Mara ReyesA company subsidizes a product so heavily that its largest customers admit it loses money on every run. On the same day, that company files to go public — and the loss-making product is the reason the offering is worth a trillion dollars.
On June 2, Anthropic confidentially filed for an IPO that could happen as soon as this fall, joining OpenAI and SpaceX in a queue that could add $4 trillion to U.S. stock-market value within months. The headline is the race to the public markets. The structure underneath it is quieter and stranger, and it surfaced the same afternoon in a different story.
Anthropic also said it would extend Project Glasswing — its cybersecurity program built on the Claude Mythos model — to organizations in fifteen-plus countries, roughly quadrupling its reach to about 200 partners across Five Eyes, NATO, Samsung, and SK. And in a third report, Palo Alto Networks disclosed what running Mythos actually costs: the model found 24-plus critical bugs using more than $1 million in tokens, and Anthropic subsidizes that spend to offset the cost.
Read those three filings together and the IPO stops looking like a victory lap. It looks like the monetization event for a dependency Anthropic has been paying, out of pocket, to manufacture.
What the product was designed for
Project Glasswing was built to do something narrow and defensible. When Anthropic announced it in April, the framing was safety-first: its most powerful model could find software vulnerabilities faster than any human team, which made it both an extraordinary defensive tool and a weapon too dangerous to release publicly. So it wasn't released publicly. It went out by invitation — 40-plus critical-infrastructure partners, governed by a framework, gated behind trust.
That was the original equilibrium. A scarce, dangerous capability, rationed to the institutions most equipped to handle it. Mythos was positioned not as a business line but as a public good Anthropic happened to control — the security model you let into the room because the alternative was letting an adversary find the bugs first.
The economics of that design were never examined out loud, because they didn't need to be. A safety program doesn't have to clear a margin. It exists to demonstrate that the lab can be trusted with the model. The cost was the point.
The shift the government couldn't refuse
Then the tool turned out to be too useful to keep scarce, and the institution that pushed hardest against it became its largest dependent.
In February, the Pentagon moved to designate Anthropic a supply chain risk, a label that would force every U.S. military contractor to sever ties. In March, it made the designation official, effective immediately. The system the government built that spring had one purpose: to keep Anthropic out.
It built the opposite. By April, the NSA was using Mythos and one source said it was already in wide use across the DoD — "despite Anthropic's supply chain risk designation." By May, the Pentagon was openly deploying Mythos to patch vulnerabilities across the entire federal government even as it worked on a plan to transition away from the company. The exclusion order and the dependency ran in parallel, neither one canceling the other. The tool was too good to refuse and the vendor was too risky to keep, and so the government did both at once.
You don't bother banning what you can route around. The ban was the confession that the vendor was already irreplaceable.
That reversal — the system designed to exclude Anthropic producing total dependence on it — is the story already visible by May. June added the part that explains why none of it was an accident.
The subsidy is the strategy
Here is the number that reframes everything. Palo Alto Networks, one of the most sophisticated security companies in the world, ran Mythos against its own source code and burned through more than $1 million in tokens to surface two dozen critical bugs. That is not a rounding error. That is a price that would stop most enterprises cold — and Anthropic subsidizes it so they don't stop.
Look at what the subsidy buys. The companies running Mythos aren't churning out at the price — they're planning to raise their budgets. Once a security team has watched the model chain five bugs into a single exploit no human caught, the $1 million stops being a cost and becomes insurance. The subsidy lowers the barrier just enough to get the institution hooked; the institution's own risk tolerance does the rest. Anthropic loses money on the run and gains a customer that can no longer responsibly turn the model off.
Now scale that to 200 of the most important organizations on earth — central banks, defense ministries, the operators of the grid and the chip supply chain — and subsidize all of it. You are not running a product at a loss. You are buying, one loss-making engagement at a time, the one asset that doesn't show up cleanly on a balance sheet: indispensability. The thing that looks like Anthropic's worst-margin business is the thing that makes the company impossible to replace.
What the IPO is actually selling
A private company can subsidize a product below cost indefinitely, the way Anthropic just raised $65 billion at a $965 billion valuation to keep doing. The market tolerates the loss because it is buying a story about the future. But the moment the company files to go public, the subsidy has to be explained to a different audience — one that prices cash flows, not narratives.
And here the structure clicks into place. Anthropic isn't asking the public market to value Mythos as a product, because as a product it loses money on every serious run. It is asking the market to value the dependency the subsidy created. The S-1 won't show a profitable security line. It will show that the U.S. government, NATO, Five Eyes, JPMorgan, and roughly 200 of the institutions that hold up the modern world have, in the space of ninety days, organized their security posture around a model only Anthropic can supply — and that two of those institutions tried to ban the company first.
That is the asset. Not the margin, the lock-in. The ban was the confession; the IPO is the invoice — Anthropic charging the public market for an indispensability that the U.S. government documented, in writing, when it tried and failed to escape it.
The regulation arriving alongside it doesn't unwind the dependency — it ratifies it. The scaled-back executive order Trump signed the same week drops the scrutiny the scrapped version carried and instead asks AI companies for early access to their most powerful models, framed around cybersecurity. After weeks of internal strife over exactly that question, the government settled on the posture of a customer, not a regulator. The order that was supposed to govern the models became an order to be let in early. The exclusion order and the access order, signed by the same administration, ninety days apart.
The same move, one layer down
This is not new economics. It is the oldest play in infrastructure, run at the speed of a token meter. Cloud providers gave away credits until the cost of migrating off exceeded the cost of staying — the credit was a loss, the switching cost was the business. Razor and blade, handset and contract, free tier and lock-in: every version subsidizes the thing you adopt to monetize the thing you can't escape. The product is the bait. The dependency is the business.
What Anthropic has done is run that play on the security layer of the state itself, and compress it into a single quarter. The difference is what's being made dependent. A subscriber locked into a carrier can switch and lose a phone number. A defense ministry that has reorganized its vulnerability management around a model it cannot reproduce is locked in at the level where switching means going temporarily blind to the next exploit. That is a harder thing to walk away from, and a more valuable thing to own — which is precisely why it is worth selling shares in.
Below cost
The Pentagon spent the spring building a system to keep Anthropic out. By June it had built the opposite — a security posture that could not function without the model it tried to ban — and Anthropic, having paid below cost to make that true for 200 institutions at once, filed to sell shares in exactly that. The subsidy was never the weakness in the business. It was the business. The loss was the moat, and the IPO is where you charge for it.