The Investor

The Revenue Quality Problem Nobody Wants to Name

ServiceNow, one of the most sophisticated enterprise software buyers on the planet, exhausted its full-year Anthropic budget by May 2026. Not because Claude underdelivered. Because Anthropic ships no granular per-user or per-tool telemetry, no SLAs worth the name, and no enterprise dashboard that would have passed muster at a mid-tier SaaS vendor in 2014. National Life Group's CIO put it plainly: Anthropic is 'great for consumer usage but not great for companies.'

This lands the same week Anthropic conceded it planned for 10x growth and got 80x, which is how you end up leasing the entire Colossus 1 cluster (220K+ GPUs) from Elon Musk's xAI. The same Musk who recently called Anthropic 'misanthropic and evil.' When you are renting compute from a declared enemy, the word for your situation is not glut. It is a shortage that bends strategy.

The June 15 Margin Event

On June 15 Anthropic converts every Claude subscription into a dollar-matched API credit pool. Two hundred dollars of subscription buys exactly two hundred dollars of programmatic tokens, which kills the 70-90% arbitrage that Cline, OpenCode and OpenClaw were running against subscription-tier usage. OpenAI answered inside the day with two months of free Codex for enterprise switchers.

Every Claude-wrapper portco whose COGS assumed subsidized subscription tokens just lost 20-40% of effective runway. The change is four days old; founders may not have flagged it yet.

The interesting framing is that this is a margin-recovery move explicitly timed to IPO diligence. A new CFO, credit unbundling, and a likely October target add up to a textbook pre-book cleanup. Anthropic is trading short-term developer goodwill for public-market-ready margins. There is a version where developer churn matters more than the margin print. Probably not the version the bankers are pitching.

The Observability Gap Is the Category

Four firms independently reached the same conclusion this week: deployment is the bottleneck, not model capability. Google Cloud is hiring hundreds of forward-deployed engineers. OpenAI stood up DeployCo with Bain. Salesforce and ServiceNow are staffing the same function. The industry has quietly conceded what Palantir worked out twenty years ago.

Meanwhile ServiceNow is selling its AI Control Tower to the same customers panicking over their Anthropic bills, which is not coincidence so much as a CDIO who watched a category form inside her own P&L and decided to be the vendor rather than the line item. Modal at $4.5B and the rest of the AI FinOps layer are being born out of one failure mode.

The Investable Layer

• AI observability / FinOps — token-level cost attribution, per-user caps, SLA monitoring across model APIs. No category winner yet. 6-12 month sourcing window.
• Deployment-services tooling — productizing 60% of FDE work (context ingestion, eval harnesses, workflow templates).
• Vertical AI with contractual lock-in — in a world where horizontal LLM spend reverses quarterly, vertical AI with data moats gets structurally more valuable.

The Category Formation Event

Three moves landed in the same week that, taken together, draw the autonomous enterprise as a funded category rather than a deck slide. SAP put €100M into an Autonomous Enterprise partner fund, wiring NVIDIA and Microsoft into the platform layer. ServiceNow shipped Action Fabric, which decouples workflow logic from UI and exposes it as headless APIs for agents to call. And a16z published its system-of-intelligence thesis, arguing that most next-decade GTM enterprise value migrates from the system of record (Salesforce at $140B, HubSpot at $9B) to the orchestration layer, and wrote a check to Stitch to back the argument with money rather than prose.

When SAP underwrites a thesis with a hundred-million-euro fund and ServiceNow simultaneously ships a headless architecture built for third-party AI agents, what you are watching is the autonomous enterprise category being drawn by the incumbents before the pure-plays get to name it.

Vercel's Production Data: Agents Are the Majority Case

Vercel published the first production-grade index of real AI usage across more than 200,000 teams. The numbers do most of the work:

• 59% of token volume is now agentic workloads, which is the base case rather than the upside case
• Anthropic captures 61% of spend, paid for premium long-context agent calls
• Google captures 38% of volume, absorbing the commodity high-throughput tier

Two different businesses are now visible inside what people kept calling 'foundation models.' Anthropic is being paid a premium for tool-using agent calls. Google is absorbing cheap throughput that looks excellent on a volume chart and considerably less excellent on a margin table. Multi-model routing is the enterprise default, not a sophistication.

The Platform Tax Arrives

Apple is building agent governance directly into the App Store, blocking agents from spinning up sub-apps outside review and defending the 30% fee on agent-mediated transactions. Google's Gemini Intelligence embeds autonomous task execution into Android at the OS level. Both moves reprice every pure-play mobile agent startup whose GTM assumed distribution was free, which is most of them.

The a16z proof point earns its own paragraph. Jason Lemkin cut Salesforce from 10+ human seats to 2 humans + 1 API seat, while spend rose 83% ($12K → $22K) with 20+ agents running underneath. Seats collapsed, the bill went up, and that is the consumption-based GTM pitch delivered in a single customer. A sample size of one, which is how every thesis starts.

Where Alpha Remains

The counter-thesis is straightforward: incumbents absorb this functionality in one quarter rather than two, and the window closes before Series A checks clear. That has happened before in enterprise software. It is also not what SAP's €100M or ServiceNow's architecture choices suggest, both of which read as explicit admissions that the incumbents need external help.

The Production Threshold

LiteLLM hit KEV the same week MDASH shipped sixteen CVEs and DepthFirst beat Mythos ten-to-one on FFmpeg, which is enough to move AI security from conference track to enterprise line item with unusual specificity. LiteLLM's AI Gateway landed on CISA's Known Exploited Vulnerabilities catalog, the first LLM-routing control plane federally flagged as actively exploited. Microsoft's MDASH multi-model system shipped 16 validated Windows CVEs in a single Patch Tuesday cycle, which is the first auditable evidence that autonomous vulnerability discovery actually works in production rather than at conferences. And DepthFirst's Open Defense Initiative found twelve memory corruption bugs in FFmpeg for roughly a thousand dollars of compute, against Anthropic's Mythos missing the same bugs at about ten thousand.

When a routing layer hits KEV, the procurement consequence is concrete: a CISO now has a documented, federally-listed exploited control plane to point at, which is the first defensible reason to cut an enterprise check specifically for AI infrastructure security.

The Bifurcation: Offense vs. Defense Economics

Two economics are forming at once and they do not rhyme. On offense, capability is compounding faster than anyone modeled, with AI cyber tasks breaking above the 'doubling every few months' trendline to the upside. Anthropic's Mythos cleared both UK AISI simulated attack ranges as the first model to do so, and Congress routed access through NSA — not CISA. That routing matters more than the clearance does. Intelligence-community procurement runs on different budgets and meaningfully higher margins than civilian defensive distribution, with a different buyer attached.

On defense, the attack surface is expanding at machine speed. A single AI honeypot absorbed 113K+ requests in a month after Shodan indexed it within three hours. PraisonAI's CVE was weaponized within four hours of disclosure. And the Shai-Hulud supply-chain framework was open-sourced under MIT, documenting industrial-grade Sigstore provenance forgery and OIDC token extraction from GitHub Actions runner memory.

The Incumbent Moat Is Cracking

TrustedSec ran LLMs at five commercial EDRs and found that reverse engineering which used to take weeks now takes days, because all five products share the same architectural furniture (YARA rules, a Lua engine, local ML classifiers). In the same week, OpenAI launched Daybreak with Cloudflare, CrowdStrike, PANW, Cisco, Zscaler, Akamai, and Fortinet listed as 'partners.' The partner list is the tell. It is the pre-disintermediation setup that has played out in four prior enterprise software waves, and the partners on that list have presumably read the same history.

The Investment Map

The diligence question for any AI AppSec pitch, or rather the only one that matters: does the harness produce 271 bugs (Mozilla's Firefox result) or 1 bug (Mythos on curl)? The difference is the harness investment, not the model. Fund harnesses, not wrappers.