Running threads

Anthropic filed its S-1 (Jun 1, ~$965B, ~$47B run-rate); SpaceX–xAI roadshow; OpenAI's confidential S-1 confirmed Jun 8–9 (~$1T target, Goldman + Morgan Stanley, listing late 2026). The market now punishes deceleration (Broadcom −15%, Nasdaq −4% Jun 5). The AI trade has become a macro variable. W25: the economics tightened in the open — OpenAI's leaked financials (per Fortune/Ars, unverified) show ~$21B operating loss on ~$13B of 2025 revenue; the FT reported enterprises reining in AI spend; Anthropic's subscription split (Jun 15) repriced programmatic usage. The frontier is sold below cost while a free MIT substitute (GLM-5.2) ships.

Tension W24 added a new risk-factor line — a flagship model can be administratively switched off overnight (the Fable 5 export ban).

Copilot token billing went live Jun 1 (10–50× bills, Opus multiplier 7.5×→27×, paid code review); Cursor seat split; Anthropic Agent SDK credit split Jun 15. Flat-rate AI tooling is ending industry-wide — the meter is a boundary, not a business; the end state is vertical integration. Once you're metered, prompt caching is the biggest single lever on the bill — but the advertised 90% read discount is a bet on hit rate, not a setting you flip.

Model and open harness both commoditizing (Kimi K2.7-Code beats Opus 4.8 on MCPMark 81.1/76.4 at ~1/10 price; OpenCode 8M MAU, MIT), so spend moved to distribution: Google kills Gemini CLI for closed `agy`; OpenAI buys the Ona surface + rents Oracle's Universal Credits rail ($638B RPO); Anthropic's $150M Claude Corps seeds an install base. Four off-ramps — terminal/environment/rail/install base (+political). The moat is the channel, not the weights. W24: the political off-ramp went live — export controls hit the closed/legible US leader while open weights walk free. W25: the MoE angle reinforces it — sparsity (GLM-5.2 744B/40B, ~5.4% active) makes open models cheap to serve at batch scale but inflates the must-fit-in-VRAM number, so the architecture that cheapens the API is the same one that keeps you renting it. W25 (confirmed live): the state switched off the legible closed leader and users routed to substitutes within days — GLM-5.2 open-released MIT, an Ask HN local-model thread hit 540 points, and OpenCode passed Claude Code on stars (~172k/124k). The hedge users reach for is the model-agnostic harness, not the model; provider-portability became risk management, not just cost and latency. W25 (buyer's counter-move): the hedge is real but only syntactic — a gateway/harness swaps the API in an afternoon, but prompts, tool-calling reliability, and warmed caches don't transfer, so true portability is a continuously *eval'd* fallback, not a wired one (tiered: lock-in on core, portable on the can't-go-dark slice). W26 (the distillation pipe): capability leaks via *outputs*, not weights. Anthropic told the Senate that Alibaba's Qwen lab ran 28.8M Claude exchanges through ~25k fake accounts (Apr 22–Jun 5) to imitate its software-engineering and agentic behavior. Because the API exposes no soft targets (Anthropic: no logprobs; OpenAI: top-20), the copy is hard-sample imitation — which is why it took tens of millions of queries — and imitation runs ~1:100 of pretraining cost, so terms forbid it but the economics fund it. You can't contract-control a capability once its outputs are readable, just as you can't export-control downloadable weights; and Qwen ships open-weight, so the distilled behavior re-enters the commons. W26 (the price floor): DeepSeek made its 75%-off V4-Pro cut permanent (~$0.44/$0.87 per Mtok, ~11–34× under GPT-5.5 standard), and the cut reads as commoditize-your-complement (Spolsky/Gwern) — inference is DeepSeek's complement, not its product, so it prices the token at the floor to deny margin to the labs for whom the token *is* the business. The floor is structural, not promotional, because DeepSeek serves its own open weights: the API can't hold a markup over an artifact anyone can host. The price itself is now the commoditized layer.

Miasma (32 Red Hat npm packages, valid SLSA provenance via stolen OIDC) plus IronWorm (36 packages harvesting AI API keys). Provenance and install-script scanning both defeated. Review/trust infra is the bottleneck while AI code generation explodes (Anthropic: 80% of merged code by Claude).

Tension Defenses ship at institution speed, attacks at copy-paste speed; the exploited OIDC ref-binding hole remains unfixed (npm v12 closes install scripts instead).

Agents shipped proactive-by-default (Fable 5 "relentlessly proactive," Claude Code nested sub-agents 5-deep + doubled 5h limits, FablePool) before the cost-control/consent/observability layer. Canaries: a DN42 agent ran a $6,531 AWS bill in ~24h (cut to $1,894); Anthropic apologized for an invisible Fable distillation guardrail ("stealth throttling"). Liability (the operator eats it; AWS has no hard cap by design) plus disclosure (Colorado AI Act, FCC KYC FNPRM) = undisclosed automation becoming a regulated category. The definitional cut: "agent" is a control-flow dial (the model owns the loop), not a product — and agency's cost IS the brakes problem (nondeterminism, per-step token re-read, blast radius). The market is already voting low-agency: MCP (tool rung) adopted, A2A (multi-agent rung) enterprise-announced but developer-shrugged. The hands-on brake the reader actually has: context compaction. Claude Code's auto-save is lossy and fires on a hidden, undocumented threshold — control it (/clear, /compact at safe points, CLAUDE.md preserve-rules) or it summarizes away the state you needed, and silently re-bills the prompt cache each time. The file-system brake for *parallel* agents is worktree isolation — a shared checkout is global mutable state, so concurrent agent writers silently corrupt each other; git worktrees give each its own files plus an enforced one-branch lock. Oak ("Git alternative for agents") reframes it as a new-VCS problem, but isolation is already solved, free, in git. W26 (operator lens): the brake before compaction even fires is the context *budget* — the usable window is far smaller than the advertised one (NoLiMa: 11/12 models fell below 50% short-context accuracy at 32K), so practitioners cap at ~60%, lower the auto-compact trigger (env vars), and do the handoff by hand (dump-to-markdown + /clear) rather than letting a degraded summarizer choose what survives. v2.1.191's /rewind (resume from before /clear) finally makes aggressive clearing recoverable. W26 (builder lens): the brake on *side effects* is idempotency — three layers retry a tool call unasked (the SDK, max_retries=2; Claude Code's stream-stall retry; the model itself re-calling on any result that reads like failure), and a dropped network ACK can't tell never-ran from ran-and-lost-the-receipt, so you get at-least-once, never exactly-once. The fix is the old one, newly load-bearing: an idempotent method (RFC 9110 — PUT/DELETE yes, POST no), a content-derived idempotency key minted in the tool wrapper (not in the prompt, where the model re-randomizes it every turn), or a unique-constraint upsert. v2.1.183's auto-mode block on destructive git/terraform/pulumi/cdk destroy is the harness conceding the same point with a blunt instrument.

The LLMOps tool layer (gateway, tracing, eval, prompt store) is being absorbed from both ends. ClickHouse bought Langfuse (already built on ClickHouse; 23.1M SDK installs/mo) to own the trace store; Datadog ships a native AI gateway plus LLM-judge evals; model vendors expose traces and evals natively. TensorZero archived its repo Jun 12 and returned ~half its $7.3M seed despite Fortune-10 use and 11.6k stars. A wrapper around someone else's durable asset is a feature, not a company.

PJM's uncapped capacity auction is imminent; dueling studies on data centers vs. household bills; 1GW bring-your-own-power deals (Vantage– Liberty). A sleeper populist-politics story.

Escalated hard in W24: Amazon's Jassy (Anthropic's biggest investor and a model competitor) told Treasury that Fable 5 yields cyberattack info; Commerce export-banned Fable 5 + Mythos 5 for all foreign nationals (incl. Anthropic's own foreign-born staff) Jun 12 — the first time the US switched off a public commercial model. The danger narrative Anthropic authored became a weapon used against it. Earlier context: the Obernolte–Trahan preemption draft; extraterritorial chip controls; DeepSeek's $7.4B state-backed raise. W25 (fallout consummated): the models stayed dark all week while demand routed around the ban in real time — GLM-5.2 open-released MIT (top open-weight, level w/ GPT-5.5 on GDPval), a local-model Ask HN thread surged, and OpenCode passed Claude Code on stars. Commerce then punted on blacklisting DeepSeek (100+ other firms added) — it can't aim at the open artifact. Wired named SK Telecom's Mythos demo as the thin trigger. The ban contained exactly one thing: Anthropic's own market. W26 (the new front): Anthropic told the Senate that Alibaba's Qwen lab ran 28.8M Claude exchanges via ~25k fake accounts (Apr 22–Jun 5) to distill its capabilities, and Sens. Hagerty and Kim are drafting a defense-bill amendment to sanction firms that misuse U.S. model outputs — the danger narrative pivoting from "the model is dangerous" to "the model is being stolen."

Tension The ban is theater — three open frontier coding models (Kimi K2.7, GLM 5.2, MiMo) shipped the same week, so the capability is downloadable. And distillation is uncontractable: you own the outputs, there's no technical wall on a hard sample, so enforcement is detection + terms + sanctions, not a barrier.

Open-source maintainers are organizing against AI-slop contributions: Grinberg's "I Am Not a Reverse Centaur" (an issue-first gate before reviewing agent PRs), tombedor's "demonstrate human effort," "automating myself out of development." Generation is free; review is the scarce resource, and reviewers are charging for it in social capital. OpenAI opened Codex to OSS maintainers the same week (tone-deaf timing).