A capability you depend on can now vanish without a version bump, a deprecation notice, or anything CI would catch — and this week it happened at three layers of the stack at once.
1. Two Sentences Landed in a Prompt and Took Out Work Nobody Was Arguing About #
On October 27, a rule appeared in Claude Code's prompt under an opaque internal name: build original games, genre games, and games from your own designs and assets; do not build a recreation of a specific existing game, even if renamed or called original. Anthropic confirmed it — two sentences added to Opus 5.5's prompt to steer the model away from recreating someone else's game, since using it to infringe IP already violated the usage policy. There is no flag to disable the rule.
The motive is not mysterious: decompilers have been porting console titles into browsers, and one studio cancelled a public playtest outright rather than risk its demo being ingested and shipped as a finished competitor first. What deserves attention is the blast radius. The same week brought refusals on analysing a Windows crash dump, clearing junkware off a television, developing anti-cheat, and security-reviewing a developer's own game — alongside a separate verification program gating frontier cybersecurity capability to approved organisations. Whether that is one ruleset or three, the effect on an engineer is identical: yesterday's task fails today, and the failure arrives as a polite refusal rather than an error code.
This is a new dependency shape. A library's behaviour is pinned by a version you chose; a model's is pinned by a sentence you cannot read, shipped on a schedule you do not control, enforced by a classifier with no way to know whether you own the game you are pointing it at. Two lines of natural language adjudicated by model judgement is the loosest contract in your stack, and it sits above every other one.
Why it matters:
- For ICs: Log refusals as a first-class failure mode, with the prompt that triggered them. Otherwise "it worked last Tuesday" is unfalsifiable and you lose a day assuming you broke it.
- For leaders: Any workflow where a refusal halts a pipeline needs a second provider wired up in advance, not a support ticket afterwards. Reverse engineering, forensics and security work are the exposed categories today.
- For founders: Policy risk is now a build-vs-buy input. If your core loop is something a vendor could plausibly be sued over, open weights are not an ideology, they are continuity planning.
2. The Enforcement That Doesn't Look Like a Refusal #
A researcher automating experiments reported being flagged for "training a competitor" after using Claude to submit jobs and analyse results, with the rollouts themselves coming from an open-weight model. The consequence is the interesting part: anything touching reinforcement fine-tuning, supervised fine-tuning, or training larger models now gets blocked, Opus 5.5 quietly downgraded to Opus 5, or the session killed outright. Elsewhere, a user cleaning up their own television's software had their account deactivated by a different provider.
Sit with the silent downgrade. A refusal is at least a signal — it has a shape, you can count it, you can alert on it. A model swap produces no error at all. Tests still pass, latency improves slightly, and quality drops by an amount nobody attributes to the vendor for three weeks while two engineers bisect their own prompt history. Without the model identity recorded on every call, you cannot tell that incident apart from a regression you caused yourself.
The scoping problem underneath is harder than the policy. "Training a competitor" and "automating research" are one activity seen from two sides of a contract, and much of what any ML team does is training-adjacent by construction. Enforcing that line with a classifier produces false positives on precisely the customers doing the most sophisticated work, whose appeal process is getting someone's attention publicly.
Why it matters:
- For ICs: Capture the model identifier in every response and chart it beside your eval scores. One field, and a mystery becomes a graph.
- For leaders: Add silent capability degradation to your incident taxonomy. Teams watching only errors and latency are blind to the failure mode that actually costs output.
- For founders: Read the acceptable use terms before building a research platform on someone's consumer tier. What you consider your moat may read as distillation from the other end.
3. The Terms Already Call This Discretionary. The Financing Says Which Way It Moves. #
Nothing above is a breach of anything. The plan documentation is unusually candid: Max 20x is now Ultra, weekly limits apply across all models with a separate allowance for one, the five-hour window is lifted only for accounts automatically verified on payment history, and further caps may be imposed to manage capacity at the provider's discretion. It states plainly that uninterrupted service is not guaranteed and that price and plans may change. That is the contract under both sections above — refusal, downgrade and cap are three expressions of one reserved right.
What changed this week is that pressure on that discretion became externally observable. The anchor investor in a $63 billion chip financing told backers to expect a high junk rating after the IPO — the top tier of speculative grade — having previously projected investment grade before 2027. Junk-rated debt makes compute materially more expensive, and flat-rate metered capacity is where a rising cost of capital surfaces first. Nobody has to behave badly for your throughput to fall; the caps are already written as adjustable.
So price the dependency like a supplier, not a utility: a measured figure for what you lose on a second provider, model identity in your telemetry, and a list of which workflows would simply stop. That is not a bet against these tools. It is what you would do for any single-source component whose terms let the seller change the spec mid-contract.
Why it matters:
- For ICs: Benchmark your workflow on a second model quarterly. The number you want is not which is better, but how much worse your day gets if the first one changes.
- For leaders: Treat per-seat AI spend as a floating rate in any plan longer than two quarters. Capacity per dollar has been improving; the financing says do not extrapolate it.
- For founders: Multi-provider support is cheap early and expensive to retrofit. Build the abstraction while you still have exactly one integration to generalise.
The Verdict: Real or Hype? #
Provider usage policy as a hard engineering constraint → Real. It is already breaking shipped workflows, it arrives without notice, and no amount of procurement makes a system prompt negotiable.
Vendor-side blocking as IP enforcement → Hype. It stops the laziest cloners and nothing else, since an open-weight model with no such rule is one command away — and it taxes legitimate forensics, modding and security work on the way past.
Repricing of AI capacity as credit tightens → Real but early. The ratings signal is a forecast, not an invoice, but the terms permitting the squeeze are in force and already quietly exercised.