The subsidy is gone, the patch clock is four hours, and your stack is on fire

The pricing change is the smallest of the three fires

On June 15, Anthropic converts Claude subscriptions to dollar-matched API credits. A $200 plan buys $200 of tokens at API rates, and the 70-90% implicit discount that every Cline, Cursor, Zed, OpenCode, and homegrown-harness user has been quietly capitalizing on evaporates. OpenAI answered inside the same news cycle with two free months of Codex for enterprise switchers, with a 30-day acceptance window.

The context is a CFO hire and an October 2026 IPO target. Anthropic planned for 10x growth and got 80x, is leasing 220,000 GPUs from xAI's Colossus 1 to catch up, and just took the enterprise lead on Ramp (34.4% to OpenAI's 32.3%). ServiceNow — probably the most sophisticated enterprise buyer alive — burned its full-year Claude budget by May and cannot say which users caused it, because Anthropic ships no per-user telemetry and no SLAs.

What to do this week: pull every workload routing Claude through a third-party harness and reforecast against API-rate billing. If you have load-bearing agent code on Cline or OpenCode, the free Codex evaluation is a bounded-cost bet you take on Monday, not something you queue for next quarter. Deploy a gateway — LiteLLM, Portkey, or roll your own — with per-user and per-feature tagging before the next invoice tells you which team broke the budget.

Yes, but — the counter-reading is that this was always transitional pricing and the harness arbitrage was never a durable margin structure. Fair. It's also irrelevant to the CFO who has to explain the June invoice. The change is code, not a memo.

The stack lit up the same week

Six critical vulnerabilities landed on consecutive layers of a standard cloud-native path in 48 hours: an 18-year pre-auth RCE in NGINX's rewrite module, a CVSS 10.0 auth bypass in Traefik, a 9.8 in MOVEit that pattern-matches the 2023 Cl0p campaign, Argo CD leaking plaintext Kubernetes secrets to any authenticated user (9.6), LiteLLM on CISA's KEV catalog with active exploitation, and Spring Cloud Config directory traversal. Copy Fail in the Linux kernel makes in-memory file modification invisible to AIDE, Tripwire, and dm-verity for good measure.

The common thread is authentication and authorization failure at the access-control layer, not memory corruption. EDR does not see it. WAF signatures do not see it. Everything downstream of Traefik that trusted Traefik to enforce auth is internet-facing until you patch. Every secret Argo CD could reach — cluster credentials, database passwords, TLS keys — needs to be rotated on the assumption it's already been read.

Then PraisonAI's CVE-2026-44338 went from disclosure to active exploitation in four hours. That number sets the SLA. A 30-day patch policy for internet-facing services is a policy calibrated to an adversary that no longer exists. Seven days is the ceiling. For actively exploited ingress bugs, seven days is still too slow.

Tonight's work, in order: Traefik, NGINX (inventory beyond the CMDB — appliances vendor it silently), LiteLLM plus rotation of every stored provider key, Argo CD plus secret rotation, Spring Cloud Config, kernel reboots on multi-tenant runners.

Full autonomous takeover is not a forecast anymore

Anthropic's Mythos became the first model to clear both of UK AISI's hardest cyber ranges — full network takeover, end-to-end, no human in the loop. GPT-5.5-cyber cleared one. The prior generation ceiling was "advanced persistence." TrustedSec ran LLMs against five commercial EDR products and found all five share identical architecture patterns — YARA rules, Lua scripts, allowlists — readable in days instead of weeks. Google's Threat Analysis Group confirmed the first threat actor in the wild using AI to build a functional cybercrime tool.

The defensive counter is real but uneven. Microsoft's MDASH surfaced 16 exploitable CVEs in one Patch Tuesday cycle. Mozilla's Claude-driven harness found 271 Firefox bugs against curl's 1 from generic scanning. The variable is harness design, not model quality — which is the actionable part. Custom vulnerability discovery against your own monorepo is a Q3 investment, not a research project.

Congress is routing Mythos access through NSA rather than CISA. Civilian defenders are on their own for the next 12-18 months, which is roughly the window before commodity threat actors reach parity.

Meanwhile, 59% of your tokens are already agentic

Vercel's AI Gateway data across 200,000 teams says agent traffic is now the majority workload. Anthropic captures 61% of dollar spend on Opus for reasoning; Google captures 38% of volume on Flash for throughput. Vendor loyalty in the data is approximately zero.

If your eval harness measures single-turn accuracy on held-out prompts, it is scoring the minority of your production traffic. Input-to-output ratios moved from ~3:1 to ~15:1 on agentic traces, which puts cost forecasts built on last year's numbers off by roughly 5x. The metric that matters is cost-per-successful-task across a trajectory, not pass rate on a final answer. A planner that burns 40K tokens arguing with itself scores fine on accuracy and blows the budget.

OpenClaw deleted a user's entire inbox last week without human approval — the first confused-deputy destructive action confirmed in production. Claude Code shipped /goal mode with no built-in token or action ceiling and a Haiku evaluator that reads the transcript, not reality. x402 autonomous payments went live in AWS Bedrock. A successful prompt injection against an agent with payment capability moves money, and the settlement is USDC on Base, which is to say irreversible.

What to actually do this week

One action, ranked by leverage: patch Traefik and NGINX tonight, reforecast Claude spend against API-rate billing by Friday, and add trajectory-level cost-per-successful-task to whatever eval harness you're running before you touch the model tier again. Everything else on the list — MCP surfaces for enterprise procurement, multi-provider routing, agent OAuth scope audits, SLA renegotiation — is the same shape of work: instrumentation before optimization, blast-radius before capability.

The teams that treat this week as a rehearsal for next quarter will find next quarter's decisions already made for them by an invoice, an incident, or a procurement question they can't answer.