The Product Desk

What Changed This Week

A developer running Claude through Cursor opened her usage dashboard on Tuesday and saw something she had not seen before: a separate credit pool. Anthropic announced that every Claude subscription now includes API credits equal to the plan's dollar amount — the $200 plan gets $200 in API credits. The framing is generous. For the cohort running Claude through third-party harnesses like Cursor, Cline, OpenCode, and Aider at effective 70-90% discounts to API pricing, the actual change is a price increase of roughly an order of magnitude. Starting June 15, third-party tool usage gets its own credit pool, and once that burns down, full API rates apply.

The pitch is "every subscriber gets API credits." What is being done is the unwinding of a subsidy that power users built their workflow on. Anthropic hired a CFO and is likely targeting an October 2026 IPO. Revenue-per-user under the old model does not survive a public roadshow. Expect one more pricing adjustment before October.

ServiceNow's Budget Is the Preview of Your Q4

ServiceNow's CDIO Kellie Romack watched her team's full-year Anthropic budget get consumed before mid-2026. She cannot say which users drove it or which workloads, because Anthropic does not ship the telemetry that would answer those questions. PagerDuty and National Life Group describe the same gap. What the data actually shows is not engagement. It is structurally unpredictable cost curves and missing instrumentation.

The era of subsidized AI inference through integrations is ending. Every team that built unit economics on third-party harness discounts is now operating on assumptions that expire June 15.

The Counter-Move Creates a Window

OpenAI responded within hours with 2 months of free Codex for enterprise customers who switch within 30 days. That is displacement pricing timed to a moment of developer frustration. Ramp data showing Anthropic at 34.4% versus OpenAI's 32.3% in April explains the urgency. OpenAI lost the business adoption lead for the first time.

The Decision Framework

The Cost Governance Gap Is the Real Product Risk

ServiceNow built an AI Control Tower internally and staffed it with a dedicated person. Most teams have not done this. Two product categories are being pulled into existence by the gap: per-customer, per-feature inference cost attribution, and multi-model abstraction layers that become strategic the moment any single provider raises prices without notice. The team that ships the attribution layer first wins the next two budget cycles.

Three Giants Shipped the Same Architecture in the Same Week

SAP, ServiceNow, and Salesforce landed on headless, MCP-based agent architectures in the same week. ServiceNow's Action Fabric pulled workflow logic out of the UI and exposed it via MCP servers any third-party agent can call. SAP shipped a Knowledge Graph for agent context, plus a €100M partner fund aimed at Autonomous Enterprise. Salesforce added native WhatsApp voice to Agentforce. The pitch is "autonomous enterprise." The thing actually being done is headless, API-first execution accessible through MCP.

Companies don't stand up hundred-million-euro funds for features. They stand them up for platform bets they intend to defend for years. Three of the largest enterprise vendors picking the same week to land in the same place is not a coincidence. It is a commitment.

The Buyer Question Has Already Changed

A procurement manager at a Fortune 500 opened three enterprise software demos this week and asked the same question in each: "Can our agents call this directly, or do my people have to click through your UI?" Two vendors did not have an answer. The third did, and moved to the next stage. That is the buyer behavior most decks have not caught up to.

Vercel's production AI Gateway confirms the demand side. 59% of all token volume now flows through agentic workloads. Most large teams route across multiple models. Anthropic captures 61% of spend (Opus for reasoning). Google captures 38% of volume (Flash for cheap tasks). The interaction model has flipped from human-at-keyboard to agent-calling-API as the majority pattern.

What This Means for Your Product

If a product's core workflows cannot be invoked by an external agent without a human clicking through the UI by Q4, agents in the buyer's stack will route around the product to reach the system of record directly. The product becomes a reporting surface on top of someone else's execution layer.

The Build Scope Is Smaller Than the Deck Suggests

For most teams, shipping an MCP server against the existing API is a week of scoping, 2-4 weeks of build, assuming the underlying API is not already a mess. The larger question is whether the UI should be restructured around the assumption that an agent is the primary first-touch user. That is a roadmap question, not a sprint question.

Glean's Warning About Raw MCP

Glean benchmarked off-the-shelf MCP against enterprise knowledge graph integration. Raw MCP used 30% more tokens and was preferred 2.5x less on agentic tasks. The diagnostic for the next planning cycle: ship MCP compatibility as table stakes, invest in the contextual layer above the protocol as the moat. The protocol is not the differentiator. The intelligence sitting on top of it is.

A Senior Operator Shipped a Pricing Page Without You

Elena Verna — former head of growth at Amplitude, Miro, Dropbox, and SurveyMonkey — opened a laptop and pushed Lovable's enterprise pricing page to production herself. No PM scoping a brief, no designer on mocks, no engineer on the build. The traditional version of that project needs all three plus roughly a week of calendar time. Verna says she spends ~90% of her time building, with almost no meetings.

Lovable has no product managers. The company is growing fast enough that the absence is not an oversight. It is the model. Engineers talk to users, write specs, ship code, and read feedback. The Growth PMs the company is hiring sit parallel to Verna, not under her. The flat structure is deliberate.

What's Actually Being Unbundled

The PM role decomposes into four jobs: user research, prioritization, spec-writing, and cross-functional coordination. When AI tools let one person hold design, code, and deploy in the same head, coordination stops being enablement and becomes overhead. Judgment (what to build) and strategy (where to compete) survive. Coordination and spec translation collapse into the tooling.

The PM who restructures now — by becoming an HI-C or by redesigning the team for single-operator autonomy — will outperform the one still running sprint ceremonies.

The Nuance the Headlines Miss

The teams that ship well have someone doing prioritization and someone talking to users, regardless of title. The teams that ship badly have those jobs distributed across people who each think it is someone else's problem. The title is not the variable. The ownership is. Lovable's model works because it occupies one specific cell: named prioritization owner plus engineers with direct user contact. That cell works without PMs. Every other cell still needs one.

The Threat Model for Established PMs

Ravi Mehta's 'average intelligence' framing is the right read. AI does not make a PM world-class at design or engineering. It makes them average-to-good at everything simultaneously. For a PM who already thinks across functions, that is an opening, but only if the recovered time goes into shipping rather than into coordinating other people shipping.

The structural risk runs the other direction for companies. Senior builders who can get autonomy and impact density at a Lovable-style flat org will leave to get it. Firms that ungate information access pull disproportionate talent density. Firms that protect management layers end up staffed with coordinators and no builders. The decision this quarter is which of those two companies you are building.

From 'Advanced Persistence' to 'Full Network Takeover' in One Generation

A red team operator ran the same attack range twice in eighteen months. The first run got a foothold and stalled. The second run, with Anthropic's Mythos, took the network. The UK AI Security Institute confirmed Mythos is the first model to clear both of AISI's simulated attack ranges autonomously. OpenAI's GPT-5.5-cyber cleared one of two. The prior generation capped at 'advanced persistence,' which assumed attackers needed human expertise to escalate. That assumption is dead.

Palo Alto Networks pointed these models at production code and found dozens of serious vulnerabilities across 130+ products. The window from disclosure to working exploit has compressed from weeks to hours.

The 4-Hour Exploitation Reality

PraisonAI's auth bypass CVE-2026-44338 was actively exploited within 4 hours of disclosure. An NGINX unauthenticated RCE sat undetected for 18 years in the most ubiquitous reverse proxy in production. A honeypot for exposed LLM endpoints logged 113,000+ requests per month with 23% targeting AI-specific paths, and AI-powered scanners locate new inference servers within 3 hours of deployment.

A thirty-day patch window assumes attackers take days to weaponize. That assumption is stale. The exploitation window for any CVE affecting your stack should now be measured in hours, not days.

Mozilla's Counter-Signal: AI for Defense Works

Two teams ran similar programs against Claude Mythos Preview. Mozilla's AI-assisted security program found 271 bugs in Firefox, including sandbox escapes and use-after-free vulnerabilities, using a custom agentic harness. curl's equivalent effort produced exactly 1 CVE. The model was identical. The harness was not. Mozilla invested in the surrounding infrastructure: a corpus of prior bugs, a triage pipeline, and a team deciding what counted as a real finding. The harness is the moat, not the model.

What Enterprise Buyers Will Ask Next Quarter

Congress is debating Mythos access with NSA prioritized over CISA, which signals offensive and intelligence use over civilian defense. Commercial enterprises will not be handed a government AI defender. They will buy one. The forcing function is the procurement RFP. Buyers will benchmark agent security against the published sandbox architectures from OpenAI and Perplexity: VPC isolation, scoped egress, encrypted credential management. A security story less specific than that is losing deals the vendor never hears about.