The Scientist

What Changed

Anthropic quietly converted every subscription plan into a dollar-matched API credit cap for programmatic usage. Starting June 15, Claude consumption through Agent SDK, claude-p, GitHub Actions, and third-party harnesses (Zed, Conductor, OpenCode, T3 Code) draws from a separate credit bucket equal to plan value. No rollover, no subsidized tokens, and overflow bills at API list rates. The 70-90% effective discount power users were extracting from $200 Max plans is gone.

This lands the same week Dario Amodei admitted Anthropic planned for 10x growth and got 80x, forcing an emergency lease of xAI's entire 220,000-GPU Colossus 1 cluster (H100, H200, and GB200). Rate limits on Claude Code are doubling and peak-hours throttling is being removed. The serving fleet is now heterogeneous and still stabilizing.

Why It Matters Now

Any eval harness, batch job, or agent loop running through a Claude subscription was implicitly subsidized. ServiceNow already burned its full-year Claude budget by May under those economics. The problem compounds because Anthropic provides no native per-user or per-tool usage telemetry. The thing this doesn't tell you is which tenant or prompt is driving spend, and you cannot recover that without building your own gateway instrumentation.

If the vendor cannot tell you which user burned the token, the cost problem is actually an observability problem, and the customer owns it before the next invoice.

On the same day, OpenAI dropped a 2-month-free Codex enterprise switch promo, a targeted counter-offensive aimed at the exact developers Anthropic just alienated. Ramp's April data shows the first-ever Anthropic lead in enterprise billing share (34.4% vs 32.3%). The methodology captures who gets invoiced, not token volume or workload criticality, which is a different question.

Cross-Source Tension

Ten independent sources cited the Anthropic enterprise crossover, but the signal contradicts itself. Anthropic is winning enterprise share even as quality degrades and effective prices rise, with capacity leased from a competitor's datacenter. The resolution: bottoms-up developer adoption is real, and so is the capacity wall. Any benchmark run between mid-April and May 7 is contaminated by capacity-driven degradation and should be discarded for baselining purposes.

The Production Data

Vercel's AI Gateway production index covers seven months of telemetry across 200,000 teams. Agentic workloads now sit at 59% of token volume, up from under 20% six months ago. The structure worth acting on is the spend-volume split: Anthropic captures 61% of dollars through Opus on reasoning, while Google captures 38% of volume through Flash on high-throughput utility. Switching is frequent. Vendor loyalty is not observed in the data.

This is consistent with MDASH on CyberGym, where Microsoft's 100+ agent ensemble beat Anthropic's single-model Mythos by decomposing the workload into scan → adversarial debate → PoC exploitation stages. The lift looks like it came from the decomposition pattern rather than raw agent count, but there is no ablation isolating which stage carries the work. Treat the attribution as a hypothesis.

What This Breaks

Most production eval harnesses still score single-turn responses against reference answers. When 59% of tokens are multi-turn tool-calling traces, final-answer accuracy hits 90%+ on both the expensive and the cheap path. The thing that number doesn't measure is the cost path to get there — a planner that burns 40K tokens arguing with itself before giving up looks identical to one that solves it in two calls. Cost models fitted when input-output ratios sat at 3:1 are off by roughly 5x on agentic traces, where input ratios run closer to 15:1 with heavy variance from cache reuse.

If 59% of your tokens are agentic but 100% of your evals are single-turn, you're flying instruments-out.

The routing pattern at scale

Abridge's architecture across 80M+ clinical conversations shows the same shape: cheap triage in front, expensive reasoning behind, LLM judges calibrated against annotated data. The non-obvious finding is that post-training on proprietary domain data still beats frontier models on cost and latency once volume gets serious. The crossover point is an empirical question on your stack, not a theoretical one.

Two Reinforcing Data Points

Glean's benchmark reports off-the-shelf MCP using 30% more tokens and losing 2.5x head-to-head preference against a tuned knowledge graph on agentic tasks. Vendor-published, methodology undisclosed. Treat as hypothesis until someone replicates it. Separately, SAP and ServiceNow both shipped Knowledge Graph + MCP architectures this quarter, which suggests RAG-over-docs is losing ground to structured KG grounding for enterprise accuracy. The evals that matter now are tool-use success@1, hallucinated-argument rate, and multi-step completion. MMLU does not measure the bottleneck.

The New Attack Surface

This cycle's CVE disclosures land squarely on the ML data stack. Apache Iceberg (CVE-2026-42812, CVSS 9.9) lets a writer redirect table metadata to an attacker-controlled S3 prefix. The next query reads poisoned Parquet. The next training run ingests silently corrupted features. Apache Polaris (CVE-2026-42809/10/11, CVSS 9.9) widens credentials across tenants, which turns a compromised analyst notebook into S3/GCS credential theft.

Add Argo CD (CVSS 9.6), which exposes plaintext Kubernetes Secrets in reachable namespaces, including model-registry tokens, HuggingFace PATs, and cloud credentials. The path from analyst notebook compromise → cross-tenant data access → training data poisoning → model corruption is no longer hypothetical.

What Most Teams Miss

Default lakehouse observability tracks row changes, not pointer changes. The Iceberg vulnerability shifts the storage location itself, and standard logging will not flag it. The thing this doesn't tell you is whether your features are still drawn from the table you think they are. There is no hard error, no schema violation, just gradually poisoned features or labels flowing into training.

Credential exposure is a pivot into everything else the warehouse touches. The fix is boring: rotate credentials and narrow what the table catalog service is allowed to reach. The time to do it is before the rotation becomes an incident response task.

The Compounding Factor

This week's lakehouse stats audit from TLDR Data adds a layer worth pricing in. Stale or missing column stats on Iceberg/Delta tables produce silent query-plan degradation. An attacker who poisons metadata pointers can also strip stats, so downstream queries scan more data and return corrupted results. The failure mode is invisible to most monitoring. No error, just 3x compute spend and quietly wrong features.

Workflow orchestrators (n8n at 9.8 SQLi, Kestra at 9.8) generally run with broad database and cloud credentials because they orchestrate everything. Scope service accounts to the minimum per workflow and audit network reach from orchestrator hosts. These are the tools most ML teams have neither constrained nor monitored.

The Breakthroughs

The week's research drops sit on different segments of the training cost curve. The combined read: the marginal dollar in ML training has moved off raw compute and onto dataset engineering.

Why TST Is the One to Spike First

Token Superposition Training reports a 2-3x wall-clock speedup from a pretraining recipe change, with no inference-side architecture modification required. If it replicates at even 1.6x on a continued-pretraining run without a val-loss regression, it pays for itself on the next full run. The risk profile is low. The claim is single-source but clean, validated from 270M to 10B parameters, and the failure mode is 'no gain' rather than 'broken model.'

Datology: The Marginal Dollar Moved to Curation

Datology reports +11.7 points across 20 VLM benchmarks at 2B params, beating InternVL3.5-2B by roughly 10 points at 17x less training compute, purely via curation. Their 4B model matches near-frontier quality at 3.3x lower response FLOPs than Qwen3-VL-4B, which is a serving-cost win, not just a training one. This is the cleanest evidence this year that the binding constraint in VLM training has shifted from GPU hours to dataset engineering.

Star Elastic: Discount the Headline, Keep the Direction

NVIDIA claims one post-training run produces a family of reasoning model sizes at 360x lower cost than pretraining the family, and 7x better than SOTA compression. Lab-reported numbers of this magnitude shrink under independent eval; that's the base rate, not a critique. Even at a 30x hold, the result restructures how size tiers get produced for deployment. One training run plus elastic derivation replaces the current practice of training 3-5 separate checkpoints.

The marginal dollar in VLM training has moved from compute to curation. A team spending more on GPU hours than on dataset engineering is optimizing the wrong layer.

Combined Implication

These results arrive in a quarter where GPU demand-to-supply sits at 4:1 at Nebius and H2 capacity is selling out. The direction is clear. Curation-first pipelines are the binding hedge against a capacity squeeze, with recipe-level wins like TST as the secondary lever. Teams that only know how to throw FLOPs at a problem will find those FLOPs priced at a premium and wait-listed besides.