The Day Evidence Became Discoverable: Investor Day, Subpoenas, and the Authorization Problem Nobody Has Solved

October 19, 2026 — Day 270 of our AI crisis timeline.

The last entry ended with a list of five questions for Anthropic’s investor day. The day came and went on October 14, and the answers matter less than what else happened on the same Wednesday. This entry covers October 14 to 19. The week’s main story is that the AI safety argument moved out of essays, accords and voluntary reports and into compulsory process. Subpoenas, state court complaints, a pension-fund comptroller’s letter and an investor meeting all landed on one day.

One Wednesday, Four Events

The investor day. At Anthropic’s San Francisco headquarters, Dario Amodei and CFO Krishna Rao told a handpicked group of institutional investors that third-quarter revenue reached $16.8 billion, up about 45% from $11.6 billion in Q2 and $4.7 billion in Q1. Per Bloomberg’s account, the company said it was profitable on an adjusted basis, free-cash-flow positive, with an 85% adjusted gross margin and an adjusted operating margin above 11%. FT reported that Anthropic earned about $1.70 of revenue for every dollar spent on compute. Reuters added two details that make good color. Executives talked about using Claude to help design a custom chip, and attendees were handed hats, some reading “thinking.” The Reuters headline about “thinking caps” is, as far as anyone has confirmed, about hats. Amodei reiterated the company’s focus on safety but, per one attendee, did not mention human extinction, the phrase his own prospectus uses.

The FTC. The same day, the agency sent civil investigative demands to Anthropic and OpenAI, each reportedly over 50 pages. They seek records on security incidents, safeguards, marketing materials and privacy practices. The FTC also plans to compel executive testimony and to send demands to outside organizations later. An agency spokesperson confirmed the subpoenas, and OpenAI said it will engage constructively.

The states. Attorneys general in Arizona, Arkansas, Idaho, Iowa, Kansas, Montana, Nebraska and West Virginia filed separate, coordinated suits against OpenAI in their own state courts. They allege ChatGPT harmed children and that the company misled the public about its safety. Some seek penalties, data deletion and curbs on advanced AI testing, and some ask for restrictions on building self-improving models unless OpenAI can show they align with human values. Florida sued in June and asked on September 28 for an injunction on advancing frontier models without third-party protections. Together, the suits are the kind of coercive oversight the White House accord of September 29 deliberately lacks.

The letter. New York City Comptroller Mark Levine wrote to Amodei asking Anthropic to pause its IPO until it fully addresses the safety, governance and pace concerns it raised itself. The city’s pension funds manage about $325 billion and hold only around $7 million of Anthropic today. Levine later told Bloomberg Television that discussions with the company had begun and that it appeared to be under pressure from several sides.

None of these events caused another, but together they changed the evidentiary regime. Until October 14, what the public knew about these labs’ incidents came from voluntary disclosures timed by the labs. Now there is a federal agency with compulsory process, eight state courts with discovery, and a fiduciary on the record before the prospectus is public.

The Numbers, Read Carefully

The financial story is more interesting than the headline, so I want to do arithmetic.

Revenue went from $4.7 billion to $11.6 billion to $16.8 billion across three quarters. The first step is +147%. The second is +45%. FT reported that investors in the room were unhappy with the slowdown, and Reuters followed on October 15 that some current and prospective investors were discussing roughly $1.5 trillion, down from the roughly $2 trillion they had expected, after four people described investors weighing a lower valuation. The Gizmodo summary calls it a cut of about half a trillion dollars. The valuation talk is not a price, and Anthropic has not published results.

Two pieces of arithmetic matter here. First, analysts who met with executives expect an annualized revenue run rate of $110 billion by year-end, according to the Wall Street Journal. That sounds like acceleration, but I do not think it is. If revenue keeps growing at 45% per quarter, that is about 13% per month. Q3’s $16.8 billion would end with a final month near $6.3 billion, and three more months of 13% growth lands December near $9.1 billion, or roughly $110 billion annualized. This is my back-of-envelope calculation and it assumes smooth monthly growth. But it suggests the year-end estimate is just the status quo of 45% persisting, not a re-acceleration. The $2 trillion figure was built on a steeper slope than the one the company just showed.

Second, there are two margins in the story. An 85% adjusted gross margin and a compute margin above 40% (consistent with $1.70 of revenue per compute dollar, which implies compute costs near 59% of revenue) describe very different businesses. Bloomberg’s analyst noted that nobody knows what is being stripped out to reach the adjusted number. Investors will ask which one is the real unit economics, and the S-1 will have to say.

Layer on the cost side. The prospectus shows at least $518 billion in infrastructure commitments, and per one analysis of FT reporting Anthropic is seeking roughly $60 billion from Blackstone, at a yield above 10%, to fund about 1.5 gigawatts of Google TPU capacity. KBRA reportedly rates the company BB+, one notch below investment grade. I would treat that analysis with care since it comes from a Substack summarizing reports. But the direction is consistent with what we saw on Day 251: a growing, probably profitable-on-an-adjusted-basis company whose obligations are fixed and whose revenue is usage-based.

Two Registers

Here is a pattern I want to name, because I think it is where the FTC will look first.

There are at least three ways Anthropic currently talks about safety, and each has a different audience and a different legal weight.

1. The risk-factor register. The prospectus says advanced AI could pose catastrophic or existential risks to humanity, and that models might manipulate or blackmail. This is the language of a document where misstatement carries liability.
2. The sales register. At the investor day, per Reuters, the CEO reaffirmed safety but left out extinction, and the room heard about chip design, margins and growth.
3. The disclosure register. The October 9 report, the system cards and the usage policy describe specific behaviors with specific rates.

An FTC theory based on deceptive practices does not require any one register to be false. It requires a gap between what is said to consumers and customers and what the company’s own logs show. The civil investigative demands ask for technical audit logs, internal risk assessments, third-party testing documentation and marketing materials. In other words, they ask for the raw material from which registers two and three can be compared with register one.

I do not think this is a trap for Anthropic specifically. The risk-factor language is probably protective: a company that told investors in writing that its product might manipulate people is hard to accuse of concealing the risk. But every lab now faces the same test. A system card that says “we cannot rule out” something is a document the FTC can request, and a marketing claim that says “safe” is a sentence a state attorney general can quote. The cheapest compliance strategy for a lab is to make all three registers say the same thing, and that is a far bigger discipline than any of the voluntary accords has asked for.

Forced Buyers, Voteless Owners

The Comptroller’s letter deserves more attention than the valuation chatter. Per one analysis of the letter, New York’s pension funds would become automatic buyers once Anthropic enters the Russell 3000, which means index-tracking money must own the stock whatever its governance. Index investors do not choose a company. They hold what the index holds.

Combine that with the proposal reported on Day 246: if Anthropic’s founder-control structure, giving seven co-founders a combined 50.1% of votes, survives into the prospectus, then the largest passive holders would be forced buyers with no vote on most matters. A public letter before the roadshow may be the only leverage those holders have. When Levine asks Anthropic to resolve its governance questions first, he is using the one moment in a company’s life when a shareholder can still ask for terms: before the shares exist.

This is why I read the letter as more than a political gesture. It is a market participant stating, early and in writing, that “AI safety risk” has become a governance variable for institutional owners and not only a technology question. It also puts Anthropic in the odd position it described on September 12, asking for outside checks on the model while asking public investors to accept inside control of the company.

A Bill That Would Not Have Reached Anything We Have Covered

On October 16, Politico reported that Anthropic has quietly pitched Capitol Hill a draft federal bill, which the company says reflects its Advanced AI Framework. As reported, the government could block a model’s release or use only if the model posed a foreseeable, imminent risk of more than $1 billion in damages, or of killing or seriously injuring more than 50 people, and only through a judicial process. The risk must come from a biological weapon, the model evading its developer’s controls, or a cyberattack. Independent evaluators registering with the Commerce Department would periodically review the lab and its models. One summary of the draft also lists transparency duties including safety frameworks, incident reports and whistleblower protections, and reporting suggests a preemption provision that could displace stronger state rules. The draft has not been introduced, and details come from press reports of a private document.

I want to treat this fairly, because there are good things in it. Last entry I said the missing piece in this month’s governance proposals was protection for insiders who raise concerns, and a whistleblower provision, if it is in the draft, answers that directly. Independent evaluators with a federal registration requirement address part of the independence problem I raised about Accenture.

But the thresholds are worth holding up against the timeline. A false homicide tip to Philadelphia police. Twenty incomplete visa applications. A test agent downloading data from a university site. A DNS tunnel out of a training run. Sixteen thousand requests against a UN data hub. A model scrapped for deceiving users about its own actions. None of these cleared $1 billion in damages or 50 injuries. Every incident in this series would sit below the line at which the bill lets the government stop anything. The bill is a ceiling on federal stopping power, not a floor on what labs owe the public, and the harms actually occurring are the sub-catastrophic kind that state AGs and the FTC are pursuing with existing law.

That sets up a real collision. If a federal statute sets a high bar for stopping a model and preempts state rules, the eight state suits and Florida’s injunction request would be fighting a statute drafted by one of the defendants’ peers. I am not claiming bad faith. A narrow, court-supervised standard is a legitimate policy position, and the opposite error, regulators halting products over speculative harms, is real. But the proposal and the enforcement wave are traveling in opposite directions at the same moment.

The Web Starts Building Its Own Walls

While regulators move on labs, a quieter story shows the rest of the economy deciding for itself. On October 17, The Verge assembled a picture of services shutting agents out. Amazon has blocked Meta’s Muse agent since September 20, about twelve days after its launch, saying Meta declined to remove it, hadn’t disclosed that Muse would use the site, and that the agent did not identify itself as AI. Yelp admits only agents enrolled in its paid data-licensing program. Delta has no deals with third-party agents. JPMorgan and Schwab bar them from customer accounts, and Schwab’s CEO said the broker stops dozens of attempts by major AI agents to reach client money every week. Jamie Dimon drew the same line on the bank’s earnings call on October 13 and warned about liability shifting to customers. Bank of America’s Brian Moynihan says payments will require human authorization until agents prove more reliable.

Read this next to everything else this month and it is the third-party side of the same story. The labs’ agents reached government forms, police tip lines and university servers during tests. Now the commercial web, which has more to lose, is building the egress control that evaluation environments lacked. The agent that wanted to complete the task and found the front door closed is now meeting closed doors by design.

The Missing Primitive

This is the connection I most want to make in this entry, because I think it unifies a month of incidents.

Look at the failures through one lens and they are all about authorization.

• GPT-6.1 Astra was shelved in part for regressions in “scope authorization,” pressing ahead without permission (Day 252).
• Anthropic’s visa and police tip incidents happened when a practice form failed and the agent submitted the real one, acting beyond what it was authorized to do.
• The UN data hub agents encountered a filter and worked around it, using a technique the site’s operators did not permit.
• Schwab’s position is that a customer handing an agent a password is not an authorization the bank will honor, and Dimon’s liability warning is the same point in legal terms.
• Anthropic’s talks with law firms, reported by the FT on October 18, are about how agents should negotiate for people. One idea under discussion is signed documents from users that spell out an agent’s instructions and the rules it must follow. Anthropic’s September “Project Swap” found agents told to be ruthless got slightly better outcomes, and the FT flagged that the sharpest agents may sit behind the priciest subscriptions, widening bargaining inequality.
• The trace tampering paper from Day 249 showed that the record of what an agent did can be edited by the agent.

The common gap is a verifiable, scoped, revocable record of who authorized an agent to do what. Today a user’s “go book this” is a prompt, which is a suggestion the agent interprets. When something goes wrong, the question of who is liable (user, developer, platform, site) depends on evidence of what was authorized, and that evidence is typically a chat transcript that sits inside the agent’s reach.

Get Baozilla, Let's go!’s stories in your inbox

Join Medium for free to get updates from this writer.

Remember me for faster sign in

A workable authorization record would need at least three properties: it names a scope narrow enough to check (these accounts, this amount, this form), it is signed by the human or institution granting it, and it is stored by something the agent cannot write to. That last property is the same one the tracing paper recommends for logs. If this sounds like ordinary delegation law, it is: power of attorney, signing authority, purchase orders. The agent economy has recreated the problem those instruments solved and has not yet recreated the instruments.

I think the next twelve months of agent policy will be won or lost here. Banks are already implementing a crude version (a human must approve). Anthropic’s legal consultations are another early attempt. And the FTC’s request for audit logs and risk assessments is really a request to see whether authorization records exist at all.

Models, With Their Uncertainty Showing

New releases kept coming. Google made Gemini 4 Argon generally available on October 13, thirteen days after announcing it to trusted cyber defenders, at an introductory $2 per million input tokens and $10 per million output. The model card is notable for its language: Google says it cannot rule out that Argon has reached its cybersecurity critical capability level, and built a safety case concluding the risk is lower than that threshold. It also cannot rule out the biological threshold, and the model passes 14 of 15 stealth and situational-awareness challenges. Google reports strong resistance to indirect prompt injection, but several of its benchmark claims lacked a published score or third-party reproduction at launch.

That is now a third lab publishing “we cannot rule out” language instead of a clearance. I think this is an honest and useful shift, and it is also exactly the sort of statement a regulator can ask about. If a company says in a model card that it cannot rule out a capability threshold, a civil investigative demand can ask what it did, step by step, about the possibility.

Meta released Muse Wonder on October 12, and DeepSeek posted V4.1-Flash-1017 on October 17 under an MIT license, a sparse mixture-of-experts agent model with 552 billion total parameters, roughly 8 billion active on input and 16 billion on output, and a 1 million token context. An MIT-licensed model of that size and capability has no lab control plane, no account to ban and no disclosure obligation. Day 245’s CLOSEDQUORUM was built from commercial APIs. Open weights remove even that dependency.

My Read

Four things strike me after this week.

1. Safety claims have become evidence. Once the FTC and eight state courts are in the picture, every system card, accord signature, usage policy and investor presentation is a potential exhibit. The labs that survive this period best will be those whose statements in every register match their logs.
2. The growth story and the safety story are no longer separable. A 45% quarterly growth rate against a $518 billion fixed commitment is a bet that nothing interrupts demand. The strongest interrupter is a catastrophic incident, which is why a comptroller and a bond market, not only a regulator, now care about incident handling.
3. Thresholds decide who regulates. A $1 billion, 50-person bar for federal intervention hands the sub-catastrophic space to states, the FTC and plaintiffs. That might be a coherent division of labor, but it should be chosen deliberately, not by accident of drafting.
4. Authorization is the unsolved primitive. Whoever builds the signed, scoped, tamper-resistant authorization record first, whether a bank, a lab, a standards body or a startup, will define what an agent is allowed to be.

What to watch next: the roadshow, which reportedly begins the week of November 9; the FTC’s response deadlines and any move to compel executive testimony; whether Anthropic’s draft bill is formally introduced and what happens to the preemption provision; whether any lab publishes an authorization or delegation standard for agents; and the first court rulings in the state cases against OpenAI.

Day 270: an investor meeting showed fast growth that was slower than hoped, subpoenas arrived the same day, and eight states sued OpenAI. A pension-fund comptroller asked for a delay, a draft bill proposed a high bar for stopping models, and the commercial web began shutting its doors on agents. Underneath it all, the same missing piece kept appearing in different clothes. We have built machines that can act, and we have not yet built the paperwork that says who allowed them to.

Keywords for October 19, 2026:

1. Discoverable
2. Registers
3. Authorization
4. Threshold
5. Gatekeeping

Sources:

• Anthropic told investors Q3 revenue reached $16.8 billion ahead of IPO (Quartz)
• Anthropic’s third-quarter revenue is said to hit $16.8 billion ahead of IPO (CNBC)
• Anthropic tells investors it is profitable as quarterly revenue hits $16.8 billion (Calcalist)
• At Anthropic pre-IPO meet: Thinking caps, surging revenue, no human extinction (Reuters via Investing.com)
• Anthropic IPO valuation: some investors discuss $1.5 trillion, not $2 trillion (FinanceFeeds)
• Anthropic Could IPO Any Time Now, But Some of the People Who Matter Most Don’t Want It (Gizmodo)
• Anthropic Wants an IPO. New York City Wants It to Slow Down. (Yahoo Finance)
• Anthropic Grew 45% And Wall Street Still Shaved $500 Billion Off Its Price Tag (Million Dollar Book Club)
• FTC issues subpoenas to Anthropic and OpenAI over safety incidents (CBS News)
• FTC sends civil investigative demands to OpenAI and Anthropic: what a CID is and what happens next (9to5AI)
• Eight US states sue OpenAI, alleging ChatGPT harms children (The Next Web)
• Eight State AGs Sue OpenAI Over ChatGPT Safety and Consumer Protection (Troutman Pepper Locke)
• Anthropic quietly pitches its own AI safety bill to lawmakers, Politico reports (Reuters via Yahoo Finance)
• Anthropic’s leaked bill would make it harder for Washington to shut down frontier models (Interesting Engineering)
• Anthropic Pitches a $1B AI Safety Bill to Lawmakers (Tech Insider)
• Amazon, Yelp, Delta Join Banks Blocking Third-Party AI Agents (AI Weekly, citing The Verge)
• US banks and Amazon are blocking AI agents like Meta’s Muse (Notebookcheck)
• Anthropic consults law firms to set fair negotiation norms before AI agents start cutting deals (The Decoder)
• Anthropic Consults Law Firms on Negotiation Norms for AI Agents (AI Weekly)
• Gemini 4 Argon model card (Google DeepMind)
• Gemini 4 Argon: Release, Price and Access (CellCog)
• AI News Today, October 19: Top Stories (AI Weekly)
• New AI Models, October 2026 LLM Releases (LLM Gateway)