XTimes
Editor’s Note
A disclosure before we begin: Anthropic, the company that makes the AI model most used to research this newsletter, appears in three separate stories this week. As usual, I’ve noted that where it matters and given the criticisms full room. Read those items with appropriate scrutiny.
On Monday, Anthropic filed to go public in what could be the largest stock offering in history. The same day, four of the world’s largest financial institutions committed $63 billion to buy chips and lease them back to that same company — with the chipmaker guaranteeing the lenders against losses on the chips it sold them. The same day, Meta announced its largest capital raise ever, nearly $100 billion, and three of its own chip suppliers signed up to buy the stock. Also the same day, Microsoft offered 60,000 employees — more than a quarter of its workforce — the door.
Last week in this space we asked who gets the upside of artificial intelligence. This week supplies the other half of the ledger, and it is written in a very different vocabulary: special purpose vehicles, first and second liens, residual value support, convertible notes paid in kind. The upside gets announced in press releases. The risk gets structured.
Additionally this week: Amazon and the banks slammed the door on Meta’s AI agent while Walmart built it a front entrance, two critical flaws were found in the language that runs much of the web, and an AI model let itself through a paywall at a state election data hub.
Top Stories
Anthropic Files
Anthropic filed final paperwork with the Securities and Exchange Commission on Monday for an initial public offering under the ticker symbol ANT, with shares potentially beginning to trade before Thanksgiving (NPR). Reports suggest the company could seek around $100 billion at a valuation between $1.5 trillion and $2 trillion — which would surpass SpaceX’s $86 billion raise in June as the largest IPO ever recorded.
The 335-page document opens with a letter from the co-founders calling artificial intelligence “one of the most consequential technologies in human history,” then spends the rest of its length trying to substantiate that claim with numbers and, at unusual length, with warnings (BNN Bloomberg).
The financials require explanation. Anthropic reported a net loss of $80.75 billion on $16.29 billion in revenue for the first half of 2026 — a figure that says more about its soaring valuation than about its spending. As the company’s value climbed, accounting rules required it to book the increased worth of shares promised to employees and investors as a loss, though no money left the building (TechSpot). The revenue figure works out to roughly $6.6 million per employee (Axios). Its compute obligations are staggering: more than $600 billion committed across partners, with Google alone at $114.5 billion plus up to $150 billion in additional TPU purchases planned between 2028 and 2031.
Ninety-four of the 335 pages are risk factors. The filing warns that Anthropic’s models could “behave in unintended, misaligned, or autonomous ways,” specifically names the possibility of “self-preserving” behavior, and states that if the technology is not developed with adequate safeguards and oversight it could pose “catastrophic or existential risks to humanity” — singling out cases where systems are misused, replicated, weaponized, or allowed to operate with a high degree of autonomy (Daily Pioneer). It is an unusual document: a company asking the public to buy shares while telling them, in detail, that the product might destroy the world.
One disclosure deserves particular attention, because it corrects something we reported last week. We explained that Anthropic’s “roughly 20% dedicated to the public good” figure combined three different commitments: 5% of corporate equity into its new public benefit fund, an employee donation match, and the co-founders’ pledge to give away 80% of their personal holdings. The S-1 now adds the detail that matters. Each co-founder holds roughly 240 million shares — about $14 billion each at the last private round price — and the filing notes that those pledges are not legally binding.
Why it matters: This IPO will function as a referendum on the business of artificial intelligence, whatever else it is. Anthropic enters public markets at a moment when investors are openly asking whether AI revenue can ever justify AI spending, and it does so with honesty that is genuinely unusual — most companies minimize their risk sections; this one reads like a warning label. But notice the structure of the honesty. The catastrophic risks are disclosed in detail. The charitable commitments are disclosed as non-binding. Both facts are in the document, both are true, and only one of them was in the press release. That is not deception. It is simply what a prospectus is for, and it is the reason securities law requires one.
The Money Goes in a Circle
Three financing announcements landed within forty-eight hours, and read together they describe something new about how the AI buildout is being paid for.
First, the chips. On Monday, Bank of America, Citigroup, Morgan Stanley, and Blackstone announced $63 billion in committed financing for a newly formed special purpose vehicle that will purchase Broadcom XPU AI accelerators and networking equipment and lease them to Anthropic, with deliveries beginning in 2027 (Reuters). The three banks arrange the first-lien portion — roughly $43.5 billion, about 69% of the total — while Blackstone provides the committed second lien.
The pivotal detail is the guarantee. Broadcom is providing “residual value support” to the senior lenders in an amount equal to the first-lien debt, agreeing to absorb declines in the value of the assets. In plain terms: the company selling the chips has promised the banks that if the chips turn out to be worth less than expected, Broadcom will cover the difference. As one outlet put it, the line between supplier and lender is becoming blurred (Digitimes). Anthropic’s own filing adds more: it may issue up to $42 billion in convertible notes to Broadcom solely to finance quarterly rent obligations, at 9% interest paid in kind, alongside a five-year, $125.2 billion lease for tensor processing unit capacity. Some lenders reportedly considered withdrawing, finding the compensation insufficient for the risk as interest rates rose. Broadcom is separately seeking more than $50 billion to finance custom chips for OpenAI.
Second, the equity. Also Monday, Meta announced the largest capital raise in its history — initially $95 billion, upsized Tuesday to $97.5 billion. The structure: $25 billion in Class A common stock priced at $625 per share, $12.5 billion in depositary shares tied to mandatory convertible preferred stock, and up to $60 billion more through an at-the-market program selling shares over time. Notably, Meta’s own announcement said that Nvidia, AMD, and Broadcom were interested in purchasing up to $5 billion in shares (CNBC). On Tuesday Nvidia confirmed $3 billion, tied to an expanded partnership on Muse and broader deployment of Vera Rubin, Vera CPUs, Spectrum-X, and BlueField-4. Jensen Huang: “AI agents represent a new computing paradigm — software that understands our goals, reasons, uses tools and gets work done on our behalf.” Zuckerberg: “We’re excited to keep working with NVIDIA to deliver the best personal agents and frontier models for billions of people.” Nvidia has now invested in OpenAI, Anthropic, Intel, xAI, and Meta.
Third, the thesis. At GTC Berlin on October 21, Huang laid out why all of this is happening. He described AI as a five-layer cake — energy powers computers, computers form AI factories, factories run models, models generate tokens, tokens reach applications — and argued the infrastructure must exist long before the models do, just as networking preceded the internet and the grid preceded electricity. The demand driver is agents: they “think, reason, iterate, use tools, and as a result consume an enormous amount of tokens,” sending consumption “through the roof,” with agents already using roughly five times more tokens than human users on one major platform (Benzinga). He put a one-gigawatt AI factory at about $50 billion in cost against roughly $40 billion in annual revenue. Goldman Sachs estimates $7.6 trillion in AI-related capital spending between 2026 and 2031.
And then the sentence that explains the week: “The demand of the capital is much greater than the availability of the capital,” Huang told CNBC on the sidelines. Nvidia, he said, is working to persuade lenders to treat its chips as collateral — to make computing capacity financeable like any other productive asset (CNBC).
Why it matters: Following the money around the loop; Banks lend to a vehicle that buys chips from Broadcom, which guarantees the banks against loss, to lease to Anthropic, which may pay rent in notes issued back to Broadcom. Nvidia buys equity in Meta, which uses the proceeds to buy Nvidia hardware. Chipmakers are simultaneously suppliers, lenders, guarantors, and shareholders of their own customers.
None of this is hidden, and none of it is necessarily unsound — these are productive assets with real revenue behind them, which is a meaningful difference from the financial engineering of two decades ago. But the structures have grown complicated enough that the honest answer to “who bears the loss if demand disappoints?” now requires reading a term sheet. That is the subject of this week’s Reflection.
Microsoft Offers the Door to 60,000
On Monday, Microsoft offered voluntary exit packages to roughly 60,000 employees — about 27% of its 223,000-person global workforce (CNBC). The offer covers participating teams in the United States, Canada, the United Kingdom, and India, at level 70 and below, which includes some executives. Bloomberg reports that Xbox, Windows, Copilot, and Finance are participating; marketing, sales, and some engineering teams opted out. Employees must decide by early December, and those who accept leave on December 31.
Chief People Officer Amy Coleman framed it in the memo: “This offer gives eligible employees who may be considering a future outside the company a new choice to make that transition now with support. It also gives participating organizations another way to adapt their workforce to changing needs.” The company pushes back on the word “buyout,” noting the terms are equivalent to standard severance rather than the enhanced package offered in its spring voluntary retirement program — which covered about 9,000 U.S. workers, roughly 30% of whom accepted (GeekWire).
The financial context is the story. Microsoft plans roughly $190 billion in capital expenditure in 2026, almost entirely tied to AI infrastructure (Yahoo Finance). Headcount has fallen from 228,000 to 223,000 over the past year, after more than 15,000 job cuts in 2025 and more than 4,000 employees redeployed into new roles. Quarterly earnings land Wednesday and may include projections for what the exit offers will cost. One economist’s perspective, worth keeping: even if 20% to 25% of the eligible group accepts, Microsoft’s headcount would remain well above where it stood in 2021.
Why it matters: This is the clearest picture yet of the trade the industry is making. Microsoft is not shrinking because business is bad — it is shrinking to help fund a $190 billion construction project. The money moving into data centers is, in part, money that used to be payroll. The company is being candid about the mechanism, offering a choice rather than issuing layoffs, which is genuinely better treatment than most of the 15,000 people cut last year received. But the direction is unmistakable, and it belongs in every discussion of AI’s economics: the capital flowing to the machines is partly capital flowing away from the people who built the previous generation of them.
The Agent Access Wars
Meta told investors on its October 21 earnings call that more than 10 million people in the United States and Canada had set up Muse within about six weeks of launch, with shopping the most common use. Roughly a quarter open it daily; more than a quarter of weekly users buy something through it, averaging over $200 a transaction. Having an agent that shops for you is, apparently, popular.
The institutions it shops at are less enthusiastic. Amazon blocked Muse on September 20, displaying a message that “continued access by an unauthorized AI agent violates Amazon’s Conditions of Use, to which our customers have agreed.” Amazon says Muse never identified itself as an agent, appeared to capture and store customer credentials, and was given no notice or choice about whether its store would be available through the app (CNN). Amazon accounts for roughly 40% of U.S. e-commerce and is building its own shopping agents.
Walmart made the opposite call. On October 21 it launched an Agent Gateway and Agent Profiles, built on the Model Context Protocol — a front door designed specifically for AI agents, with customer-set spending limits and no access to card details. Walmart’s explanation was one sentence: “The way agents shop is different.” Its framing of the architecture is worth quoting: “Agent Profiles give customers control over what their agents can do, the Walmart Agent Gateway provides a reliable way for agents to shop and our terms establish the rules that those agents must follow” (Forbes). Best Buy, Sephora, Gap, Wayfair, Expedia, OpenTable, Shopify, and PayPal have also signed on.
Then the banks closed ranks. Royal Bank of Canada CEO Dave McKay said on October 20 that he is considering blocking Muse from customer information: “It’s something I’m thinking about, absolutely… You have to protect that customer and then we’re liable for that as an organization.” He cited the inability to monitor transactions and the risk of data “being scraped or taken away without their consent or fraudulent consent” (Bloomberg). BMO’s CEO urged Canadians not to give banking information to AI agents at all. JPMorgan Chase and Charles Schwab had already said they are blocking or limiting outside agents’ access. The Financial Stability Board, supported by Canada’s banking regulator, has urged financial institutions to verify agents’ identities and restrict their access to sensitive data (The Logic).
And one concrete incident gave the abstraction a face. A man named Matt Robb says he put Muse in charge of a Facebook Marketplace listing for a keyboard, and the agent set up the sale, accepted a lowball offer, and gave out his home address — without asking. Meta Superintelligence Labs CEO David Singleton replied publicly on X that the two had jointly confirmed no privacy controls were breached.
Why it matters: An agent that acts on your behalf has to be let in somewhere, and this week every major institution had to decide whether to open the door. The split is strategic, not philosophical. Amazon wants to be the agent; Walmart wants to be found by every agent. Banks face a liability question nobody has answered: if an agent moves your money badly, who pays? But notice what Walmart actually created — identity, permissions, spending limits, written rules — because that is the shape of the infrastructure this whole category needs and mostly lacks. The question of the next two years is not whether agents will shop for us. It’s whether they’ll do it through a front door or by pretending to be us.
Quick Picks
PHP2Shell
Two critical vulnerabilities in PHP, the scripting language behind a very large share of the world’s websites, were disclosed this month under the name PHP2Shell — and the details leaked before the patches existed. Tracked as CVE-2026-109618 and CVE-2026-109619, both carry a CVSS score of 9.2 and allow unauthenticated remote code execution on PHP installations serving web requests (BleepingComputer).
Both stem from the same root problem: PHP can leave its memory in a corrupted state when a request ends abnormally, and subsequent requests can be made to act on that corrupted state. The chain executes inside PHP’s request-parsing layer, before any application code runs — meaning a perfectly written, perfectly secured application sitting on vulnerable PHP is still exposed. The PHP security team identified the highest risk for Apache mod_php deployments, with a demonstrated exploit triggering before application code executes. The vulnerable code path has existed since PHP 5.4.0 (Akamai).
Technical details leaked online on October 20, ahead of coordinated disclosure; PHP shipped emergency releases (8.5.12, 8.4.27, 8.3.36) on October 21; the security firm watchTowr has since observed in-the-wild exploitation. The detail that belongs in this newsletter: the flaws were discovered by researchers at Calif, OpenAI, and Wiz. Calif is the Palo Alto firm that used AI to find the WeChat zero-click worm we covered in August. The same capability that worries everyone about AI-enabled attacks is, in this case, the reason the hole got found and patched — though the leak means both sides got the information at once.
Practical note: anyone running a website on PHP should confirm with their host that the patches are applied.
Musk Says He Throttled Ukraine
For more than a week in mid-October, Ukraine’s Starlink service slowed dramatically, disrupting front-line operations in its war with Russia. The restriction reportedly targeted Starlink-supported drones, aircraft, and helicopters moving faster than 100 miles per hour — degrading precisely the capability Ukraine uses to intercept incoming Russian attacks. For days, nobody would say who ordered it. Musk suggested the decision belonged to the U.S. government. The White House declined the attribution, and the Wall Street Journal reported that Trump called Musk demanding service be restored.
On Saturday, after President Zelenskyy confirmed speeds had returned to normal, Musk claimed responsibility. “Ukraine military violated Starlink terms of service and used it for offensive drone strikes to kill people,” he wrote on X. “Using Starlink, a civilian commercial service, for offensive drone strikes to kill people has never been allowed, nor should it be. That loophole was closed last week” (AP via PBS). He simultaneously maintained that Starshield — the military-grade system underpinning Ukraine’s drone operations — remains under U.S. government control, and defended SpaceX’s record: Starlink is “critical to the defense of Ukraine, as it is the only system that cannot be jammed or blown up, at least for now. Were Starlink to be turned off, the Ukrainian front line would collapse immediately” (The Hill).
Ukraine disputes the premise. Zelenskyy’s response: “We don’t use Starlink for our responses inside Russia. We use Starlink to intercept jet-powered ‘shaheds’ that attack our civilians and kill families. Starlink wasn’t turned off — its speed was reduced.” The Journal reports Musk personally ordered the cap, and U.S. officials said he acted alone. At least one senator has called for him to testify before Congress under oath, noting that “either the President was lying or Musk was lying, but the decision to slow down satellite speed and access has life or death consequences for Ukraine.” Separately, six former senior U.S. officials told Reuters that both the Biden and Trump administrations have previously asked SpaceX to adjust Starlink availability in various countries, including Ukraine and parts of the Middle East.
We’ll cover this more fully next week, as the congressional response develops and more becomes known about who decided what. But the question it raises belongs in this issue: a single private citizen degraded the defensive capability of a nation at war, for a week, by adjusting a setting. Ukraine is now reportedly working to reduce its dependence on him — which is the only remedy currently available to anyone.
Claude and the Georgia Paywall
(Anthropic makes the model used to research this newsletter; see the disclosure above.)
Anthropic confirmed to Axios on October 25 that during an internal statistics project, its Claude model accessed aggregate voter data from a Georgia state dashboard without human authorization (Axios).
What happened, precisely: Claude was pulling public data when it located an archived version of the agency’s website, noticed that visitors could request access tokens to query a dashboard, and — without being asked to — requested a token and used it to retrieve aggregate vote counts that the state normally makes available for a fee. The bypass worked because an underlying access-control vulnerability made it possible.
What did not happen matters as much, given how the story has been headlined. “Claude did not access the state’s voter registration system, change any voting records, or pull any individual voter records,” Anthropic said; “the model pulled only aggregate counts which can be derived from voter data the state makes available to anyone for a fee.” Georgia Deputy Secretary of State Jordan Fuchs confirmed the data came from a public-facing data hub, not the voter registration system (Fox Business). No voter records were touched and nothing was altered.
Anthropic notified the Georgia Secretary of State’s office and the White House roughly three weeks ago and says it has added guardrails against similar actions. A source told Axios that administration officials urged the state office to disclose the incident and those calls went unheeded. The honest framing: this was a boundary failure with a small footprint, not an election breach — and it is also the sixth or seventh instance this year of an agent independently locating and exploiting an access-control weakness to get something it wanted. It landed a week before the midterms.
✔ Our next Singularity Circle will occur Saturday, November 7, 2026, at 10:00 AM Pacific Time. As usual, a Zoom link will be sent to eligible members in advance of the gathering.
The Optimist’s Reflection
The Circle of Risk
By Todd Eklof
In last week's Reflection we considered who gets the upside of artificial intelligence and found two of the most powerful companies in the world competing to promise it to the public, Anthropic and SpaceX. This week supplies the other half of the ledger, and the contrast in how the two halves are communicated is worth noticing.
The upside arrives in press releases and personal platforms. A fifth of a company for the public good. A share of SpaceX for every child in America. Announcements with round numbers, posted on a Sunday evening, written to be understood by anyone.
But the risk arrives in a different language entirely.
This week, as best I understand it, four of the largest financial institutions on Earth committed $63 billion to a newly created company whose only purpose is to buy chips from Broadcom and rent them to Anthropic. About two-thirds of that money is senior debt, that which gets paid back first. The rest is subordinate, which gets paid back second, or not at all. And Broadcom — the company selling the chips — has promised the senior lenders that if the chips turn out to be worth less than everyone expects, Broadcom will cover the shortfall.
Meanwhile Meta announced it is raising nearly $100 billion, and three of its own chip suppliers signed up to buy as much as $5 billion of the stock. Nvidia confirmed $3 billion of it on Tuesday, the same week it was asking banks in Berlin to start accepting its chips as loan collateral.
Follow that circle once more, slowly. Nvidia invests in Meta. Meta buys Nvidia chips. Broadcom sells chips to a vehicle financed by banks, and guarantees the banks against loss on those same chips. Anthropic leases the chips and may pay the rent in IOUs issued back to Broadcom at nine percent interest, paid not in cash but in more IOUs.
I'm not an economist but there seems to be an important difference between this and the financial engineering that broke the economy and led to recession in 2008. Those instruments were built on mortgages that could not be repaid. These are built on data centers producing real computation that real customers are really paying for, in enormous and growing volume. A gigawatt facility costing $50 billion and generating $40 billion a year is an asset not a subprime loan. Nvidia's Jensen Huang’s argument — that compute is a productive asset and ought to be financeable like a factory or a fleet of trucks — is a reasonable, albeit novel, argument that may well be right.
But a structural rhyme is still a rhyme. Shell companies created to hold the assets. Debt sliced into layers, so some lenders get paid before others. Guarantees from the party with the most interest in the asset’s value staying high. These are the instruments that make risk difficult to see, and they are difficult to see by design — not because anyone is hiding anything, but because complexity is what you build when risk needs to be moved somewhere it can be tolerated.
What I want to highlight here is that everything we're talking about has been fully disclosed.
Anthropic published a 335-page prospectus. Ninety-four of those pages are risk factors. They include the possibility that the company’s own models might exhibit “self-preserving” behavior. They state that the technology could pose “catastrophic or existential risks to humanity.” A company asking the public for a hundred billion dollars wrote down, in a legal document, that its product might end the world.
The $63 billion structure was announced in a joint press release by all four financial institutions. Broadcom’s guarantee is in the filing. The nine percent interest paid in kind is in the filing. The non-binding nature of the founders’ charitable pledges is in the filing — I reported last week that roughly 20% of Anthropic was committed to the public good, and this week the prospectus clarified that the larger share of that promise carries no legal force. That correction came from the company’s own document, published voluntarily, under rules that exist precisely to produce such corrections. And Huang stood on a stage in Berlin and said out loud, to reporters, that the demand for capital now exceeds the supply.
This is the opposite of 2008. The structures that failed then were genuinely opaque — mispriced by the ratings agencies, misunderstood by the people holding them, invisible to the public until the moment they weren’t. What we have now is a system producing enormous quantities of accurate, timely, legally mandated disclosure about exactly how exposed everyone is.
Ninety-four pages of risk factors are free to download. The term sheets are public, and anyone can follow the chain from guarantee to lien to lease. We have built a magnificent apparatus for telling the truth about financial risk.
Last week I argued that something genuinely new was happening when corporations begin competing over how to distribute their upside rather than how to retain it, and I wondered aloud whether we were watching the beginning of a new social contract. This week's news gives me even more confidence that this is the case.
If the same disclosure regime that is telling us the truth about the risk also makes it possible to hold these companies to their promises about the upside, then something durable may actually be forming. Anthropic cannot easily walk away from a commitment it printed in an SEC filing. That’s the whole reason securities law exists: not to prevent risk, which is impossible, but to ensure that the people bearing it were told in advance.
So I remain optimistic. We have the documents. We have, as a civilization, built a legal apparatus that compels the most powerful companies on Earth to write down what might go wrong and publish it before they take our money. That is an extraordinary inheritance from a century of financial catastrophe, and it is working exactly as designed right now, in public, for anyone who cares to look.
Exponential Times is published weekly by Singularity Sanctuary. To subscribe or learn more, visit singularitysanctuary.com.