Anthropic just repriced every Claude wrapper — and the ingress layer is on fire

The pricing shock that broke everyone's budget

On Monday, Anthropic converted every Claude subscription into a dollar-matched API credit pool. A $200 plan buys $200 of programmatic tokens. Starting June 15, third-party harnesses — Cursor, Cline, OpenCode, Aider, anything you wrote yourself — get a separate credit bucket sized to plan value, then fall through to full API rates.

The 70-90% implicit discount that funded a generation of coding-agent wrappers is gone. Same prompts, same outputs, roughly 10x the bill for anyone who was routing production workloads through subscription-tier access.

OpenAI answered inside 24 hours with two free months of Codex for enterprise switchers, enrollment window closing July 13. Ramp's April data explains the urgency: Anthropic 34.4% of business AI spend, OpenAI 32.3%. That's the first documented lead change, and the number was drawn from card-spend data that skews SMB — the real enterprise gap is probably wider.

Anthropic hired a CFO. October IPO is the working target. ARR is up from $9B to $30B+ in four months. The pricing move is margin recovery timed to a roadshow, dressed as developer generosity. It won't be the last one before October.

Yes, but — the counter-reading is that this is a temporary supply squeeze and the discount comes back once Colossus 1 integration stabilizes capacity. It doesn't. Anthropic just took the ceiling off inference revenue-per-user. That number does not go back down before diligence.

What ServiceNow's blown budget tells you about yours

ServiceNow — a company that knows how to buy enterprise software — burned through its full-year Anthropic budget by May. Not because Claude was bad. Because Anthropic ships no per-user telemetry, no usage dashboards, no SLAs. Kellie Romack's team could not tell which users drove the overrun or which workloads. National Life Group's CIO put it more directly: great for consumer usage, not great for companies.

This is the vendor that just took 34.4% of enterprise AI spend. The plumbing is consumer-grade.

ServiceNow's response was to build AI Control Tower internally and start selling it to other enterprises. That's what routing around a vendor deficiency looks like when the deficiency is durable. The category being pulled into existence is per-customer, per-feature inference cost attribution — a gateway sitting in front of every LLM call with team tags, budget alerts, and daily caps. If you don't have one by mid-June, ServiceNow's failure mode is your July invoice.

The compounding factor is that Claude inference is now partly running on xAI's Colossus 1 — 220,000 GPUs whose CEO has publicly called Anthropic "misanthropic and evil." The lease is real; the money clears what Grok couldn't earn on the same silicon. Your prompts traverse infrastructure operated by a direct competitor with stated hostility toward the vendor. Update the sub-processor register. File the DPIA refresh before your next customer audit asks about it.

The perimeter is on fire in three places

The same week the pricing memo dropped, three independent critical auth bypasses hit the ingress layer.

NGINX shipped a patch for an unauthenticated pre-auth RCE in the rewrite module that has sat in the tree for 18 years. Rewrite is not optional — it's in 90%+ of production deployments, every try_files, every URL manipulation. The RCE executes before your app's auth middleware, rate limiting, or input validation sees the request. Public PoC expected within days.

Traefik shipped CVE-2026-35051 and -39858 at CVSS 10.0 — the rubric does not go higher. ForwardAuth, BasicAuth, every middleware configuration is bypassed. Every service behind Traefik is effectively internet-facing with no authentication until patched.

MOVEit Automation shipped a 9.8 auth bypass in the same product family Cl0p ran a months-long campaign against in 2023. PraisonAI was weaponized four hours after disclosure. Argo CD 3.2/3.3 leaks plaintext Kubernetes secrets at 9.6 — patch alone doesn't close the window, you have to rotate every credential the controller could reach.

The chain that matters: Traefik bypass → internal Argo CD → plaintext K8s secrets → cluster ownership. Required privileges: none.

The common thread across all four is authentication bypass at the access-control layer, not memory safety. EDR will not catch these. Generic WAF signatures will miss. And the tempo has changed — UK AISI confirmed Anthropic's Mythos completed autonomous full network takeover on both of its hardest ranges, the first model to do so. Google TAG attributed a functional cybercrime tool to a threat actor using AI to build it. Four-hour weaponization is the tempo defenders are now working against. A 30-day patch SLA was calibrated for a threat model that no longer exists.

What to do this week

Two actions, both 72-hour clocks.

Model the June 15 impact on every Claude-dependent workload by Monday. Pull invoices for the last three months. Split usage by direct API versus third-party harness. Multiply the harness slice by the API-rate delta. Send finance a one-page memo with the new number and the switching threshold — the price point at which you move workloads to Codex during the free window. Teams that have this memo ready move in three days. Teams that don't spend the quarter in a Slack thread while ServiceNow's failure mode arrives on their invoice.

Patch NGINX, Traefik, and MOVEit before Friday. Not "schedule for the maintenance window." Rotate every Argo CD-accessible K8s secret in the same push. If a rolling restart across your reverse proxy fleet isn't a two-line runbook, that's the second bug this advisory surfaced — write the runbook this week.

The pricing model and the threat model both changed. The window to respond to either is about the same length.