The AI Brief

In a Fortune interview published Saturday, September 12, Altman said: "I actually think that, given everything happening with safety, right now would be an ill-advised moment to go public, and we don't feel pressure on that." When Fortune pressed him on whether 2026 was off the table in favor of 2027, Altman replied, "I would say not 2026." The statement is the first unambiguous on-record CEO closure of the year, following OpenAI CFO Sarah Friar's August all-hands comment that the company would go public "in 2027 or sooner."

Altman went further, telling Fortune that OpenAI and other leading AI companies "may be close" to announcing a joint agreement to slow AI development and work together on safety. He said OpenAI has discussed pausing development when its models cross new capability thresholds, describing the approach as sequencing: "society needs to contend with these models at each level of capability." He cited OpenAI's nonprofit-for-profit structure as the mechanism allowing decisions "not obviously in the interest of our business." On X, Altman also endorsed Dario Amodei's September 12 essay calling for AI pacing, writing that OpenAI would match Anthropic's commitment to independent embedded evaluators with employee-level access.

OpenAI had confidentially filed IPO paperwork with the SEC earlier in 2026. Its Q2 revenue of $6.7 billion grew 18% sequentially, but operating losses widened to $12.3 billion that quarter alone. Anthropic, in the same period, posted its first-ever operating profit of $559 million on $10.9 billion of revenue. Anthropic is expected to begin marketing its own IPO in mid-October, targeting a listing days before the November midterm elections.

OpenAI reported Q2 2026 revenue of $6.7 billion, up 18% from $5.7 billion in Q1, per investor communications reported by the Wall Street Journal. Operating losses widened to $12.3 billion in Q2, putting H1 operating losses above $21 billion. Audited 2025 results showed a $38.5 billion net loss on $13.1 billion of revenue, with a $41.6 billion fair-value charge on compensation structures dominating. OpenAI's annualized revenue run rate crossed $40 billion in July per Bloomberg, against an internal 2027 target of $62 billion.

Anthropic posted $10.9 billion of revenue and $559 million of operating profit in Q2 2026, its first-ever positive operating quarter, driven primarily by Claude Code enterprise adoption. The contrast is sharpest at the operating leverage line: Anthropic's coding-agent enterprise push produced margin in the same quarter OpenAI's Codex-anchored growth did not bend the cost curve. Anthropic's annualized revenue run rate reached $65 billion at end of July. The Q2 figures are expected to anchor Anthropic's IPO prospectus disclosure package when it publishes in late September.

Disclosure: Claude, which generates this brief, is built by Anthropic.

Israeli security startup Accomplish, founded by Or Hiltch, Amit Avner, and Guy Zipori, disclosed leaky sandbox vulnerabilities across Claude Code, OpenAI Codex, and Cursor this week after notifying vendors over the summer. Accomplish says one fix took 50 days after responsible disclosure. CEO Amit Avner framed the pattern structurally: "If these frontier models are so good, how come they're not finding these critical vulnerabilities in their own products?" Anthropic, Cursor, and OpenAI did not comment on the record at publication time, per Upstarts Media, which first reported the disclosures.

Independent research confirms the breadth. Cymulate Research Labs documented configuration-based sandbox escapes across Claude Code, Gemini CLI, Codex CLI, Cursor, and GitHub Copilot, with two vulnerability families letting sandboxed code execute on the host and a third enabling theft of Google OAuth tokens. Pillar found four flaws in Cursor alone, including CVE-2026-48124, fixed in version 3.0.0, in which a Claude hook configuration file became a command-execution path outside the sandbox. A shared vulnerability affected Cursor, Codex, and Gemini CLI simultaneously, allowing agents to launch privileged containers that escaped isolation.

The common thread: coding agents inherit broad permissions to operate usefully across a codebase, their sandboxes are enforced at the behavioral permission layer rather than at the OS level in many default configurations, and the agent's execution context can be hijacked by malicious content in repository files the agent reads during a session. Anthropic's OS-level Bash sandbox, available from Claude Code v2.1.x, provides kernel-enforced filesystem and network isolation, but it wraps the Bash layer only; the Read, Edit, MCP, and hook layers remain on the host until operators explicitly configure the full isolation stack.

First covered in Vol. I, No. 110: Dario Amodei published "We Must Pace the Frontier" on September 12, proposing a three-step framework for slowing AI capability development and committing Anthropic unilaterally to permanent embedded third-party evaluators with employee-level access. Altman responded the same day on X: "I agree with Dario that we need to pace the frontier. This has been a primary topic of discussions we've had at OpenAI in recent weeks. Committing to having independent evaluators with employee-like access is a great idea, and we will do the same. We'll have more to share soon."

In his Fortune interview published Saturday, Altman expanded the framing, saying OpenAI and other major AI companies could be "nearing an agreement" to jointly slow development and work together on safety. He said OpenAI has discussed pausing development when its models cross new capability thresholds, to let safety and alignment work catch up, describing the approach as sequencing rather than retreat. He invoked the Hugging Face agent breach and the chain-of-thought monitoring failures disclosed by OpenAI chief scientist Jakub Pachocki as the immediate backdrop. Altman also cited OpenAI's nonprofit-for-profit structure as the mechanism that allows safety-first decisions that are "not obviously in the interest of our business."

Bloomberg reported Sunday that chipmaker and AI supply-chain stocks may face near-term pressure as markets price decelerationist rhetoric from the two largest AI compute buyers. Analysts cited by Bloomberg see limited long-term impact on infrastructure spending, because safety evaluations and alignment work themselves require substantial compute. The divergence between near-term stock pressure and long-term infrastructure demand is the practical tension the market opens Monday facing.

First covered in Vol. I, No. 107 (September 7): Anthropic's public S-1 was expected on SEC EDGAR shortly after Labor Day. Reuters reported September 4 that the prospectus, previously expected the week of September 7, is now not expected until late September. The roadshow would begin in mid-October at the earliest, with a listing targeting completion days before the November 3 US midterm elections. Anthropic is finalizing a $15 billion revolving credit facility with Morgan Stanley, Goldman Sachs, JPMorgan, and Citi before analyst meetings and the roadshow begin.

The timing is sensitive on multiple dimensions. Amodei's pacing essay, published September 12, is already generating bearish noise around AI sector stocks ahead of a Monday open. Separately, Anthropic is named defendant in Sony Music Publishing and Warner Chappell's copyright suit alleging approximately 20,000 songs were scraped to train Claude, adding litigation risk to the prospectus's risk-factor section. The company's last private valuation was $965 billion post-money from its May Series H; a $2 trillion IPO target implies more than a doubling at listing. Anthropic's annualized revenue run rate reached $65 billion at end of July 2026, up from $47 billion in May and $9 billion at year-end 2025.

Disclosure: Claude, which generates this brief, is built by Anthropic.