Anthropic Rented 220,000 GPUs From Its Enemy. Here's What That Buys You.

Anthropic leased xAI's entire Colossus 1 cluster this week — 220,000+ GPUs, GB200s included — from a CEO who has on the record called them "misanthropic and evil." That transaction only happens when compute scarcity is bending strategy harder than rivalry. Dario conceded the number: they planned for 10x growth and got 80x. ServiceNow, one of the most sophisticated enterprise buyers alive, burned its full-year Claude budget by May and cannot say which users drove it, because Anthropic ships no per-user telemetry.

In the same week, Ramp's April data put Anthropic at 34.4% of paid business share against OpenAI's 32.3% — the first documented lead change on this beat. OpenAI countered within hours with two months of free Codex for any enterprise that switches in 30 days. And on June 15, Anthropic converts every Claude subscription into a dollar-matched API credit pool, killing the 70–90% arbitrage that developers using Cursor, Cline, and Zed have been living inside for a year.

One lab is capacity-constrained and winning. One is defending, not expanding. The vendor most of your shadow-AI policies do not name is now the majority vendor.

The pricing cliff is 29 days out

The $200/month plan now buys exactly $200 of API credit for programmatic work. Heavy harness users face a 3–10x effective cost increase overnight. Opus 4.7 separately tripled image pipeline costs. There was no announcement — it shows up on the invoice.

The capacity context matters here, because it explains the behavior. Anthropic has been silently revoking Claude Code from paying customers, banning corporate accounts mid-trial, and running A/B experiments on access revocation itself. That is supply rationing, not strategy. The margin move is timed to a likely October IPO: they hired a CFO, and public markets do not reward the metric where power users capture large implicit subsidies.

Yes, but — the Ramp data skews toward SMB and mid-market through credit-card billing, and almost certainly understates OpenAI's eight- and nine-figure invoice contracts. The magnitude of the flip is probably overstated at the largest accounts. The direction is not.

The teams that wrote a one-page memo defining "what price change would make us reverse course" will move in 72 hours. Everyone else spends Q3 in a Slack thread while the free-Codex window closes on July 13.

The eval harness is measuring the wrong distribution

Vercel's AI Gateway telemetry, across 200,000+ teams over seven months, puts agentic workloads at 59% of all token volume. Anthropic captures 61% of dollar spend through Opus. Google captures 38% of volume through Flash. That spend-versus-volume split is the architectural tell: expensive models handle planning and reasoning, cheap models do throughput.

Most eval harnesses still score single-turn responses against reference answers. When 59% of production tokens are multi-turn tool-calling traces, that harness is measuring the minority. The metrics that actually predict production behavior on agentic workloads are tool-call precision, steps-to-completion, cost-per-successful-task, and recovery-from-error rate. Not perplexity. Not chat-bench.

Microsoft's MDASH — a 100+ agent ensemble running scan → adversarial debate → PoC construction — beat Anthropic's Mythos on CyberGym. The paper does not tell you which stage produced the lift, or what the ensemble cost against a single-agent baseline, and without an ablation the result is suggestive rather than decisive. But the pattern is reusable and it is showing up everywhere.

The perimeter is on fire while you decide about vendors

Two pre-auth ingress bugs landed the same cycle. NGINX shipped an 18-year-old unauthenticated RCE in the rewrite module — the module that runs in roughly 90% of production deployments, before any app-level auth ever sees the request. Traefik shipped a CVSS 10.0 authentication bypass, which makes every ForwardAuth and BasicAuth middleware in front of internal services decorative. Argo CD 3.2/3.3 leaks plaintext Kubernetes Secrets to read-only users. Apache Iceberg (CVSS 9.9) lets an attacker with table-write permission redirect metadata to a poisoned S3 prefix, so subsequent queries read corrupted Parquet and training runs ingest silently poisoned features.

PraisonAI went from CVE disclosure to active exploitation in four hours. LiteLLM is on CISA KEV. If you are running versions 1.81.16–1.83.7, assume the stored provider API keys are compromised and rotate.

Separately, UK AISI confirmed Anthropic's Mythos cleared both of its hardest simulated attack ranges — full autonomous network takeover, not persistence. GPT-5.5-cyber cleared one. Congress is routing Mythos access through NSA, not CISA. The signal is offensive-first, defensive-second, which means civilian critical infrastructure is on its own for several years.

Mozilla surfaced 271 real Firefox bugs using a custom Claude harness. The same model against curl produced one low-severity CVE. The variable is the harness, not the model.

What to do this week

One action, three parts, all due before June 15. Stand up an LLM gateway in front of every Claude call, with per-user and per-feature token tagging and a daily budget alert wired to Slack or PagerDuty. This is the meter Anthropic will not build for you, and it is what turns "we blew the budget in May" into "we caught the drift in week two." While the gateway is up, run OpenAI's free-Codex trial against your top three Claude workloads as a controlled A/B — the data is useful regardless of which vendor wins. And patch NGINX and Traefik tonight, not this weekend. A public PoC for the rewrite RCE lands within days, and the compound chain from Traefik bypass to Argo CD to full cluster is one weekend project for someone motivated.

The cheap version of this week is a Slack thread and a spreadsheet. The expensive version is finding out on the July invoice.