On the evening of 4 April, Anthropic quietly adjusted the terms of its Claude subscription plans. If you were using OpenClaw or any other third-party agent harness on a subscription, that's over. You can still use Claude inside those tools, but only on pay-as-you-go API credits, billed separately at metered rates. It was a small change, easily missed in a week of louder product announcements, and it resets how the agent ecosystem pays for the compute underneath it.

Boris Cherny, who runs Claude Code at Anthropic, broke the news on X. His framing was operational. Subscriptions weren't built for the usage patterns of these third-party tools, he wrote; capacity was a resource they were managing thoughtfully, and they were prioritising customers using their own products and API.

Fair enough, as far as it goes. Capacity is real. Agent workloads are hungry in a way that interactive chat isn't. But this wasn't capacity talk. It was a permissions announcement in capacity clothing.

The announcement

For anyone who hasn't been following the OpenClaw story, a quick recap. Peter Steinberger built it as a weekend project in November 2025. By February it had over 100,000 GitHub stars and a working community marketplace of agent skills. In mid-February Steinberger announced he was moving to OpenAI; the project went to a foundation, with OpenAI pledging continued support. I wrote about it at the time as a validation moment for personal AI agents — personal AI agents just got validated, the piece went, and the race to bring them to everyone is on.

The piece flagged platform dependency as one of the things worth watching. “If you build your business workflows around one agent platform and it pivots, stalls, or gets absorbed — what's your migration path?” I used the WhatsApp precedent, which still seems to fit — Facebook promised separation at the acquisition, then merged the data into the ad graph within about two years, and the EU fined them €110 million for misleading regulators. Which sounds punitive until you remember it was somewhere around a day and a half of Facebook's ad revenue. The fine was the price of doing what they were always going to do.

That was February. This is April. The thing I flagged as a risk to watch turned into a live fire drill in about eight weeks.

What Anthropic did, specifically, isn't a ban on using OpenClaw with Claude. You can still do it. You just can't do it on your subscription any more. The harness that had become the primary way a lot of developers were actually using Claude, as an agent rather than a chat tool, got quietly moved onto a different billing line. Steinberger and the investor Dave Morin apparently tried to negotiate and managed to delay enforcement by exactly one week.

Anthropic threw in a softener. One-time credit equal to your monthly plan cost, redeemable until April 17. Up to 30% discount on pre-purchased usage bundles. That's worth having, but it's fairly clearly a gesture to keep the optics manageable while the policy does what it was designed to do.

The security story, and why it's only half the explanation

There's a defence of this move that's worth taking seriously. OpenClaw has had a bad few weeks on security.

Ars Technica reported in early April that the project had patched three high-severity vulnerabilities, the worst of which — CVE-2026-33579 — scored 9.8 out of 10. Roughly 63% of internet-connected OpenClaw instances were running without any authentication at all. Researchers at Blink flagged that an unauthenticated attacker could work their way up to admin on those deployments without needing an account. The patch landed on 5 April. The CVE listing didn't appear publicly until the Tuesday, giving anyone paying attention a two-day head start.

So one reading is: Anthropic saw a third-party tool with a critical auth bypass being used at scale through their subscription plans, and decided they didn't fancy carrying the liability exposure for usage they couldn't audit. I've seen enough infra-sec incident reviews to know that reading is at least partly correct. If a large-scale compromise of OpenClaw deployments leaked customer prompts, including Claude prompts, through an unauthenticated interface, Anthropic would be the name in the headline, not the harness. “Claude data leaked” writes itself; “OpenClaw harness data leaked” doesn't.

That's the charitable case, and it's probably a live factor in the decision. Honestly I went back and forth on this for a day or two — there's a version of events where the security panic is doing almost all the work and the revenue consequence is something Anthropic noticed later and shrugged about, not something it actually drove. I'm not sure I can rule that version out. But the timing and the framing tell you it isn't the whole case. The ban applies to all third-party harnesses, not just OpenClaw. The negotiation window was a week. The customer messaging was about capacity, not security. And the economic effect, pushing agent workloads onto the metered API and off the flat-rate subscription, is precisely the effect you'd design for if what you actually wanted was a different revenue shape.

Liability and economics aren't mutually exclusive. Both can be true. But when a single move cleanly solves two problems and the public framing only names the third one, I'd bet on the invisible ones doing most of the work.

The platform tax

The interesting thing about subscription pricing is the implicit bundle. You pay a flat rate. The provider takes the spread between what you actually use and what the price was set for. If you use less than the average, you subsidise someone else. If you use more, someone else is subsidising you.

Agent workloads break that model. An agent running in a loop, fetching a page, reasoning over it, writing a follow-up prompt, calling a tool, looping back, can burn through tokens at ten or twenty times the rate of a human at a keyboard. OpenClaw, built precisely to enable that pattern, was a subscription-buster by design. The more effective the harness, the bigger the shortfall between subscription price and real consumption.

So far, so operational. But what's actually being paid for in a Claude subscription? Technically, tokens. Practically, access — the right to plug Claude into your workflow and keep it there. The subscription is less a consumption allowance than a relationship fee. You pay for the ability to integrate.

What Anthropic just demonstrated is that this right is revocable. Nobody's being shut down — that's too crude a framing for what happened. The subtler move is that the shape of what you're paying for can be adjusted whenever the provider decides it should be. The same access you had last week is now billed on a different line. Nothing changed under the hood — only the paperwork around it.

That's the platform tax. It isn't a number you pay on day one. It's a levy that can be raised at any time once your workflows depend on the platform. The App Store takes 30% partly because it can; AWS keeps egress fees punitive partly because it can; Meta turned WhatsApp's data promise into a €110 million fine partly because it was cheaper than not doing it. Platform taxes get charged once you're already in — that's the whole point of the mechanism.

I don't know what the eventual rate looks like, and I'd be suspicious of anyone claiming to. What I do know is that the mechanism is now live, and mechanisms that exist tend to get used.

And if the analogy feels heavy, notice the emotional register of the Anthropic announcement. “We've been working hard to meet the increase in demand.” That's the tone of a utility that's just realised you've been running a small factory off the domestic tariff. It's a perfectly reasonable commercial position for them to take — just worth noticing that it isn't a neutral one.

Where the moat actually is

There's a piece of conventional wisdom in AI right now that model quality is the moat. Smarter model wins, keeps winning, and the challengers scramble to catch up.

I'm not sure that's been true for a while. Model quality commoditises in a way that platform control doesn't. Within a couple of versions, the frontier labs end up inside the same rough performance band. GPT-5, Claude Sonnet, Gemini Advanced — the gap between them on any given task is real, but it isn't load-bearing. What differs is how each lab has wired the model into a usage shape. Chat tiers, project memory, code workspaces, agent harnesses. The moat is the funnel that sits around the model.

Which is why I thought the most revealing thing about Cherny's announcement was the second half of his sentence. “Prioritising our customers using our products and API.” The products are the funnel. The API is the metered workload. OpenClaw and the other third-party harnesses are neither of those things, and the economics have now been adjusted to reflect that. This isn't hostility to open source — Anthropic has been generous with it at other moments. It's a decision about who owns the layer between a model and the user's life, and the labs have worked out they want to own it themselves.

I argued something close to this in most AI capability doesn't live in the model back in December. The capability most people experience as “Claude is smart” mostly lives in the product wrapper around the model, not the weights themselves. If that's right, then the wrapper is the asset, and allowing a third party to become the dominant wrapper is strategically unwise. You're letting someone else capture the part of the value chain that actually retains customers.

Anthropic did the rational thing here, and in markets shaped like this one, rational moves are the ones that tend to get copied.

What this means if you're building on any of it

For anyone who's been quietly building workflows on top of one provider's subscription plan, the Anthropic move is a signal about how the industry means to treat agent workloads going forward. The thing that got repriced this time was agent harness usage. The thing that gets repriced next time could be anything the provider decides is eating into the margin.

The hard bit is that you can't avoid platform dependency by being clever at contract negotiation. It's structural. Once your agent fleet is plumbed into a particular model's quirks, prompt patterns, and tool-calling conventions, switching isn't a one-afternoon exercise. I wrote about this in the Anthropic effect after the US federal ban in March — the US military couldn't stop using Claude even when it was ordered to. Switching cost is measured in weeks of rework and a hit to quality that most teams can't absorb during a normal sprint, let alone a crisis.

So if you're building, a few things have probably just moved up your list. Keep your harness layer neutral, even if you're currently running one provider. Build the ability to run evaluations against two models, at minimum, on the workloads you actually depend on. Budget for the possibility that your unit economics change, because at some point they will. And when a provider says “capacity” in a pricing announcement, translate that in your head to “we're rationing a thing we used to give away, and the rationing is going to favour the people holding the contracts we'd most like to keep.”

The line nobody's saying out loud

The thing the labs know and their customers are still working out is that the model was never the interesting part. It was always the bundle the model was sitting inside. Who gets to call it. From where. Under what terms. Whether those terms are stable or adjustable. Whether the adjustment notice is a quarter or a week.

Anthropic just showed the industry what the adjustment looks like in practice. It wasn't particularly dramatic or punitive — a blog post, a couple of concessions, a week's delay for the biggest complainer. The kind of move you can make twice a year without anyone quite calling it a pattern.

The labs have worked out that the agent was the point all along. Most of the customers are still catching up. The interesting question now is which side of that gap you're on when the next adjustment lands — and whether you're going to notice it before or after it's already priced into your next invoice.