The Anthropic Bill Detonates June 15. Patch The Edge Tonight.

ServiceNow burned its entire annual Anthropic budget by May. Not a mid-market shop with a stray Cursor seat — a $9B-revenue company with a CDIO and a procurement function. They did it without knowing which users or workloads drove it, because Anthropic ships no per-user telemetry, no SLAs, and no committed pricing to enterprise customers. That's the vendor 34.4% of business AI spend now goes to.

On May 12, Anthropic announced that starting June 15, Claude subscriptions convert to dollar-matched API credits, and third-party tools (Cursor, Cline, Zed, OpenCode, Claude Code /goal) get a separate credit bucket. When it burns, the meter runs at full API rates. The implicit 70-90% discount that made a $200/month plan buy $700-$2,000 of API-equivalent value is gone. OpenAI countered within hours with two months of free Codex for enterprise switchers on a 30-day window.

This is the story of the week, and it's the story a lot of teams will discover from an invoice rather than a dashboard.

The pricing move is an IPO move

Anthropic hired a CFO. The reporting points to an October target. $30B ARR up from $9B four months ago is real revenue, but the per-user economics underneath it were subsidized by a pricing accident that public market investors will not tolerate reading in an S-1. So the accident is being closed.

Dario Amodei conceded at Code with Claude that Anthropic planned for 10x growth and hit 80x. The emergency patch was leasing 45% of xAI's Colossus 1 cluster — 220,000 GPUs from a company whose CEO has publicly called Anthropic "misanthropic and evil." Financial logic overwhelmed competitive logic, which tells you something about the compute market that no press release will. Grok didn't get traction. The GPUs had to earn.

Yes, but — the counter-reading is that Anthropic is a duopolist with 34.4% enterprise share flipping OpenAI for the first time, and a 3-10x price increase on a captive base is what pricing power looks like when you have it. That's true. It's also why the Codex offer is time-boxed and why Ramp's card data shows the lead change happened in a single month. Vendor stickiness in AI is zero. Customers flip on capability. The 30-day window is real leverage exactly once, and it's now.

Model the impact before Monday. Take current third-party harness spend, subtract plan-credit equivalent, multiply the remainder by API rates. That's the new bill. If it's material, run the Codex evaluation on the free window — even if you don't switch, you own the benchmark data in the next Anthropic conversation. If you don't have per-user, per-feature token attribution at a gateway, you're operating without instruments the vendor has decided not to build for you. LiteLLM, Portkey, or something you write yourself. Ship it before June 15.

The edge is on fire in parallel

While the pricing story dominated the AI feeds, four unauthenticated criticals landed on the perimeter. NGINX shipped a fix for an 18-year-old pre-auth RCE in the rewrite module, which is present in roughly every production NGINX deployment on earth. Traefik posted CVSS 10.0 on an authentication bypass that makes ForwardAuth and BasicAuth decorative — every backend service behind it is effectively internet-facing without auth. MOVEit at 9.8, same product family Cl0p worked through in 2023. Argo CD at 9.6 lets any authenticated user read plaintext Kubernetes Secrets, which for most ML teams means model registry tokens and HuggingFace PATs.

And PraisonAI, an open-source agent framework, was weaponized four hours after disclosure. Four hours. That's not a patch SLA anymore, that's a scramble. The old 30-day window is now the exposure window, not the response window.

Patch NGINX first because it's pre-auth and executes before your app sees the request. Then Traefik, with a WAF in front if you can't take the downtime. Then Argo CD, and rotate every Kubernetes Secret in namespaces it can read — patching alone doesn't close the window on secrets already disclosed. If you run LiteLLM anywhere between 1.81.16 and 1.83.7, it's on CISA's KEV catalog and API keys are the target. Rotate.

The capability line moved

Anthropic's Mythos is the first model to clear both UK AISI simulated attack ranges — a discrete jump from "advanced persistence" to "full network takeover." Congress is routing access through NSA rather than CISA, which tells you which side of the offense/defense split the government read this as. Mozilla's custom harness found 271 previously-unknown Firefox bugs with Mythos. Daniel Stenberg ran the same model against curl without a custom harness and got 1 real CVE. Same weights. 271:1 yield gap. The harness is the product, not the model.

That's the operator lesson for anyone building coding agents or security tooling. Refusal-rate benchmarks measure the wrong thing. Weights are commodity. Orchestration IP — how you probe, how you mutate, how you measure, how you gate — is where the moat is now.

One thing to do this week

Run the June 15 arithmetic. Not the pitch-deck version — the actual per-team, per-workflow token attribution against full API rates, with the Codex free window scored side-by-side on your top three Claude-dependent workflows. Write a one-page memo naming the switching cost, the price point that reverses the decision, and the SLA terms you want in the next Anthropic contract. Teams with that memo ready move in 72 hours when the next pricing change lands. Teams without it spend the quarter in a Slack thread while ServiceNow's May moment quietly becomes theirs.