The Scientist

The New Economics

The Claude pricing changes this week compound; the metering shift is the load-bearing one, and three things landed together:

1. Programmatic metering: Claude subscriptions now convert to dollar-matched API credits for Agent SDK, claude-p, GitHub Actions, and third-party harnesses. The implicit 70-90% subsidy on alternative-harness usage is gone.
2. June 15 third-party credit separation: Usage through Conductor, Zed, OpenCode, and T3 Code gets a separate credit bucket. No rollover, overflow at API rates. Weekly limits bumped 50% as a two-month softener.
3. Capacity-driven degradation: Dario admitted planning for 10x and getting 80x. Rate limits doubled this week, peak-hours throttling removed for Pro/Max, Opus limits 'substantially raised' — all signs that the serving fleet was oversubscribed.

The Capacity Fix That Changes Your Baseline

Anthropic is absorbing xAI's Colossus 1 cluster: 220,000+ GPUs spanning H100, H200, and GB200. That is roughly 45% of xAI's current capacity moving providers overnight. The integration will produce heterogeneous serving infrastructure, which means p95/p99 latency will get weirder before it stabilizes.

Any Claude benchmark from before May 7 is stale. The serving conditions just shifted again, and the serving conditions will shift once more when Colossus integration completes.

ServiceNow's CDIO burned through the full-year Claude budget by May. National Life Group's CIO called Claude 'great for consumer usage but not great for companies' wanting per-user monitoring. Anthropic provides no native per-user telemetry, no SLAs on latency or availability, and no budget alerts. The thing benchmark numbers don't tell you is whether you can attribute spend to a team; here you cannot. The observability gap is structural, not a bug to be fixed next sprint.

The Competitive Counter

OpenAI dropped a 2-month-free Codex enterprise switch promo the same day Anthropic metered usage. Ramp's April data shows Anthropic 34.4% vs OpenAI 32.3% — the first apparent lead change in business adoption. OpenAI is explicitly pricing against the developers Anthropic just alienated.

The asymmetry is the part that decides this. OpenAI's promo is a free evaluation window with zero downside risk. Anthropic's change is an immediate cost increase for any team that was leveraging the subsidy. A two-month free trial is cheap signal; not running it leaves the comparison unmeasured.

The Production Data

Vercel's AI Gateway telemetry — 200,000 teams, 7 months — now puts agentic workloads at 59% of token volume. Six months ago that share was under 20%. The composition has shifted faster than anything since completion-to-chat, and most production stacks were built before the shift started.

The spend-versus-volume gap is where the architecture leaks through:

Read it as tiered routing already in the wild: expensive models for planning, cheap models for throughput. The code should reflect what the traffic is doing.

Why Single-Turn Evals Are Now Dangerous

Agentic traces are multi-turn, tool-calling, bursty, and dominated by long contexts with small output deltas. Cost models pinned to a 3:1 input-output ratio are off by roughly 5x. Real agentic traffic runs closer to 15:1 on input, with aggressive cache reuse on some providers and none on others. A forecast that averages over that produces asymmetric errors by vendor, not a uniform miss.

If 59% of your tokens are agentic but 100% of your evals are single-turn, you're flying instruments-out.

The CyberGym result lines up with this. Microsoft's MDASH (100+ agent ensemble) beat Anthropic's Mythos by decomposing tasks into scan, adversarial debate, and PoC stages. The multi-agent topology won the leaderboard. The thing this doesn't tell you is whether the lift came from the decomposition or the agent count, because no ablation has been published. At production inference budgets I expect about half the benchmark gain to survive, and would not commit to migration on more than that.

MCP Overhead Is Real but Measurable

Glean reports off-the-shelf MCP burning 30% more tokens and losing 2.5x head-to-head against a retrieval-tuned knowledge graph. The number is vendor-published with undisclosed methodology, so treat it as directional. The failure modes it points at are real: MCP tool listings inflate context, and naive tool outputs return verbose blobs where a reranked snippet would do. Measure on your own corpus before you price the gap.

Where the in-house/API crossover moves

Three results landed this week, each touching a different stage of the training pipeline. Together they shift the point at which proprietary post-training beats frontier API calls.

TST is the one to replicate first

Token Superposition Training is a pretraining recipe change with no inference-side cost. If it replicates at even 1.6x on a matched-FLOPs baseline, it pays for itself on the next full run. The mechanism, training on superimposed token representations, is validated across two orders of magnitude in model size. The thing this doesn't tell you is whether the speedup holds at the scale you actually train at; the encouraging signal is that the trend is consistent across the sizes they tested. No architectural change at inference means the deployment path is clean.

Datology: curation displaces compute

The Datology result is the clearest evidence this year that the marginal dollar in VLM training has moved from compute to curation. At 2B parameters, their curated dataset beats InternVL3.5-2B by about 10 points on 20 benchmarks using 17x less training compute. The near-frontier 4B model reports 3.3x lower response FLOPs than Qwen3-VL-4B. That last number is a serving-cost win, not just a training one, which is the number worth tracking because it recurs every request.

Star Elastic: model families on one post-training run

NVIDIA reports that one post-training run produces a family of reasoning model sizes at 360x lower cost than pretraining each individually. Headline numbers from labs usually compress under independent eval. Given the numbers in the paper, I expect this to hold at closer to 30x once someone outside NVIDIA runs it. 30x still restructures how teams produce size tiers for edge-vs-cloud deployment.

If TST replicates at even half the claimed speedup, and Datology's curation-over-compute thesis holds, the case for in-house post-training on proprietary data gets materially stronger against frontier API rates.

This connects to Abridge's production architecture: 80M+ clinical conversations, a constellation of models, a dedicated post-training team. The implicit claim is that at sufficient data scale, vertical post-training beats frontier-model calls on cost and latency for narrow tasks. The threshold question is volume. At low volume, the frontier API wins because you avoid maintaining the pipeline. At Abridge's scale the math is straightforward. These three results lower the crossover point for everyone in between.

The Pattern

This week's advisory is not generic patch noise. It is a direct hit on the modern data and ML architecture. Sketch the reference stack (lakehouse → orchestrator → inference gateway → agent framework → CD pipeline) and every layer shipped a CVSS 9.0+ vulnerability this cycle.

Priority Patching Order

Why Iceberg/Polaris Is the Scariest

CVE-2026-42812 lets an attacker with table-write permission point metadata at an attacker-controlled S3 prefix. The next query reads poisoned Parquet. The next training run ingests silently corrupted features. The thing default lakehouse observability doesn't tell you is whether a pointer mutated; it tracks row changes. Combined with Polaris credential-broadening, there is a plausible path from compromised analyst notebook to cross-tenant data theft to training data poisoning, with none of it tripping standard alerts.

The 18-year NGINX RCE is a useful reminder that 'battle-tested' and 'audited' are not the same word. Every model-serving gateway behind NGINX is in the blast radius.

PraisonAI: The 4-Hour Window

PraisonAI was weaponized within 4 hours of CVE disclosure. That is not a patching window. It is a containment window. Agent frameworks inherit the attack surface of every tool they wire together, plus a new surface from prompt-mediated control flow, and maintainers are not staffed like the security teams at the vendors whose APIs they wrap. LangChain, CrewAI, and AutoGen sit in the same bucket until measured otherwise.

Update on LiteLLM (covered Tuesday): remains on CISA KEV as actively exploited. If you patched, verify key rotation completed. If you didn't, assume exfiltration.