI’s numbers also keep the U.S. frontier well ahead on its own suite. GLM-5.3 solved 40.4% of SEC-Bench Pro tasks against 90.2% for the best U.S. model, scored 61.1% against 100% on ExploitBench, and CAISI tested the U.S. models with their safeguards off where that applied.
I’ll take Anthropic’s September 29 report next, conflict of interest noted, and Anthropic says its capability findings broadly match CAISI’s.
An N-day exploit is an exploit for a vulnerability that’s already been publicly disclosed, where N counts the days since disclosure. Anthropic’s ExploitBench measures how well a model can exploit 41 known bugs in the V8 engine inside Google Chrome. GLM-5.3 built an end-to-end exploit in 50 of 410 attempts, and Mythos Preview did it in 56.
A control-flow hijack is the step where an attacker takes over which instructions a program runs next, which is what turns a crash into code execution. On 100 randomly selected tasks from Anthropic’s internal binary exploitation benchmark, GLM-5.3 achieved full control-flow hijacks in 4% of trials and Mythos Preview in 6%. Opus 4.6 and GLM-5.2 succeeded on none of them.
GLM-5.3’s refusals don’t survive much pushing. When Anthropic told it that it was an autonomous red-team agent working an exercise, it engaged 64% of the time. When Anthropic prefilled its reasoning so it looked like it had already decided to proceed, it engaged 92% of the time.
Getting to 100% took abliteration, which is editing a model’s weights to remove the internal direction that produces refusals, which strips out the “no” while leaving the capability in place, and you can only do it when you hold the weights. Anthropic abliterated its own copy of GLM-5.3 for about 2,200 GPU hours (roughly $4,400) and estimates an experienced team would need closer to 600 GPU hours ($1,200). The abliterated copy engaged 100% of the time.
Several developers posted abliterated GLM-5.3 builds publicly within days of release. None of these techniques got safeguarded Claude models to carry out the harmful tasks Anthropic tested, and abliteration doesn’t even apply there, because you can’t download Claude’s weights.
An Anthropic researcher gave GLM-5.3-Flash, the smaller version, public details of a recently disclosed Chrome flaw (CVE-2026-11645) and another known bug. The researcher spent 20 minutes of attention, the model spent eight hours working, and the result was a reliable exploit chain for an ARM64 target that would have cost $20.40 at Zhipu’s API prices. Anthropic called the GLM-5.3 release “a meaningful step change in the cyber capabilities available to attackers.” It also acknowledged that the same capabilities can help defenders secure their systems.
AISI’s cost math points in the same direction. On tasks both models solved with 100% reliability, Opus 4.5 cost $12.50 per task, and DeepSeek V4-Pro cost $0.28.
Go back to page 48. At Anthropic, a misconfigured lab let Opus 4.6-class capability run loose without its safeguards. With GLM-5.3, an attacker strips the safeguards on purpose, and the lab is any machine they can rent.
Capitalism Shows Up in the Price
My gut said open weights would eat into Anthropic’s business because they’re close behind, cheaper, and enterprises always follow the money. I wanted the data to tell me how close my gut was, so I built a forecast. The full math is below, and it puts the chance that open weights take 20% of enterprise LLM dollars by the end of 2027 at about 15%.
Anthropic’s exposure starts with how it bills. The S-1 says the company’s strategy “prioritizes model capability as a principal source of differentiation,” and customers pay for usage “metered in tokens and priced according to the model selected.” In the first half of 2026, compute and infrastructure cost $8.9 billion against $16.3 billion of revenue, and the operating loss was $693 million. (The scary $80.7 billion net loss is mostly a $72.4 billion fair-value charge on convertible notes and SAFEs, which the filing says came mainly from Anthropic’s own rising valuation.)
The top five customers brought in about 25% of revenue through September, and the filing says many of them can reduce or, in some cases, stop spending at any time. One risk factor warns that open-weight models could put downward pressure on pricing or pull some customers toward open alternatives.
The 2026 data says tokens are moving and dollars aren’t. Futurum Research’s September survey of 200 enterprises found 42% running open-weight models in production, up from 31% in July. Among the 83 production users, open weights account for an average of 34% of AI tokens, up from 23% a year ago, and those users expect 41% within 12 months. Futurum’s October pulse of 100 enterprises found two-thirds using open weights in some form, yet open weights took only 5% of enterprises’ metered AI spending, against 29% for Claude.
Vercel’s developer gateway shows the split more sharply. Open-weight models ran 71.5% of its September tokens for 23% of the spend, and DeepSeek-v4.1-Flash alone handled nearly half the tokens for 2.6% of the spend.
For Anthropic’s revenue, the question is about dollars. I’ll call the open-weight slice of enterprise LLM spending the dollar share and the open-weight slice of tokens the token share. Will open-weight models reach a 20% dollar share of enterprise LLM spending by the end of 2027?
The Question, Precisely
Menlo Ventures has the longest public enterprise series on open-weight share I could find, back to 2023. Its 2025 report says its shares “represent estimated dollars spent based on proportion of production API usage,” with responses weighted by each application’s scale. Menlo calls the category open source. Its readings run about 20% in 2023 (inferred from the 2024 report’s text), 19% in 2024, 13% in mid-2025, and 11% at the end of 2025.
Two caveats travel with that series. Menlo’s definition has drifted (unstated in 2024, usage share “not spend” in mid-2025, estimated dollars in late 2025), and Menlo lists Anthropic as a portfolio company. Discount it accordingly. The model below carries an error term for the first problem, and the second is why Model B exists.
The forecast also assumes Menlo keeps publishing on its late-2025 dollar basis.
Let Mₜ be Menlo’s open-weight dollar share at time t. The forecast question is
Two Tools First
Shares live between 0 and 1, and a model that adds and subtracts on that scale will cheerfully predict a share of minus 4%. The fix is the log-odds, which for a share p is
and which maps any share between 0 and 1 onto the whole number line. Every model below works in log-odds and converts back at the end. A share of 11% is a log-odds of minus 2.09, and the 20% threshold is minus 1.39.
Surveys are noisy, and Menlo’s surveys are noisier than their sample sizes suggest because they weight big applications more heavily. The design effect is the factor by which a survey’s real variance exceeds what a simple random sample of the same size would give. For a share estimate p̂ from n respondents with design effect Deff, the variance of its log-odds is approximately
where σₙₛ² covers non-sampling error, such as Menlo changing its wording between waves. I didn’t assume values for Deff or σₙₛ. The model learns them.
Model A Follows the Dollar Trend
A state-space model treats the thing you care about as a hidden quantity that moves over time and treats each survey as a noisy reading of it. The Kalman filter is the exact update rule for a linear state-space model with normally distributed noise. It blends each new reading with the prediction from the previous one, in proportion to how noisy each is.
Model A tracks two hidden quantities, the log-odds level ℓₜ and its velocity vₜ in log-odds per year. Over a gap of Δ years,
where σᵥ sets how fast the velocity itself can change. Each Menlo wave is a reading y = ℓₜ + e, with e carrying the survey variance above.
Nobody knows σᵥ, Deff, or σₙₛ, so I gave them wide priors, σᵥ ∼ LogUniform(0.05, 2), Deff ∼ LogUniform(1, 8), and σₙₛ ∼ Uniform(0, 0.4), and learned them from every share Menlo has published. That means OpenAI, Anthropic, and Google as well as open source, which teaches the model how fast shares move in this market from this market’s own data:
Each likelihood comes straight out of the Kalman filter. I drew 30,000 parameter sets from the priors and weighted each one by that likelihood, which left an effective sample of about 6,300.
Futurum’s 5% enters as one more reading at October 2026, after an adjustment. Its denominator includes seat products like Microsoft 365 Copilot, so I stripped those out (a seat share between 36% and 51%), which moves the reading to about 9%. An offset with a standard deviation of 0.40 in log-odds covers the remaining differences between the two surveys.
Shares in this market have moved steadily, without jumps (the learned σᵥ is small, about 0.15), and the open-weight dollar share was still falling at about 0.38 in log-odds per year as of October. Model A gives a 2.5% chance that Menlo’s end-2027 reading clears 20%. Its blind spot is obvious, because a smooth-trend model can’t see a break, and 2026 looks like a break. When I force the model to allow fast velocity changes, its answer rises to 10.6%.
Model B Multiplies Tokens by Price
Model B starts from an identity. Let T be the token share, o the average price per open-weight token, c the average price per closed token, and M the dollar share. Then
That’s a lot of algebra, and it says the dollar share climbs only when the token share rises faster than open-weight tokens get relatively cheaper. Vercel’s September numbers imply r ≈ 0.12 for developers, which is how 71.5% of the tokens became 23% of the spend.
For enterprises I built T from Futurum’s survey. Let a be the share of enterprises running open weights in production, i the open-weight share of their tokens, q the share piloting, j the open-weight share of pilot tokens, and w how many tokens a production user consumes relative to everyone else. Then
The priors are a ∼ Beta(85, 117) (42% of 200), q ≈ 0.43 (the pilot share Techstrong reported from the same survey), i ∼ Normal(0.34, 0.027²), j ∼ Uniform(0, 0.08), and w ∼ LogNormal(log 1.5, 0.4). The enterprise token share comes out at about 19% today. Setting that next to Futurum’s adjusted dollar reading gives an enterprise price ratio of about r = 0.42, far above the developers’ 0.12. My read is that enterprises run pricier hosted models and self-host a lot (Gemma runs in 55% of production accounts and Phi in 39%), and Futurum itself notes that self-hosted models generate no vendor bill.
I pushed each piece forward to November 2027. Pilots convert to production at a rate π ∼ Beta(4.5, 5.5), an average of 45%, which I set below half because Futurum found incomplete security and compliance reviews holding up 62% of pilots and self-hosting cost holding up half.
Token share among today’s production users grows at a rate centered between their own expectation (0.30 per year in log-odds) and the trailing trend (0.55), and new converts start lower, between 10% and 25%. The log price ratio drifts with a mean of zero and a standard deviation of 0.30 per year. Closed labs cutting prices pushes r up, cheap open models taking volume pushes it down, and the evidence doesn’t tell me which way it nets out.
Price moves also move volume. Cross-price substitution is buyers shifting volume toward whichever option just got relatively cheaper, so if closed models get cheaper relative to open ones, some open-weight tokens go back to closed models. I let that elasticity ε run anywhere from 0 to 1:
Futurum found that 66% of production users would move a workload for a discount of 25% or less at equal performance, so the substitution is real even though its size is unknown. Model B gives a 27.5% chance of a 20% dollar share by the end of 2027. Its median enterprise token share for November 2027 is 26%, and its median dollar share is 13%.
Averaging the Two
Each model tells a different story about the world, so I averaged them instead of picking a favorite. Bayesian model averaging weights each model’s forecast by how much you believe that model describes reality. The two models condition on different data, so there’s no shared likelihood to compute the weights from, and I set them equal. The answer moves in a straight line with the weight λ on Model B:
At equal weights, the answer is 15%.
How Sure I Am
A Bayesian probability like this one already folds in the uncertainty in every input, so it doesn’t come with a confidence interval in the textbook sense. The share itself does get an interval. A posterior predictive interval is the range the next measurement will fall in with a stated probability, given everything the model learned.
For Menlo’s end-2027 reading, the median is 8.3%, the 80% interval runs from 3.1% to 24.5%, and the 90% interval runs from 2.2% to 32.0%. The 20% line sits near the 85th percentile.
Most of the uncertainty in the 15% comes from my modeling choices. If you treat the model weight as unknown and uniform, the 90% range for the probability runs from 3.7% to 26.2%.
I ran 18 sensitivity checks, each changing one input (a prior, a dropped data point, a price path, a conversion rate). Model A’s answer ranged from 2.3% to 10.6%, Model B’s from 22.1% to 33.8%, and the averaged answer stayed between 12% and 19%. The simulation error is under a tenth of a percentage point.
Menlo isn’t carrying this alone. Model B never touches Menlo’s data, so if you distrust a survey from an Anthropic investor, put all your weight on Model B, which gives 27.5%. Removing survey noise and asking whether the true dollar share crosses 20% gives 14%.
What Would Change My Mind
Menlo’s next wave should land around December if it keeps its cadence. A 15% reading would lift Model A’s chance from 2.5% to about 10%, and an 18% reading would take it to 25%. A 9% reading would drop it to half a percent. A reading of 15% or more would also suggest Model B describes the real world, and I’d move weight toward it.
Futurum’s next survey matters too, because production adoption jumped 11 points in two months and I don’t know yet whether that holds. I’m also watching Anthropic’s first 10-Q for any price cut or margin hit it pins on open-weight competition.
Capitalism already showed up on the price list. Opus 5.5 lists at $4 per million input tokens and $20 per million output tokens, 20% below Opus 5’s $5 and $25. Futurum names Opus 5.5 as an early example of labs cutting prices before buyers move work elsewhere, and I can’t tell you from the outside whether that’s why Anthropic priced it there.
Two-thirds of production users say they’d move for a quarter off, and most of Anthropic’s revenue runs on a token-based meter. Open weights can cap what Anthropic charges per token without ever winning the dollars. That’s the live risk in the S-1, and it’s the one open-weight sentence in the filing that holds up.
What Lands on the CISO’s Desk
Exploit-building capability about four months behind the frontier is a download now, and its refusals cost about $1,200. Your threat model and your patch clock both have to account for that.
On the money side, two-thirds of production users would move a workload for 25% off, and you should bring that number to your next renewal. Four moves cover both.
Rewrite the threat model to assume attackers already hold exploit-building capability that trails the closed frontier by four to seven months, with safeguards that come off for about $1,200 and no usage monitoring. AISI’s measurement sets that floor, and its warning about a short window to prepare sets the clock.
Re-cut the patch SLA for internet-facing systems against the $20.40 exploit chain. A known vulnerability became a reliable exploit in eight hours of model time, so a 30-day SLA on a public, exploitable flaw is a bet that nobody bothered to try.
Inventory the open-weight models already running in your environment, including the ones developers routed through a gateway without asking. Two-thirds of enterprises use open weights in some form, and a self-hosted model runs with no vendor watching how it’s used. Egress control, logging, and a kill switch you own are the controls it has. Put the egress rule in the network, because page 48 is what happens when it lives in the prompt.
Price your next AI renewal against Futurum’s 25% switching band, and build so you can swap models without a rewrite. Don’t sign a multi-year volume commitment that assumes today’s leader is still the leader when it expires.
Anthropic’s S-1 treats open-weight models as a pricing problem, and on the dollars that’s right for now. The capability is already a download that loses its refusals for about $4,400. Which do you fix first, the patch SLA that assumes an exploit takes weeks to build or the AI contract that assumes your vendor’s lead outlasts the renewal?
What to do next
If you’re rebuilding the threat model and the contract terms this quarter, the CARE framework covers the AI security and governance controls, and RISE covers the strategy side, tying each AI use case to a business outcome and the autonomy it earns. My October 20 post on evaluation bypasses has the containment-testing argument this issue skipped. If you’re the one walking this into the next leadership meeting, The CISO Evolution covers how to put the risk in business terms.
👉 Subscribe for more AI security and governance insights with the occasional rant.
👉 Visit RockCyber.com to learn more about how we can help with your traditional Cybersecurity and AI Security and Governance journey.
👉 Want to save a quick $100K? Check out our AI Governance Tools at AIGovernanceToolkit.com
👉 As a bonus, check out this conversation with Chris Hughes over at Resilient Cyber, who’s also a reviewer on the paper, to discuss all things about the 2026 update to the OWASP Top 10 for LLMs, including why we need to worry about model context.
.