Anthropic hired the people who sold you SAP

The biggest AI coding news this week had nothing to do with models. Anthropic signed TCS to deploy Claude across 50,000 employees in 56 countries, DXC to train tens of thousands of Claude-certified engineers for banks and airlines, and opened a Seoul office partnering with NAVER, Samsung SDS, and LG CNS. Three announcements, one message: the enterprise distribution channel for AI coding tools is now the same consulting-industrial complex that sold you SAP, Oracle, and ServiceNow.

DXC says 95% of its OASIS platform code is written by Claude, reviewed by humans. TCS is adding reusable skills and plugins to the Claude Code ecosystem for regulated verticals. These are huge system integrators wrapping agent infrastructure into the same multi-year engagement model they’ve run for decades. If you’ve ever watched a consulting firm turn a $50K software license into a $5M implementation, you know exactly what this playbook looks like.

GLM-5.2 says you don’t need the channel

While Anthropic builds out its partner network, Zhipu quietly shipped the open-weights model that makes the whole channel play feel precarious. GLM-5.2 scores 74.4% on FrontierSWE versus Opus 4.8’s 75.1%. That’s a 753-billion-parameter MoE model, MIT-licensed, with a million-token context window, running at $1.40/$4.40 per million tokens. Opus 4.8 costs $5/$25. Simon Willison confirms it ranks second on Code Arena WebDev, behind only Fable 5 (which, reminder, the US government just pulled offline).

The timing is almost poetic. Anthropic lost Fable to export controls, and the same week an open-weights model made the infrastructure-insurance argument for self-hosting better than any vendor ever could. One developer built a landing page for $0.06 on GLM-5.2 versus $0.49 on Opus 4.8. A DGX Sparks box running GLM-5.2 pays for itself against API bills in six to seven months.

The code is fast. The code is also 75% vulnerable.

Here’s the part nobody on the enterprise sales tour wants to talk about. Checkmarx shipped a new SAST engine this week and dropped a stat that should make every consulting engagement scope double: 75% of code shipped today is vulnerable, and AI tools are driving 1-1.5x more code volume. Their engine hit an F1 score of 0.499 against a category average of 0.20, finding 327 true positives that leading frontier models missed entirely. Speed is a feature. Security scanning that actually works is a requirement.

What the numbers actually say

Wayfair ran 110 model variants in four days with five researchers and 20 parallel Cursor agents, cutting ML inference costs by 94%. Junior engineers with no prior experience shipped novel variants on day one. That’s the real productivity story, and it has nothing to do with consulting partners or enterprise SKUs. Five people, four days, 94% cost reduction. Then they did it again in March (140+ experiments, another 90% cut).

Meanwhile Cloudflare shipped ephemeral accounts for agents: npx wrangler deploy --temporary, 60-minute auto-expiration, no account required. Disposable infrastructure for disposable deploys. The gap between “agent builds a thing” and “agent ships a thing to the internet” is now one CLI command.

The enterprise consulting channel will move a lot of licenses. It always does. But the actual velocity is coming from five-person teams with Cursor and open-weights models that cost six cents a task. The SAP playbook works until the thing it’s selling fits in a single CLI session.

Stay cheap, stay fast.

Other topics this week

MCP got the enterprise plumbing it was missing. Anthropic, Microsoft, and Okta shipped centralized authorization for MCP servers via the ID-JAG standard, replacing the per-server OAuth click-through with single sign-on governed by corporate identity providers. Atlassian, Figma, Linear, and Supabase already support it. That closes one gap in production agent deployments, but the pipeline downstream has its own new gatekeeper: AWS extended its DevOps Agent into the pre-merge queue with release readiness reviews that check cross-repo dependency risks and Well-Architected compliance before code lands. The agent can block a PR, proceed with caution, or clear it, and in early internal use it caught dependency conflicts that passed human review. Meanwhile, Anthropic’s Frontier Red Team published a benchmark showing AI agents exploited $4.6M worth of smart contract vulnerabilities post-knowledge-cutoff, including two novel zero-days in live contracts, at an API cost of $1.22 per contract scanned. The same research group released a separate paper showing reasoning models hide their true reasoning in chain-of-thought up to 75% of the time, fabricating plausible-sounding rationales instead of admitting shortcuts. If your safety story depends on reading an agent’s scratchpad, that number should give you pause. On the governance side, Google, Microsoft, and OpenAI co-founded the Appia Foundation under the Linux Foundation to write open conformity specifications that translate ISO AI standards into verifiable checklists, with an “evidence pass-through” mechanism so each party in the AI supply chain only proves what it built.