The Investor

The Revenue Looks Great Until You Read the Contract

The least comfortable fact in AI investing this week is that enterprise AI ARR does not behave like SaaS ARR, and the evidence keeps arriving from buyers who would prefer it didn't. ServiceNow, arguably the most sophisticated enterprise buyer alive, blew through its full-year Anthropic budget by May 2026. National Life Group's CIO described Anthropic as 'great for consumer usage but not great for companies.' The reason is banal: there is no granular per-user telemetry, no SLAs worth the name, and no contractual switching costs anywhere in the stack.

This matters because the thirty billion dollar ARR figure everyone is marking Anthropic against assumes enterprise-grade durability, and the plumbing underneath it is not enterprise-grade.

The June 15 Margin Event

Anthropic's decision to convert every Claude subscription into a dollar-matched API credit pool eliminates the 70-90% arbitrage that third-party harnesses (Cline, OpenCode, the various Claude wrappers) have been quietly running for months. A $200/month plan now buys exactly $200 of programmatic tokens, which means no more leveraging subscription-tier access for production-scale inference at a fraction of API rates.

OpenAI answered within days with two months of free Codex for enterprise switchers. Set against Ramp's April data showing Anthropic at 34.4% of business spend versus OpenAI at 32.3%, this looks like a subsidy war timed to pre-IPO margin recovery. Or rather, the more interesting version: a subsidy war both sides need to be seen losing money on, for different reasons.

Every Claude-dependent portfolio company whose unit economics were built on subscription-tier token access has lost 20-40% of runway since last Friday, a change that is four days old and which most founders have not yet flagged.

The Deployment Services Arms Race Confirms It

The industry has quietly conceded what Palantir proved twenty years ago, which is that deployment is the bottleneck, not model capability. Google is hiring hundreds of forward-deployed engineers, OpenAI stood up DeployCo with Bain, and Salesforce and ServiceNow are staffing the same function under different names. When four firms independently decide the margin lives in deployment services, the margin lives in deployment services.

The second-order effect is a new category — AI observability and FinOps — validated by ServiceNow's own AI Control Tower selling into the same customers panicking about their Anthropic bills. The company that burned its budget is now selling the budget-monitoring tool, which is not coincidence so much as a CDIO who watched the category form inside her own P&L and decided to charge for the lesson.

What This Means for the Book

The under-discussed risk is the reversibility of enterprise AI spend: absent SLAs there are no switching costs, absent usage telemetry there is no early warning, and FOMO-driven procurement (which describes most 2025-2026 AI spend) produces a cliff-shaped risk profile rather than the smooth retention curves SaaS multiples assume. This is probably wrong in a handful of names, but the working rule is to apply a 20-40% reversibility discount to any LLM-layer ARR where SLAs and telemetry are absent.

59% Is Not a Thesis. It's the Base Rate.

Vercel published the first production-grade AI Gateway index this week — not a lab benchmark, not self-reported ARR, but downstream production data across 200K+ teams. The headline: agentic workloads now carry 59% of all token volume. The chat-completion era is officially the minority case in production.

More revealing is the spend-versus-volume bifurcation. Anthropic captures 61% of spend via Opus on premium reasoning calls. Google takes 38% of volume via Flash as commodity throughput. These are two different businesses emerging inside what everyone has been calling 'foundation models.' The pricing power lives with Anthropic. The scale lives with Google. Multi-model routing is not a sophistication — it's the default architecture.

The Incumbents Are Moving First This Cycle

Unlike the cloud transition where AWS and Azure defined infrastructure while ERPs caught up late, this time the incumbents are moving first:

• SAP committed €100M to an Autonomous Enterprise fund with Nvidia and Microsoft wired in
• ServiceNow shipped Action Fabric — headless APIs designed for agents to consume, decoupling logic from UI
• Notion launched a developer platform hosting Claude, Codex, Cursor, Decagon, Warp, and Devin as teammates
• Airtable launched Hyperagent with a $10M inference credit program targeting 500 founders

This means the question of where agent-layer value accrues looks materially different from the cloud parallel. Pure-play agent orchestration layers face absorption risk from both below (model labs climbing up) and above (workflow platforms climbing down).

The window for agent infrastructure at reasonable Series A pricing is 2-3 quarters. After that, SAP's corp dev team, Notion's platform, and Anthropic's own tooling absorb the category into existing surfaces.

The a16z GTM Thesis Sharpens the Allocation

a16z published its full GTM thesis with a live check (Stitch): the system of intelligence layer captures majority value over the system of record. The Lemkin proof point makes the economics concrete: Salesforce from 10+ human seats to 2 humans + 1 API seat, while spend rose 83% ($12K → $22K) and 20+ agents run on top. The seat count collapsed. The bill went up.

The investable wedge is narrow: vertical-specific orchestration layers with institutional-context accumulation. The moat has migrated from data gravity to orchestration gravity — institutional context, workflow memory, and multi-system synthesis are the new lock-in. Horizontal 'AI copilot for sales' plays walk straight into Salesforce's API-first counter-punch.

What Survives Absorption

Three characteristics define what the incumbents cannot replicate in a quarter: (1) proprietary action surfaces — a regulated workflow, a dataset, an integration graph; (2) accumulated institutional context that compounds with usage; (3) vertical depth the incumbent's horizontal platform cannot be bothered to defend. Everything else is a feature waiting to be shipped.

LiteLLM Lands on the KEV Catalog

CISA added LiteLLM, an AI Gateway routing control plane, to its Known Exploited Vulnerabilities catalog this week. This is the first time an LLM-routing component has been federally flagged as actively exploited. Combine that with Ollama's GGUF model-loader bug (CVSS 9.1, data exfiltration via malicious model files) and OpenClaw shipping six critical CVEs in a single cycle, and the AI-infra stack sits at roughly the security maturity of enterprise SaaS in 2014.

This looks like a vulnerability story and is not. Or rather, the more interesting version is that it is the regulatory validation event that turns "AI security" from a pitch slide into an enterprise budget line with procurement authority attached.

Concurrent Disruption Signals

The category is being disrupted from three directions at once, and the wedges do not all have to clear for the thesis to work.

Economics: DepthFirst's Open Defense Initiative landed FFmpeg, Envoy, and Kata as anchor tenants, claiming 12 memory corruption bugs for ~$1,000 in compute versus Anthropic's Mythos missing the same bugs at ~$10,000 across hundreds of scans. If the 10x claim holds at scale, wrapper economics collapse for anyone building security workloads on rented frontier-model time.

Platform absorption: OpenAI's Daybreak launched with Cloudflare, Cisco, CrowdStrike, Palo Alto Networks, Oracle, Zscaler, Akamai, and Fortinet listed as "partners." That is the pre-disintermediation pattern, every incumbent named as a friend in the quarter before the platform eats them.

Autonomous discovery at scale: Microsoft's MDASH produced 16 validated Windows CVEs in a single Patch Tuesday, the first auditable evidence that multi-model vulnerability discovery works at hyperscaler production scale rather than in conference demos.

When attackers weaponize AI-framework CVEs in 4 hours (PraisonAI) and defenders need weeks to patch, the economics of selling security on a human-speed cadence break. The fundable layer is the one that matches machine speed.

The Investment Map

The category splits into four fundable wedges, and the diligence test on each is whether the moat is harness design or merely model access.

1. AI-gateway security: MCP firewalls, LLM posture management, model-artifact scanning. LiteLLM on KEV is the "MongoDB ransomware moment" that creates enterprise procurement authority.
2. Autonomous vulnerability discovery with specialized harnesses: the Mozilla-versus-curl delta is the diligence test. Mozilla found 271 Firefox bugs with a custom agentic harness; Mythos found 1 real CVE in curl with a generic scan. Harness design is the moat, not model access.
3. Agent runtime security: an 81% bot-detection bypass rate plus 4-hour exploit windows on AI frameworks equals a defender-empty category with near-certain demand.
4. Supply-chain provenance: Shai-Hulud's leaked source documents industrial-grade Sigstore forgery. The current trust chain is known-breakable.

EDR Moat Erosion

TrustedSec ran LLMs against five commercial EDRs and compressed reverse engineering from weeks to days; all five products rest on identical architectural furniture (YARA rules, Lua engines, local ML classifiers). Current multiples on CrowdStrike, Palo Alto, and SentinelOne are priced for the old moat. Detection-rule IP is becoming a commodity input. This is probably wrong on timing, but the durable positions look like distribution, data scale, and harness-heavy integration layers.