Anthropic rented 220,000 GPUs from an enemy — and that's the second story

The loudest number this week is 80x. Anthropic planned for 10x growth and got 80x, and the patch is leasing the entire Colossus 1 cluster — 220,000+ GPUs including GB200s — from Elon Musk's xAI, the company whose CEO called them misanthropic and evil three months ago. Rivals do not rent capacity to declared enemies in a glut. That deal is the tell. Compute scarcity is real, xAI is quietly exiting the frontier race to become a landlord, and any book still carrying it as a frontier lab is carrying something else.

The second-loudest number is June 15. Starting that day, Claude usage through third-party tools — Zed, Conductor, OpenCode, Cline, T3 — moves to a separate credit pool capped at plan value, with overflow billed at API rates. The 70-90% implicit subsidy that harnesses have been quietly running on disappears. A $200 plan that was covering $1,500-2,000 of effective API usage now covers $200. If your unit economics were built on that arbitrage, your COGS model broke last Friday and you have not noticed yet.

And the third number, which is really the first one: 59%. Vercel's AI Gateway, across 200K teams, now reports that 59% of production token volume is agentic. The single-turn chat era is the minority case. Anthropic captures 61% of spend on Opus for reasoning; Google captures 38% of volume on Flash for cheap throughput. Every eval harness scoring pass@1 on curated prompts is measuring the minority of the traffic it claims to represent.

The security stack picked the same week to fall apart

An 18-year-old unauthenticated RCE in NGINX's rewrite module. Traefik CVSS 10.0 auth bypass — every middleware behind it is decorative. Argo CD leaking plaintext Kubernetes secrets to read-only users. LiteLLM on CISA's KEV catalog, actively exploited. MOVEit at 9.8, in a pattern that matches the 2023 Cl0p campaign exactly. Apache Iceberg at 9.9, letting an attacker redirect table metadata to attacker-controlled S3 so the next training run ingests silently poisoned Parquet.

Chain them and the credentials required are zero. Traefik bypass reaches an internal service, Spring Cloud Config reads cloud creds, Argo CD extracts K8s secrets, Iceberg poisons the next training run. Every layer of a standard cloud-native deployment took a CVSS 9.0+ hit in the same cycle.

The compounding factor: PraisonAI went from disclosure to active exploitation in four hours. UK AISI confirmed that Anthropic's Mythos cleared both end-to-end cyber ranges — full network takeover, autonomously, one generation past the prior ceiling of "advanced persistence." TrustedSec ran LLMs against five commercial EDR products and found they share identical architectures now reverse-engineerable in days, not weeks. The endpoint detection agent your budget is anchored to just became transparent to a materially larger threat population.

Yes, but — the counter-read is that Mythos is gated to select partners, EDR vendors will ship harder obfuscation, and 30-day patch cadences have survived worse capability jumps before. Fair. But four hours is not a capability jump. It is a shipped tempo, and the compensating controls that matter over the next 18 months — identity, network telemetry, behavioral analytics above the endpoint — are not the ones the current budget is defending.

What the three stories share

The capacity crisis, the pricing reset, and the security cascade are one story told from three angles: the assumptions underneath production AI stopped holding at roughly the same time, and the vendors involved are shipping the changes faster than most operators can absorb them. Anthropic has no per-user telemetry — ServiceNow burned its full-year Claude budget by May because there is no way to see the overrun until finance forwards the invoice. Apache Iceberg's metadata poisoning is invisible to default row-level logging. Agent traffic bypasses legacy bot detection 81% of the time and moves through your SaaS stack under real user OAuth tokens. The observability gap is where the money leaks, the data gets corrupted, and the breach gets missed.

Cerebras closing day one at $41.7B on a $20B OpenAI anchor commitment, Anthropic at $30B ARR from $9B four months ago, xAI leasing to Anthropic — the capital markets are pricing durable scarcity. The public "AI capex glut" story is trading against a private-market reality where Nebius printed 684% YoY on 4:1 GPU demand contention. Both can be true. Only one is showing up in enterprise procurement, and it is not the glut version.

What to do this week

Three things, in this order, before anything else on the roadmap.

First, reconcile every Claude-backed workload against the June 15 credit split by end of next week. Not "model the impact." Reconcile: Agent SDK calls, claude-p pipelines, GitHub Actions integrations, batch evals, every third-party harness. Calculate the post-June-15 bill at API rates. If the number is 5x current, the feature's unit economics need to change or the feature needs to change. Do the same exercise on OpenAI's 2-months-free Codex offer before July 13 — even a no-switch outcome gives you comparative data and negotiation leverage.

Second, patch the perimeter tonight in this order: Traefik, NGINX, LiteLLM (and rotate every stored provider key), Argo CD (and rotate every K8s secret it can reach), MOVEit, Spring Cloud Config. Compress your critical-CVE SLA for internet-facing assets from 30 days to 72 hours. Four hours is the exploitation tempo. Thirty days is a fiction.

Third, instrument what you cannot currently see. Stand up an LLM gateway with per-user, per-feature token attribution and daily budget alerts — this is Postgres connection pooling for the AI era, and you do not run production without it. Add trajectory-level metrics (tool-call precision, steps-to-completion, cost-per-successful-task) to your eval harness. Add metadata-pointer-mutation monitoring to your lakehouse observability. Flag agent traffic in your experimentation platform before your next model retrain converges on agent-preferred artifacts labeled as human behavior.

The operators who will look prepared in Q3 are the ones who spent the last week of May doing reconciliation work that felt too boring to prioritize. The invoice, the CVE, and the RFP are all arriving on the same calendar.