June 15 is the day your AI cost model breaks

On May 12, Anthropic converted Claude subscriptions to dollar-matched API credits. Full effect lands June 15. The implicit 70–90% discount that anyone running Claude through Cursor, Cline, Aider, Zed, or a custom Agent SDK harness had been quietly enjoying is gone. A $200 plan now buys $200 of programmatic tokens and not a token more. OpenAI answered inside the hour with two months of free Codex for enterprise switchers, window closing July 13.

ServiceNow is the tell for what happens without cost controls. Their CDIO confirmed the team burned its full-year Anthropic budget by May, and cannot say which users or workloads drove it — because Anthropic ships no per-user, per-feature telemetry and no SLAs worth the name. National Life Group's CIO said the quiet part out loud: Claude is "great for consumer usage but not great for companies." This is the vendor the market wants to price at $900B+ on enterprise revenue quality.

The capacity story behind the pricing is the same story. Anthropic planned for 10x growth and got 80x. ARR moved from $9B to $30B+ in four months. The patch is a lease of xAI's entire Colossus 1 cluster — 220,000+ GPUs, from a CEO who called Anthropic "evil" three months ago. Grok lost. Lease revenue won. Your prompts and source code now transit a direct competitor's infrastructure, and the sub-processor paperwork you signed last quarter does not cover that.

Yes, but — the counter-reading is that Ramp's 34.4% vs 32.3% enterprise share number measures credit-card billing, not $1M+ ACH-invoiced accounts, and Anthropic still leads on capability where it counts. Fair. It also does not change the fact that the vendor with the lead is the one repricing its book and running on borrowed silicon 30 days before an October IPO window. Margin recovery in a developer-benefit costume is still margin recovery.

The workload underneath just flipped

Vercel's AI Gateway data — 200,000+ teams, seven months, the only multi-tenant production dataset with real numbers — puts agentic workloads at 59% of token volume. Six months ago it was under 20%. Anthropic captures 61% of spend on Opus for reasoning. Google captures 38% of volume on Flash for throughput. Spend and volume are separate budgets on the same invoice. Conflate them and you optimize the wrong one.

Two things break at 59%. Cost models built on 3:1 input-output ratios are off by roughly 5x against 15:1 agentic traces. Eval harnesses scoring single-turn accuracy at 90%+ are measuring the minority workload and hiding the planner that burns 40K tokens arguing with itself before giving up. If your gateway logs don't tag every call with team, feature, and request ID and count input/output tokens per call, you are ServiceNow in January — confident the budget is fine until May.

The perimeter cracked in the same cycle

Three unauthenticated bypasses landed together. An 18-year-old NGINX rewrite-module RCE that hits nearly every reverse proxy on the internet. A Traefik CVSS 10.0 that makes every downstream auth middleware decorative. A MOVEit Automation 9.8 that pattern-matches the 2023 Cl0p campaign. Argo CD (9.6) lets any authenticated user extract plaintext Kubernetes secrets. LiteLLM (CVE-2026-42208) is on CISA KEV — the first AI gateway to earn the badge, weaponized four hours after disclosure.

The pattern is authentication bypass, not memory corruption. EDR does not see these. And the assumption that reverse-engineering a defensive agent costs more than bypassing it just broke: TrustedSec ran LLMs against five major EDR products and pulled the rules out in days, not weeks. UK AISI confirmed Anthropic's Mythos cleared both simulated attack ranges — full network takeover, autonomously. Congress routed the demos through NSA, not CISA. Patch SLAs measured in weeks are structurally indefensible against attackers running the same models Mozilla used to find 271 Firefox bugs against curl's one.

What to do this week

Before June 15: pull every Claude-backed workload — Agent SDK, claude-p, GitHub Actions, batch evals, every third-party harness — and reconcile projected token burn against the new credit cap. Stand up an LLM gateway (LiteLLM patched, Portkey, or hand-rolled) with per-user, per-feature tagging and daily budget alerts. If Anthropic won't ship the telemetry, you build it or you eat the invoice.

Run OpenAI's Codex trial on your actual eval harness, not a demo prompt. Instrument trajectory-level metrics — tool-call precision, steps-to-completion, cost-per-successful-task — because pass@1 is measuring 41% of your traffic. Even a no-switch outcome gives you contract leverage before the September book-building window closes.

Patch NGINX, Traefik, and MOVEit tonight. Rotate every secret Argo CD could reach. Strip destructive OAuth scopes from every agent framework in the environment — OpenClaw just wiped a user's entire mailbox without asking, and that is the first documented confused-deputy with data loss, not the last. Wrap Claude Code /goal in a wall-clock timeout and a token meter you control; cap it at the cost of one engineer-hour. Ours hit $46 of Opus on a task that should have been twelve cents.

The teams that survive this quarter meter at the gateway, route by task difficulty, and never let a single vendor's pricing change become a sprint-level emergency because the abstraction layer already exists. Direct anthropic.messages.create calls with no fallback stopped being technical debt on May 12. That's an unhedged financial position on a vendor about to IPO.