The Scientist

The Pricing Reset

Anthropic converted every Claude subscription into a dollar-matched API credit bucket. The implicit 70-90% discount teams were getting by running Agent SDK, GitHub Actions, or third-party harness workloads against a $200 Max plan is gone. Starting June 15, third-party tool usage (Zed, Conductor, OpenCode, T3 Code) draws from a separate credit allocation with no rollover and overflow at API rates. Any cost model built before this date is numerically wrong, not approximately wrong.

ServiceNow's CDIO publicly confirmed they burned their full-year Claude budget by May after the price hikes. The thing this doesn't tell you is how much was preventable: Anthropic ships no native per-user, per-tool usage telemetry, and no SLAs on latency or availability. You cannot attribute spend you cannot measure.

The Capacity Story Behind the Price Story

Dario Amodei at Code with Claude admitted they planned for 10x growth and got 80x in revenue and usage. That 8x forecast error explains the degradation reports from the last several weeks. What users were reading as model regressions was a capacity wall. The emergency fix is leasing xAI's entire Colossus 1 cluster (220,000+ GPUs spanning H100, H200, and GB200) from the CEO who called Anthropic 'misanthropic' three months ago.

Any Claude benchmark from before May 7 is stale. Re-baseline after the new caps land, not before — otherwise the delta you attribute to a prompt change is mostly capacity noise.

The OpenAI Counter-Offensive

Hours after the metering announcement, OpenAI dropped a 2-month free Codex enterprise switch promo. Ramp's April data showed the first-ever Anthropic lead at 34.4% vs 32.3%, so OpenAI is pricing a direct assault on the developers Anthropic just alienated. Treat this as an asymmetric-payoff evaluation window: free head-to-head data on workloads you actually run, not on someone else's leaderboard.

What This Means for Your Stack

The combined read across nine sources: single-provider Claude dependency carries unpriced risk, and the forecast-error bound on that risk is now 8x. Anthropic is targeting an October IPO with a CFO hired specifically for margin improvement. The base rate says pricing stays sticky or rises from here.

The Production Data

Vercel's AI Gateway index, drawn from 200,000 teams over 7 months, puts agentic workloads at 59% of all token volume. That is measurement, not forecast. Anthropic captures 61% of spend through Opus. Google captures 38% of volume through Flash. The data shows no vendor loyalty. Customers route by task.

The spend-versus-volume gap is the structural read: expensive models do the planning and reasoning nodes, cheap models do the high-throughput utility calls like retrieval rewriting, extraction, and classification. Teams paying Opus rates for every agent step are overspending on the 59% of calls that do not need it.

Why Single-Turn Evals Are Now Dangerously Misleading

Most eval harnesses in production still score single-turn responses against a reference answer. That was the right design in 2023. Once the median request is a multi-step tool loop with retries, the metric you want is different:

Sayash Kapoor's framing is the cleanest version of this: outcome-only metrics systematically underestimate failure modes in capable agents. Stronger agents surface benchmark bugs and reward-hacking paths that weaker agents never reach. The pass@1 curve flattens at exactly the point where real reliability starts to diverge. The thing pass@1 doesn't measure is the long tail you will actually ship into.

The Production Reference Architecture

Abridge (80M+ clinical conversations, 250 health systems, $5.3B valuation) has disclosed enough to lift the pattern: cheap fast model for triage, expensive model for reasoning, confidence-gated routing, LLM judges calibrated against human annotators quarterly, memory externalized into event stores. Microsoft's MDASH reports the same decomposition on the security side, with scan, debate, and exploit stages beating monolithic approaches on CyberGym.

A router that treats every call as independent is leaving money and latency on the table once a meaningful fraction of traffic is agentic. Session-aware routing and tool-calling reliability matter more than MMLU deltas.

The Glean benchmark claiming MCP uses 30% more tokens than a retrieval-tuned knowledge graph is vendor-published with no methodology, so treat the magnitude as untrusted. The direction matches what the production traces show: naive tool listings balloon context windows. I would expect the real number to land somewhere south of 30% on a clean rerun, but still positive enough to matter.

The New CVEs Landing on the Data Stack

This week's advisory cycle concentrates on infrastructure data teams actually run in production. The LiteLLM KEV entry was flagged earlier this week. Three new critical CVEs landed that target lakehouse and MLOps infrastructure directly, which is a different class of problem.

Why Iceberg CVE-2026-42812 Is the One That Matters

An attacker with table-write permission can redirect metadata pointers at an attacker-controlled S3 prefix. The next query reads poisoned Parquet. The next training run ingests silently corrupted features and produces a model that looks fine on the eval set. The thing standard lakehouse observability doesn't cover is pointer changes; it covers row changes, not pointer changes. Most monitoring stacks will not see this.

Combined with the Polaris credential-broadening issue, the plausible path runs from "compromised analyst notebook" to "cross-tenant data theft."

Draw a reference architecture for a modern data team, throw darts at it, and every throw hits a CVSS of 9.0 or higher.

Argo CD: Model Registry Tokens Are Exposed

The missing-authorization flaw lets low-privilege users extract plaintext Kubernetes Secrets in reachable namespaces. For teams running model services or training jobs through Argo CD 3.2 or 3.3, that set includes model-registry tokens, HuggingFace PATs, database passwords, and cloud credentials. Rotation costs more than the patch. Skipping it is not a defensible decision.

The Pattern

These are not obscure memory-corruption bugs in C libraries. They are authorization failures and unsafe input handling in Python, Go, and Java tools that shipped fast. ML infrastructure was built at startup velocity and is now getting the security attention web frameworks got a decade ago. CISA is tracking AI-infra exploits the way it tracks Exchange or Ivanti. The downstream effect, predictable enough to underwrite, is procurement friction on anything LLM-adjacent for the next few quarters.

Three Results That Move the Budget

Three research drops landed the same week, each aimed at a different line item in the training compute bill. Read together, the marginal dollar in model development is moving from raw FLOPs toward training recipes and data curation. That is a claim about where to spend, not a claim that compute stopped mattering.

What Each Means for Your Roadmap

TST is the one to spike first. Token Superposition Training is a pretraining recipe change with no inference-side architecture change. If it replicates at even 1.6x on a continued-pretraining run with no val-loss regression, it pays for itself on the next full run. The mechanism — superposing multiple token targets per forward pass — is clean, and the authors validated it from 270M up to 10B MoE. The thing this doesn't tell you is how it behaves on your data mix at your context length, which is where most pretraining recipes lose half their reported gain.

Datology is the clearest evidence this year that the marginal VLM dollar has moved from compute to curation. Their 2B model beats InternVL3.5-2B by about 10 points at 17x less training compute, through data selection and mixture optimization alone. At 4B params, they reach near-frontier quality at 3.3x lower response FLOPs than Qwen3-VL-4B. The training cost number is interesting; the response FLOPs number is what shows up on the serving bill.

Star Elastic's 360x number is the kind of claim that always shrinks under independent eval. Given the setup, I expect it to hold up by roughly an order of magnitude less on third-party benchmarks. Even a 30x retention would change how teams produce size tiers. One post-training run yielding a family from 1B to 70B is categorically different from training each size independently.

TST requires no inference-time changes. Datology requires no model architecture changes. Both are 'free' efficiency wins conditional on reproduction — and both are cheap enough to spike this quarter.

The Data Curation Thesis

Datology's result sits alongside the Fivetran readiness index, which finds that only 15% of organizations have the data foundation for agentic AI, with about 50% citing data quality and lineage as the top blocker. The correlation is suggestive, not causal: bigger models still help, and curated data is partially a proxy for teams that know what they are doing. The lakehouse stats gap compounds the problem. Iceberg, Delta, and Parquet treat column-level stats as optional, and stale or missing stats produce plans that cost 3x what they should without surfacing a hard error. That last failure mode is the one to instrument first, because it does not show up on any leaderboard.