The Product Desk

What Changed This Week

A developer opened Cursor on Monday, ran the same Claude-backed workflow she ran last Monday, and got billed about ten times more for it. Anthropic announced that every Claude subscription now includes API credits equal to the plan's dollar amount — $200 plan gets $200 in credits. Pitched as generosity. For the cohort using Claude through third-party harnesses (Cursor, Cline, OpenCode, Zed, Conductor) at effective 70-90% implicit discounts to API pricing, it is a price increase by an order of magnitude. Starting June 15, third-party tool usage gets a separate credit pool. Overages bill at full API rates.

The era of subsidized AI inference through integrations is ending. What developers were doing did not change. What Anthropic charges for it did.

Why Anthropic Is Doing This Now

Anthropic hired a CFO and is likely targeting an October 2026 IPO. The previous model — where power users got enormous implicit subsidies — does not produce the revenue-per-user metrics public market investors want. Anthropic's ARR grew from $9B to $30B+ between December 2025 and April 2026. They are rationalizing pricing before the S-1 narrative tightens. Expect at least one more pricing adjustment before October.

OpenAI's Counter-Move

Sam Altman offered 2 months of free Codex to enterprise customers who switch within 30 days. That is displacement pricing, timed to Anthropic's moment of developer frustration. Criticism from Theo, Jeremy Howard, Matt Pocock, and Omar Sanseviero arrived within hours of the announcement. OpenAI lost the business adoption lead for the first time (32.3% vs 34.4% per Ramp) and is fighting to reclaim it.

The Multi-Model Reality Is Already Here

Vercel's AI Gateway data across 200,000+ production teams confirms what vendor dashboards already suggested. Heavy multi-model routing is the default pattern in large deployments. Anthropic captures 61% of spend (Opus for reasoning). Google captures 38% of volume (Flash for cheap/fast tasks). No vendor loyalty exists. Switching costs at the model layer are approximately zero when architecture supports it.

The 2x2 for This Sprint

The Headless Enterprise Bet

SAP shipped a Knowledge Graph for agent context and a €100M partner fund for Autonomous Enterprise. ServiceNow launched Action Fabric, decoupling workflow logic from UI and exposing it via MCP servers for third-party AI agent execution. Salesforce added native WhatsApp voice to Agentforce. Companies do not stand up hundred-million-euro funds for features. They stand them up for platform bets they intend to defend for years.

A procurement manager spent forty minutes last Tuesday clicking through a vendor onboarding flow. Next quarter, an agent will. She will review the result.

The Procurement Question Changed

A Fortune 500 procurement lead opened three enterprise demos this week and asked the same question in each: "Can our agents call this directly, or do my people have to click through your UI?" Two vendors had no answer; the third did, and moved to the next stage. The window before this shows up in RFPs is 2-3 quarters.

What Vercel's Production Data Confirms

Agentic workloads now account for 59% of all AI gateway token volume. Amazon killed its standalone chatbot, Rufus, in favor of an embedded agent. Notion launched a developer platform explicitly for agent tooling with pre-built agents from Ramp, Clay, and Vercel. Productivity apps are quietly turning into agent-hosting platforms.

The Integration Assessment

The actual work is smaller than the deck will suggest: a week of scoping, 2-4 weeks of build to ship an MCP server against an existing API. The harder question is whether the product's core UI should be restructured around the assumption that an agent, not a human, is the primary first-touch user for a non-trivial share of sessions. That is a roadmap question, not a sprint question.

The Diagnostic

Pull the last twenty support tickets from top-decile accounts. Count how many assume a human in the seat versus an agent doing the work. If that ratio moved even ten points toward agents in the last two quarters, the headless layer is a retention bet tied to the next renewal cycle, not a platform bet tied to the next board meeting.

Legacy bot detection has an 81% AI agent bypass rate. If a product relies on CAPTCHA or behavioral analysis to gate access, assume it is already compromised against agent traffic.

The Case Study Nobody Wanted

Kellie Romack, CDIO at ServiceNow, watched her team's full-year Anthropic budget get consumed before May 2026. She cannot tell you which users drove it, or which workloads, because Anthropic does not ship the telemetry to answer those questions. PagerDuty and National Life Group describe the same gap. Nimesh Mehta at National Life Group calls Anthropic 'great for consumer usage but not great for companies.'

The cost model is now the product risk. Token spend used to sit in a finance spreadsheet and get reviewed quarterly. That arrangement worked when AI features were pilots with capped traffic. It does not work when the feature is embedded in the workflow and usage scales with customer success.

The Measurement Gap Is Universal

Here is what teams tell themselves: we priced the feature with healthy margin over inference cost. Here is what users actually do: they find the workflow that saves two hours, and they run it 11 times a day instead of the 3 the pricing model assumed. Retention improves and usage depth climbs. Gross margin goes sideways, then down. ServiceNow built an 'AI Control Tower' internally and staffed it with a dedicated person. It now sells the tool to its own customers.

The Adoption Problem Is Equally Broken

Duolingo's CEO publicly acknowledged that the blanket 'evaluate all employees on AI usage' policy failed. AI content at scale produces approximately 20% unusable output requiring human QC, and mandating usage produced performative adoption without productivity gains. They reversed the policy. Meanwhile, 'tokenmaxxing' — employees gaming AI consumption metrics to look productive — is Goodhart's Law arriving at enterprise AI measurement on schedule.

The Services Gap

Google, OpenAI, Anthropic, ServiceNow, and Salesforce are all investing heavily in forward deployed engineers. OpenAI acquired Tomoro to staff 150 FDEs. Self-serve AI launches into enterprise without a services component should plan against roughly 20% activation. Only 15% of organizations have the data foundation for agentic AI at scale, and companies are spending millions anyway. The failure pattern is predictable: buy, fail to activate, churn, blame vendor.

The Stable Pricing Model

The only stable cell is variable cost matched to variable pricing. Everything else is a bet that usage will not grow, which is a strange bet to place on a feature the same deck is telling the board is working.

The Threshold That Crossed

A red team operator opened the UK AI Security Institute's two simulated attack ranges this month and watched Anthropic's Claude Mythos walk both — the first AI model to clear both ranges, achieving full network takeover autonomously. OpenAI's GPT-5.5-cyber cleared one of two. The previous generation stopped at 'advanced persistence.' The old threat model assumed attackers got a foothold and then needed a human to escalate. That assumption is what your detection rules are tuned against. It is no longer true.

The Exploit Window Collapsed

PraisonAI's authentication bypass (CVE-2026-44338) was weaponized 4 hours after public disclosure. Four hours is the number that retires the thirty-day patch window as a planning assumption. Palo Alto Networks, scanning with AI models, surfaced dozens of serious vulnerabilities across 130+ products.

The economics of 'accept risk' change when the cost of finding the chain drops from a week of human time to fifteen minutes of compute.

The Harness Is the Moat, Not the Model

Mozilla pointed a custom agentic harness at Firefox and surfaced 271 bugs in Firefox, including sandbox escapes, race conditions, and use-after-free bugs fuzzers had missed for years. The same model pointed at curl's 178K lines of C produced 1 low-severity CVE. Daniel Stenberg called it 'primarily marketing.' The delta is 270 bugs of harness quality: a corpus of prior bugs, a triage pipeline, and humans deciding what counts. The model was table stakes.

What This Means for Product Security

Congress is debating which agencies get Mythos access. NSA got it first, not CISA. Commercial buyers will not be handed government defenders — they will buy adjacent ones. Palo Alto and CrowdStrike are up 20% YTD. Cisco expects AI orders to jump from $5B to $9B. Enterprise procurement is now benchmarking agent security against published sandbox architectures: OpenAI's Windows sandbox, Perplexity's VPC isolation. A security story less specific than 'VPC isolation with scoped egress' is losing deals this quarter. The 2x2 for next sprint: on one axis, can you describe your isolation boundary in one sentence a security buyer will repeat. On the other, can you patch a dependency CVE inside four hours. Cells outside 'yes/yes' are the cells that lose the renewal.

The Infrastructure Is Under Active Attack Now

• LiteLLM: unauthenticated DB query vulnerability on CISA's KEV catalog (actively exploited)
• Ollama: CVSS 9.1 heap overflow in model loader
• NGINX: 18-year-old unauthenticated RCE in rewrite module
• Traefik: CVSS 10.0 authentication bypass
• OpenClaw: 6+ critical CVEs simultaneously

AI honeypot data: Shodan indexes exposed AI endpoints in 3 hours. 23% of probes target AI-specific paths. 175 active LLM-hijacking attempts per week.