The Investor

What Happened

On May 12–13, Anthropic and OpenAI repriced the coding-agent market on the same afternoon. Anthropic converted every Claude subscription into a dollar-matched API credit pool, meaning a $200 plan now buys exactly $200 of programmatic tokens and nothing more. That kills the 70–90% arbitrage the third-party harnesses (Cline, OpenCode, OpenClaw) had been running by funneling production workloads through subscription-tier access. OpenAI answered within hours with two months of free Codex for enterprise switchers inside a 30-day enrollment window.

Read against Ramp's April data showing Anthropic at 34.4% of business spend vs OpenAI at 32.3%, which is the first documented lead change, plus a fresh CFO hire and a likely October IPO target, the read is narrow: margin recovery dressed as developer generosity, timed to pre-IPO diligence.

What this does to wrapper margins

Any Claude-dependent portfolio company whose COGS quietly assumed subscription-rate token access just absorbed a structural margin hit. The arithmetic is unkind. A wrapper paying around $200/month for inference that would cost $700–2,000 at API rates has watched gross margin on that workload move from above 70% to potentially negative inside a single weekend. The change is four days old, and most founders have not flagged it to their boards.

Call it margin recovery, not a pricing tweak. The model layer is reclaiming the surplus that funded an entire category of startups.

Notion's External Agents API, which now hosts Claude, Codex, Cursor, Decagon, Warp, and Devin inside the same workspace, adds a second compression vector. The interface layer is being metered from above by the model vendors and aggregated from below by the workspace platforms, which leaves whoever is sitting in the middle paying retail and selling wholesale.

The Duopoly Subsidy Fight

Multiple sources describe the same dynamic. Anthropic is spending pre-IPO capital to lock in developers while OpenAI rents enterprise switching with free quarters, and the layer between them pays for both. Sources disagree on whether this is permanent or tactical, and there are at least three readings worth holding at once: the October IPO is a natural sunset for Anthropic's subsidy, OpenAI's counter expires the moment the Ramp share gap widens, and a third where neither side blinks because the developer surface is now considered strategic enough to bleed for indefinitely. This is probably wrong, but the third reading is the one I would underwrite.

The training-efficiency stack matters here too. Nous Research's Token Superposition Training shows 2–3x wall-clock speedup validated to 10B MoE, and Datology claims +11.7 points across 20 benchmarks at 17x less compute. If either replicates at scale, the capex moat sitting underneath both labs starts to compress, and the subsidy fight gets cheaper to sustain rather than shorter.

Surviving Moats

The wrappers that survive this fall into a narrow set:

1. Open-source distribution, where Cline's rebuilt SDK with subagents and scheduled jobs owns the slice of the community that refuses vendor lock-in
2. Bounded execution / enterprise security, where Cursor's cloud agents with full dev environments, rollback, and isolated secrets compete on trust rather than token economics
3. Proprietary workflow data, meaning any tool accumulating institutional context the model layer cannot replicate from the outside

Everything else is a thin wrapper running on subscription arbitrage. That is a markdown waiting to be written down.

The ServiceNow Tell

ServiceNow — one of the more sophisticated enterprise software buyers anyone has ever underwritten — exhausted its full-year Anthropic budget by May 2026. Not because Claude was bad. Because Anthropic ships no granular per-user telemetry, no usage dashboards, and no SLAs worth the paper. National Life Group's CIO put it about as plainly as a CIO will: Anthropic is 'great for consumer usage but not great for companies.'

This is the asset the secondary market is being asked to mark at $900B+ on an enterprise revenue thesis. Consumer-grade plumbing does not, historically, clear enterprise-grade multiples.

The Observability Category Is Forming in Real Time

ServiceNow's internal response is the part to read twice: they built AI Control Tower to monitor what the vendor would not. That is a CDIO who watched a category form inside her own P&L and decided to be the vendor instead of the line item. Around her:

• Modal at $4.5B on inference orchestration revenue that is, by all accounts, surging
• Only 15% of enterprises have data foundations ready for agentic AI at scale, per the Fivetran index, despite spending in the millions
• Nearly half cite data quality and lineage as the actual blocker
• Four firms — Google, OpenAI/Bain, Salesforce, ServiceNow — independently concluded the margin lives in deployment, not the model

When four firms independently copy the Palantir FDE playbook in the same quarter, the margin is in deployment services. Period.

The Revenue Quality Discount

Several lines of evidence converge on a structural fact: enterprise AI spend is reversible in a way traditional SaaS never quite was. No SLAs means no contractual lock-in. No telemetry means budget blowouts happen quietly. Low switching costs mean the next model release becomes a procurement reset. Reasonable people disagree on severity — one camp says the Ramp lead is durable because enterprise buyers are sticky by nature, the other points at OpenAI's 0.3% YoY growth and concludes stickiness is not, in fact, doing the work here.

The synthesis, or rather the version of it I am willing to defend: LLM-layer ARR deserves a 20–40% reversibility discount against traditional enterprise SaaS. Apply it before the LP meeting, not during.

The FDE Land Grab

Google Cloud is hiring hundreds of forward-deployed engineers. OpenAI stood up DeployCo with Bain Capital and is openly recruiting Palantir alumni. Salesforce and ServiceNow are staffing the same function under different titles. The industry has conceded what Palantir figured out roughly twenty years ago: deployment is the bottleneck, and the bottleneck is where the margin sits. The software that productizes 60% of FDE work — context ingestion, custom eval harnesses, workflow templates — captures margin the labs cannot defend.

The Category Is Being Named by Incumbents

Three things showed up in the same week, which is either coincidence or the kind of coincidence that isn't. a16z published its GTM software thesis arguing the system of intelligence captures the next decade's value, backed by the Stitch investment. SAP committed €100M to an Autonomous Enterprise fund wired to NVIDIA and Microsoft. ServiceNow shipped Action Fabric, a headless architecture built to host third-party AI agents via MCP servers. The autonomous enterprise category is being drawn by the incumbents before the pure-plays get to name it.

This is the opposite shape from cloud, where AWS defined infrastructure and the incumbents caught up roughly a decade late. This time the ERPs and workflow platforms moved first.

The Production Data

Vercel's AI Gateway index — the first production-grade measurement across more than 200,000 teams — delivers the numbers worth arguing about:

• Fifty-nine percent of token volume is agentic, which makes it the majority case rather than the niche
• Anthropic takes sixty-one percent of spend, on Opus, as premium reasoning
• Google takes thirty-eight percent of volume, on Flash, as commodity throughput

Two different businesses are now visible inside the phrase 'foundation models,' or rather, the more interesting version: one priced like a consultant, one priced like a utility. The spend-versus-volume split validates multi-model routing as the enterprise default and closes the argument that a single lab runs the table.

The Lemkin Proof Point

Jason Lemkin's SaaStr anecdote, which a16z is now using as the unit-economics template, runs as follows: Salesforce cut from more than ten human seats to two humans plus one API seat, while spend rose eighty-three percent, from twelve thousand to twenty-two thousand dollars, with twenty-plus agents running on top. The seat count collapsed. The bill went up.

If NRR structurally exceeds one hundred and fifty percent in this model, it justifies premium multiples. Three customers showing the same pattern is the Series A bar.

Where the Window Closes

This is probably wrong, but the sources disagree on timing in a useful way. One camp argues the incumbents absorb the intelligence layer through acquisition within eighteen months and the wedge narrows. The other points to Lemkin's observation that startups are currently moving faster than Salesforce and ServiceNow on agentic fabric. The synthesis is that twelve to eighteen months is the investable window for agent infrastructure pure-plays at reasonable multiples. After that, either the winners have compounded or the incumbents have written the check.

The wedges that fit inside that window:

1. Vertical orchestration with institutional-context accumulation, the Stitch archetype
2. Agent identity and governance, the gap Levie keeps flagging
3. MCP tooling and knowledge-graph infrastructure, now settling as enterprise default
4. AI observability, agent-specific, distinct from model-layer FinOps

Every dollar SAP deploys into this layer eventually is a dollar of Series A/B markup for the companies already on the cap table.

The Category-Defining Week

Four events crystallized AI security as a standalone budget category in the same seven days:

1. LiteLLM added to CISA's KEV catalog — the first LLM-routing control plane federally flagged as actively exploited
2. Microsoft MDASH shipped 16 validated Windows CVEs in a single Patch Tuesday — production-scale autonomous vulnerability discovery, not a demo
3. Anthropic's Mythos cleared both UK AISI attack ranges — first model to do so, with Congress routing access through NSA rather than CISA
4. OpenAI launched Daybreak with Cloudflare, Cisco, CrowdStrike, PANW, Oracle, Zscaler, Akamai, and Fortinet as 'partners'

When a platform launches with every major incumbent listed as a friend, the phase is pre-disintermediation, not partnership.

The Economics Are Bifurcating

DepthFirst's Open Defense Initiative landed FFmpeg, Envoy, and Kata as anchor tenants claiming 10x cost efficiency over Mythos — 12 memory corruption bugs for ~$1,000 vs Anthropic's ~$10,000 across several hundred scans. The AI-security market is splitting into:

Mozilla found 271 bugs in Firefox with a custom agentic harness on top of Claude — while Mythos found 1 real CVE in curl with a generic scan. Harness design beats model selection. That is the moat signal for any AI AppSec deal in your pipeline.

The NSA Signal

Congress routing Mythos access through NSA rather than CISA tells you which agency the first government dollars route through. This is offensive/IC-led procurement, not civilian defensive distribution. The implication for deal flow: tilt toward teams with TS/SCI talent, Five Eyes partnerships, and offensive-AI primitives wrapped in compliance.

EDR Moats Are Cracking

TrustedSec ran LLMs at five commercial EDRs and reported that reverse engineering that took weeks now takes days. All five products share identical architectural furniture — YARA rules, Lua engines, local ML classifiers. Detection-rule IP is becoming a commodity input. Daybreak's partner list is the confirmation: when the platform lists every incumbent as a friend, it is pre-disintermediation.

AI security is pricing as an AI feature and transacting as a defense-tech category. The Series B window closes on whichever framing the market agrees to first.