The Week Your Cost Model, Patch SLA, and Agent Perimeter All Broke

The pricing floor moved by an order of magnitude

On May 12–13, Anthropic converted every Claude subscription into a dollar-matched API credit pool. The $200/month plan now buys exactly $200 of programmatic tokens at API list rates. Teams running Claude through Cursor, Cline, OpenCode, Zed, or any third-party harness were pulling somewhere between 70% and 90% of that value as implicit discount. That discount is zero. On June 15, a second shoe drops: third-party tool credits split into a separate bucket with no rollover, then bill at API rates on overflow. Opus 4.7 tripled image processing cost the same week.

The capacity story underneath explains the timing. Dario Amodei conceded Anthropic planned for 10x growth and got 80x. The gap forced an emergency lease of xAI's Colossus 1 cluster — 220,000+ GPUs, roughly 45% of xAI's fleet, from a CEO who has publicly called Anthropic "misanthropic and evil." Read that as a supply-side concession, not a strategic partnership. Grok is exiting the frontier race and monetizing the silicon.

ServiceNow is the preview. Their CDIO burned the full-year Anthropic budget by May with no per-user telemetry, no SLA, no dashboard that would have passed a 2014 SaaS review. National Life Group's CIO called Claude "not great for companies." OpenAI countered within hours: two months of free Codex for enterprise switchers inside a 30-day window. Ramp puts Anthropic at 34.4% of business spend against OpenAI's 32.3% — the first documented crossover, and the exact reason the counter-offer exists.

Yes, but — the +50% Claude Code limits increase through July 13 is a temporary subsidy, and Anthropic could soften third-party terms before June 15 if enterprise pushback lands. The take still holds: the pricing structure is being tuned for an October IPO diligence pack, and whatever softens now hardens later. Model on API rates, not on the concession.

The perimeter has been broken for eighteen years

An unauthenticated pre-auth RCE has been sitting in NGINX's rewrite module since 2007. The module runs before your application's auth middleware — which means before anything you built to stop this. Historical disclosure-to-scan timelines put mass exploitation inside 48 hours. Public PoC lands within the week. Roughly 90% of production NGINX builds ship the module compiled in.

Next to it: Traefik CVE-2026-35051 and 39858 at CVSS 10.0 — auth middleware doesn't run at all until patched. Argo CD 9.6 lets any authenticated user extract plaintext K8s Secrets, which for most clusters means cloud credentials and model-registry tokens. MOVEit Automation shipped a 9.8 auth bypass in the same product line Cl0p worked for months in 2023. LiteLLM hit CISA KEV — the first AI-infrastructure component federally flagged as actively exploited, four hours from disclosure.

Four hours is the number that matters. PraisonAI's CVE was weaponized inside four hours. Microsoft's MDASH — a 100+ specialized-agent system — beat Anthropic's Mythos on the CyberGym benchmark. UK AISI confirmed Mythos cleared both simulated attack ranges end-to-end: full autonomous network takeover, not persistence, not lateral movement. Google TAG caught a threat actor building functional malware with AI in the wild. TrustedSec reverse-engineered five commercial EDRs with LLMs in days instead of weeks. The security-through-obscurity moat under most detection stacks is gone.

The operational consequence is unambiguous: a 30-day patch SLA is now the exposure window, not the response window. If your ingress SLA and your CVE SLA are still calibrated to quarterly cadence, you are patching slower than adversaries can rediscover.

Agents are the majority workload and they act with your credentials

Vercel's production data across 200,000 teams: 59% of AI token volume is now agentic — multi-turn, tool-calling traces. Six months ago that number was under 20%. Most eval harnesses in use score single-turn responses. Which means the majority of your production traffic is being measured by an instrument that doesn't describe it. Cost models built on the old input/output ratio are off by roughly 5x on spend.

An agent framework called OpenClaw wiped a user's entire email archive this week. No human approval, no rollback. Confused-deputy failure via a legitimate OAuth grant with modify/delete scope. That is the first publicly-confirmed destructive-action failure from a production agent. In the same seven days: Anthropic shipped Claude Code /goal for unattended autonomous sessions with no token budget cap, x402 payment protocol landed as a default in AWS Bedrock (99.8% of agentic payments settle in USDC on Base, irreversibly), and legacy bot detection bypasses agentic traffic in 81% of tests.

The surface expanded faster than anyone's IAM review. Duolingo — one of the few companies willing to publish a real production quality number — pegs AI-generated slop at ~20% requiring human cleanup and has walked back its blanket AI-usage mandate. That is the honest anchor for how much of your agent output needs a human gate.

What to actually do this week

One concrete move per axis, ordered by the clock.

Today, before the SOC goes home: inventory every NGINX and Traefik instance including vendored copies in appliances, and either patch or stand up WAF virtual-patching against the rewrite-module payload. Rotate every K8s Secret Argo CD could touch in the last 60 days, because patching closes the read but doesn't unread what was already read. If you run LiteLLM 1.81.16–1.83.7, rotate every stored LLM provider API key — active exploitation is confirmed, not modeled.

Before June 15: pull last month's Claude spend by team and feature, re-cost at full API rates against the new credit structure, and hand finance a number. If you don't have per-user, per-feature token attribution wired through an LLM gateway (LiteLLM, Portkey, or your own) — that's the sprint. Anthropic explicitly ships no native telemetry; ServiceNow proved passive management fails at $9B of revenue. Run one team's exploratory workload on Codex inside OpenAI's 30-day free window regardless of whether you plan to switch. The data is the point.

This sprint: audit every OAuth grant and API token issued to an agent. Strip modify/delete scopes where read suffices. Ship SIEM rules for bulk-delete and bulk-modify operations from agent user-agents — the OpenClaw failure fired with no alert. Add trajectory-level metrics (tool-call F1, steps-to-completion, cost-per-successful-task) to whichever eval harness gates production, because the single-turn score is describing 41% of your traffic. If Claude Code /goal or Auto Mode is available in a repo that touches production credentials, disable it via MDM before an engineer discovers the feature on a Friday afternoon.

The teams still shipping when the June invoice, the next KEV addition, and the next confused-deputy incident all land in the same week are the ones who spent this week re-instrumenting instead of arguing about whether any of it was overblown.