The Investor

What Changed This Week

Anthropic did two things in the same week, and the combined effect is that everyone building on Claude is now running different math. First, every subscription plan converts into a dollar-matched API credit pool, so a two-hundred-dollar-a-month plan buys exactly two hundred dollars of programmatic tokens. That kills the 70-90% arbitrage the third-party harnesses (Cline, OpenCode, OpenClaw) had been quietly running against subscription-tier usage. Second, third-party credits unbundle on June 15, which is a polite way of saying Anthropic is done subsidizing other people's experiments.

Set that against Ramp's April numbers, Anthropic at 34.4% of B2B spend vs OpenAI at 32.3%, the first documented lead change, then add a new CFO hire, and the read is fairly direct: this is an October IPO cleanup that sacrifices short-term developer goodwill for public-market-ready margins. The counter-thesis worth naming is that this is just margin discipline that would have happened regardless of timing. Possibly. The CFO hire still rhymes.

Cross-Source Analysis

There is a reasonable argument that the enterprise lead isn't durable. Ramp's panel skews toward SMB credit-card spend and undercounts the eight- and nine-figure invoiced contracts where OpenAI retains strength, so the precise percentage is doing less work than the headlines suggest. The directional number is harder to wave away: Anthropic quadrupled enterprise adoption YoY while OpenAI grew 0.3%. That gap is not a methodology artifact.

OpenAI replied within hours with two months of free Codex for enterprise switchers inside a thirty-day window, which tells you both vendors are watching the same dashboards and that coding agents are now a subsidy fight rather than a product fight.

The coding-agent thesis is now a duopoly subsidy fight with a commoditized harness layer beneath, and every portco priced on Claude subscription economics is worth less today than last Friday.

What This Means for Your Book

The wrappers running COGS against subscription tokens have lost something like 20-40% of effective runway in the four days since the change went live, and most founders haven't surfaced it to their boards yet. From the other direction, Notion shipped an External Agents API hosting Claude, Codex, Cursor, Decagon, Warp, and Devin inside the same workspace, which commoditizes the interface layer from above. That is a two-sided squeeze on anyone whose business is thin-wrapping a frontier model.

Survivors clear one of three bars, or rather one of three increasingly narrow bars: proprietary workflow data that compounds per-use, open-source distribution along the Cline model, or enterprise-grade bounded execution with real security moats like Cursor's sandboxed agents. Anything that doesn't clear one of those is a pass.

Fifty-Nine Percent of Production Tokens Are Already Agentic

Vercel published the first production-grade AI Gateway index across more than 200,000 teams, and the headline reframes the stack: agentic workloads now carry 59% of all production token volume. That is the majority case in production today, not a forecast, with chat completion already a minority revenue line.

Beneath the headline sits a bifurcation that describes two different businesses. Anthropic captures 61% of spend, mostly via Opus on expensive tool-using agent calls, while Google captures 38% of volume, via Flash on cheap high-throughput work. One charges a premium for reasoning. The other runs the commodity pipe. The model layer has split along a price-volume axis that most investors are still pricing as a single category.

Incumbents Naming the Autonomous Enterprise Layer

The platform race to define the layer before pure-plays can is visible in last week's announcements:

• SAP committed €100M to an Autonomous Enterprise partner fund with NVIDIA and Microsoft wired in
• ServiceNow shipped Action Fabric, decoupling logic from UI and exposing workflows as headless APIs for agents to consume
• Notion launched a developer platform with Claude and Codex as hosted teammates

a16z simultaneously published its GTM thesis, which is that value migrates from data gravity (Salesforce's moat) to orchestration gravity, or rather the accumulated workflow context and multi-system synthesis that sits on top of it. Their check went to Stitch. The Lemkin proof point is the one to chew on: a customer cutting Salesforce from ten-plus human seats to two humans plus one API seat while spend rose 83% ($12K to $22K), with twenty-plus agents running underneath.

Seats collapsed and the bill rose. That is the consumption-based GTM pitch in one customer.

Where the Alpha Remains

The infrastructure gap is specific and quantifiable: MCP gateways, agent identity and auth, knowledge-graph tooling, agent observability, governance layers, eval frameworks. SAP's fund ends up deploying into exactly this layer, which means the only interesting question is whether you are on the cap table at seed or Series A pricing before corp-dev activation compresses entry points. The window before Series B pricing firms is, by my read, 2-3 quarters.

This is probably wrong, but the counter-thesis deserves airtime anyway. Notion, Cursor, and Airtable absorbing agent hosting into existing workflow surfaces is a distribution problem standalone orchestration startups cannot outspend, and the honest version of that argument is that Vertical beats horizontal in agent ops from here.

What landed this week

AI security has a defensible line item now, which is new. A KEV listing, a platform launch, and a benchmark claim arrived inside the same news cycle, and the procurement consequence is the part worth pricing.

1. LiteLLM hit CISA's Known Exploited Vulnerabilities catalog, the first LLM-routing control plane to be federally flagged as actively exploited. CISOs now have an auditable reason to write an enterprise security check against AI workloads specifically. That is the consequence.
2. OpenAI launched Daybreak with Cloudflare, Cisco, CrowdStrike, Palo Alto Networks, Oracle, Zscaler, Akamai, and Fortinet listed as partners, which is the classic platform-prepares-to-eat-partners setup that played out in four prior waves of enterprise software. The partners signed it anyway.
3. DepthFirst claimed 10x cost efficiency over Anthropic's Mythos on vulnerability discovery: twelve memory-corruption bugs in FFmpeg for roughly one thousand dollars in compute, against Mythos missing them across several hundred scans at roughly ten thousand. The benchmark is self-reported. Read it that way.

The Bifurcation Worth Pricing

A split is forming in AI security economics. On one side, specialized harnesses (the DepthFirst shape) post order-of-magnitude cost advantages on narrow workloads. On the other, frontier-model-powered tools (Mythos) offer broader capability at higher cost. Microsoft's MDASH producing 16 validated CVEs in a single Patch Tuesday settles the question of whether autonomous discovery works at production scale, which is the part of the thesis that was actually in doubt a quarter ago.

Defender demand has its own catalyst. PraisonAI's auth-bypass CVE was weaponized within 4 hours of disclosure, which means open-source AI-agent frameworks are live attacker targets rather than theoretical ones. An AI honeypot indexed by Shodan within three hours absorbed 113K+ requests in a month.

Cyber-AI is pricing as an AI feature and transacting as a defense-tech category. The Series B window closes on whichever of those framings the market agrees to first.

Investable Wedges by Urgency

The category is splitting into four funded verticals at different maturity levels. This is probably wrong on at least one of them, but the shape is the point:

The Daybreak partner list is the portfolio-defense signal worth tracking. Every security portco should be able to articulate why their product isn't a Daybreak connector in eighteen months. If the answer takes more than two sentences, it isn't one.