Happy Thursday. Anthropic disclosed $16.8 billion in Q3 revenue and its first adjusted profit at a closed-door investor meeting Tuesday, setting the stage for a $2 trillion IPO before Thanksgiving. The numbers are striking, but so is what sits beneath them: $518 billion in infrastructure commitments, 80% of it non-cancelable, spread across partners who are also investors, customers, and competitors.
The rest of today's issue covers the legal pressure building on AI companies over child safety, where enterprises are actually building their agent infrastructure, and a structural risk inside the billion-dollar browser security market that the acquisitions have not solved.
FUNDING & M&A
Anthropic's $16.8B Quarter Sets Up a $2T IPO Test
Anthropic reported $16.8 billion in Q3 2026 revenue, up 45% from Q2, with an 85% adjusted gross margin and an adjusted operating margin above 11%. About 80% of that revenue comes from API and enterprise usage, making the company a B2B infrastructure business far more than a consumer product.
The IPO math is where things get complicated for enterprise buyers and competitors alike. Anthropic is chasing a $2 trillion public valuation despite $518 billion in infrastructure obligations, 80% of which are non-cancelable, owed to partners that also compete with it. Its own SEC filing flags that Google, Amazon, and Microsoft may not have fully aligned incentives. If Anthropic goes public at anything near its target, the capital it raises will accelerate product development and put pressure on every AI platform vendor selling to enterprises.
SECURITY & PRIVACY
Eight States Sue OpenAI Over Child Safety; Federal Class Action Filed Separately
Eight state attorneys general filed separate lawsuits against OpenAI on Oct. 14, each under state consumer protection law, alleging the company marketed ChatGPT as safe while knowing it posed risks to children. Arizona's 87-page complaint seeks a $10,000 fine per instance of deceptive advertising. A federal class action filed the day before accuses OpenAI of training its models on data collected from minors without valid consent.
The state-by-state strategy is deliberate. Kansas AG Kris Kobach said the states are not waiting for federal AI legislation. That means OpenAI faces at least nine separate legal fronts with different procedural timelines, discovery scopes, and potential remedies. For any software company that has children or teenagers among its users, this is the clearest signal yet that state AGs will move on AI child safety without waiting for Congress, and that product-level age verification and guardrails will face legal scrutiny, not just public pressure.
SECURITY & PRIVACY
Browser Security Crossed $1B in Deals. Every Product Runs the Same Code.
CrowdStrike, Zscaler, and Akamai each acquired a browser security company in the first half of 2026, spending a combined total exceeding $700 million. Added to Palo Alto Networks' $625 million Talon purchase in 2023, the market has absorbed more than a billion dollars in deals. Every product that resulted, including Island's independent offering valued at $4.85 billion, runs on Google's Chromium engine.
The concentration risk is the story the deal announcements did not tell. A critical Chromium vulnerability would hit every enterprise browser security product at once, regardless of which vendor sold it. CrowdStrike Chief Business Officer Daniel Bernard noted employees spend 85% of their workday in browsers, and AI agents are accelerating that share. That makes the single-engine dependency a larger problem each quarter, not a smaller one. Security buyers evaluating this market should ask vendors directly what their plan is if Chromium becomes the source of a major breach, because right now no funded alternative exists.
Created by the robots at The SaaS Sentinel