Mert

$1 billion to $19 billion in annualized revenue. Fourteen months. That is the growth curve Anthropic is now trying to price on the public market.

Bloomberg reported on March 27 that Anthropic — the company behind Claude — is weighing an initial public offering as early as October 2026. The company has started preliminary discussions with Goldman Sachs, JPMorgan, and Morgan Stanley. The raise target: more than $60 billion. No S-1 has been filed. But when a company growing at 1,167% year-over-year starts talking to three of Wall Street’s biggest banks, you pay attention.

I have been building with Claude Code for the past year, shipping products on top of Anthropic’s models. The IPO news is not just financial gossip to me — it signals where the platform I depend on is heading. And the numbers behind this filing are worth understanding whether you are an investor, a developer, or both.

The Revenue Machine

Anthropic’s financial trajectory defies normal SaaS math. In December 2024, the company was running at $1 billion in annualized revenue. By February 2026, SaaStr reported that figure had crossed $14 billion. As of March, it is approaching $19 billion.

The catalyst is Claude Code. Anthropic’s agentic coding tool went from zero revenue to over $2.5 billion in annualized billings in roughly nine months. Business subscriptions quadrupled in the first six weeks of 2026 alone. Enterprise customers — defined as those spending over $1 million annually — now exceed 500, up from a dozen two years ago. Eight of the Fortune 10 use Claude.

The consumer side tells a similar story. Monthly visits to claude.ai surged from 16 million in January 2025 to 220 million in January 2026. That is not a rounding error. That is a product finding product-market fit at extraordinary speed.

Anthropic’s latest funding round in February 2026 raised $30 billion at a $380 billion post-money valuation, co-led by Abu Dhabi’s MGX. The previous round, in March 2025, valued the company at $61.5 billion. A 6x jump in under a year.

Amazon holds the largest stake at $8 billion. Google has invested $2 billion. Anthropic raised its 2026 revenue forecast by 20% to $18 billion, according to Seeking Alpha, though the current run rate suggests it could overshoot.

The OpenAI Collision Course

Anthropic is not filing into a vacuum. OpenAI is also exploring a 2026 IPO, which means two AI frontier labs could hit the public market in the same window. That creates a direct competition for investor capital that the tech IPO market has not seen since the cloud wars.

The financial contrast is sharp. European Business Magazine reported that OpenAI burns approximately $14 billion per year while the majority of its users remain on free tiers. Anthropic’s revenue mix skews toward paid enterprise contracts. Epoch AI projects that Anthropic could overtake OpenAI in annualized revenue by mid-2026.

This matters for developers. A successful IPO gives Anthropic a massive capital injection for compute, research, and infrastructure. A competitive IPO race between Anthropic and OpenAI likely means both companies double down on developer tooling and API capabilities to demonstrate growth to public-market investors. If you build on either platform, the next twelve months of product investment will be shaped by who is trying to impress Wall Street.

What Actually Matters

The $60 billion headline is dramatic, but three structural questions will determine whether Anthropic’s IPO succeeds or stumbles.

Compute economics is the first. Revenue of $19 billion is remarkable, but frontier AI model training and inference are brutally expensive. Anthropic has not disclosed margins publicly, but the industry benchmark suggests compute costs consume 50-70% of revenue for companies operating at this scale. The profitability timeline Anthropic presents to investors will set the price.

The Amazon-Google shareholder structure is the second. Amazon is the largest shareholder and has integrated Claude deeply into AWS Bedrock. Google invested $2 billion. Post-IPO governance — whether Anthropic gains true independence or remains strategically tied to its cloud backers — affects how the market values the company. Independence signals platform durability. Deep integration signals distribution but also dependency.

The third is the broader AI investment thesis. There has been no major AI-company IPO in 2024 or 2025. Anthropic’s listing becomes the test case. If it prices well and trades up, it validates the entire AI venture ecosystem. If it stumbles, it cools the sector. Forge Global notes that private-market trading of Anthropic shares is already active, with strong pre-IPO demand.

For developers building on Claude, the IPO is a bet on platform stability. A public Anthropic with $60 billion in fresh capital is a company that can sustain the compute arms race, invest in developer tools, and maintain the kind of model quality that got us here in the first place.

Fourteen months, 19x revenue. October answers one question: does the public market believe AI’s growth curve is real, or priced in?

Full Korean analysis on spoonai.me.

Sources:

• Bloomberg: Claude AI Maker Anthropic Considers IPO
• SaaStr: Anthropic Hits $14B ARR
• Epoch AI: Anthropic vs OpenAI Revenue
• Forge Global: Anthropic IPO Analysis
• Seeking Alpha: Anthropic Raises Revenue Forecast

A web developer with five years of experience posted one line on Reddit after trying the latest Claude Max: “I feel increasingly irrelevant.” The thread exploded. Thousands of comments. Heated arguments about whether the profession is dying or just changing shape. Someone mentioned that a task estimated at five days was completed by Claude in a single attempt. That one anecdote became a lightning rod for every anxiety developers have been quietly holding.

I’ve been building products with AI tools for over a year now. I use Claude Code daily. The anxiety isn’t abstract to me. But after reading through hundreds of Reddit threads and looking at the actual data, the picture is more nuanced than either side of the debate admits.

In a survey of 550 software developers, nearly 30% said they believe AI will replace their development work in the foreseeable future. That means 70% don’t. But even among the 70%, there’s a shared recognition that the job description has fundamentally changed.

The Creator of Claude Code Said the Quiet Part Out Loud

Boris Cherny, the person who built Claude Code, told Fortune something remarkable: “I think by the end of the year, everyone is going to be a product manager, and everyone codes. The title software engineer is going to start to go away.” He said it would be replaced by “builder.”

This isn’t a LinkedIn influencer farming engagement. This is the creator of the tool making the prediction. Claude Code builds features, runs tests, fixes bugs, and verifies its own output without direct human supervision. The r/ClaudeCode subreddit now has 4,200+ weekly contributors, more than triple the 1,200 on the competing r/Codex subreddit. Claude Code generates 4x more Reddit discussion volume than Codex. That gap isn’t about marketing. It reflects who’s actually using what.

When I configured my Claude Code setup for the first time, the productivity gain was immediate and unsettling. Tasks that used to take me an afternoon were done in minutes. Not because I’m a slow developer, but because the tool handles the mechanical parts, the boilerplate, the test scaffolding, the repetitive patterns, with zero friction.

The uncomfortable question isn’t whether AI writes good code. It does. The question is what remains uniquely human about software development when the mechanical parts are fully automated.

Stack Overflow’s Collapse Is the Canary

Stack Overflow was the developer’s default answer engine for 15 years. Monthly questions peaked above 200,000 in 2014. By late 2025, they’d dropped below 50,000. An 80% decline in one year, on top of already steep declines. Fifteen years of growth, effectively erased.

84% of developers now use AI tools in their development workflow. Why post a question on a forum and wait when you can ask an AI inside your IDE and get an answer in seconds? Stack Overflow’s aggressive moderation policy, where newcomers routinely got their questions closed or downvoted, only accelerated the exodus.

Here’s the irony. Stack Overflow’s annual revenue roughly doubled to $115 million. They pivoted from developer forum to AI data provider. 17% revenue growth from API partnerships with LLM providers. The developer community that built the platform is gone. The data that community generated is now the product.

Stack Overflow trajectory:
2014: 200K+ monthly questions (peak)
2022: ChatGPT launches, decline accelerates
2025: <50K monthly questions (75% drop)
2026: Revenue doubles via AI data licensing

The platform that taught millions of developers to code is now feeding its corpus to the models that make those developers question their relevance.

Junior Developers Are in a Hiring Winter

The numbers on junior hiring are stark. Entry-level developer postings dropped 60% between 2022 and 2024. In 2026, junior developer hiring fell another 73%. Computer science graduate unemployment hit 6-7%.

The logic is brutal in its simplicity. Junior developers traditionally handled bug fixes, test scripts, and boilerplate code. AI tools handle exactly those tasks. Research shows developers using GitHub Copilot complete coding tasks 56% faster. One senior with AI tools now outputs what previously required a senior plus two juniors. The cost math doesn’t favor hiring entry-level.

But the market isn’t uniformly frozen. Some large enterprises are increasing junior hiring specifically for developers who can work alongside AI. The hiring bar shifted from “demonstrate you can write a binary search tree” to “demonstrate you can solve a real business problem using AI as a collaborator.” If you’re a junior developer reading this, that shift is worth paying attention to.

I’ve been running parallel AI agents on real projects and the workflow looks nothing like traditional development. The developers who thrive in this environment aren’t necessarily the strongest coders. They’re the strongest problem decomposers.

Transformation, Not Replacement. Maybe.

The most common counterargument on Reddit threads: “It’s transformation, not replacement.” The developer role shifts from writing code to defining specifications and reviewing AI output. Architecture decisions, security audits, user experience design, these still need human judgment.

I partly agree. When I use Claude Code, I spend more time thinking about what to build and less time on how to build it. That’s a genuine shift. But I also notice something troubling. The “what to build” question has always been the province of product managers and designers. If developers move entirely into that space, the question becomes: are they developers, or are they product people who happen to understand code?

Anthropic launching the Anthropic Institute on March 11 to study AI’s impact on jobs and the economy tells you something. When the company building the disruption tool creates a research institute to study the disruption, the disruption is no longer hypothetical.

The Real Anxiety Isn’t Technical

Read enough Reddit threads and you notice: the deepest anxiety isn’t about unemployment. It’s about identity. “I am someone who writes code” is a self-definition for millions of developers. When that definition becomes unstable, the response isn’t purely rational. It’s emotional in ways that no amount of “just upskill” advice can address.

SF Standard asked the question directly: “AI writes the code now. What’s left for software engineers?” I don’t have a complete answer. I do know this: the gap between what “developer” meant five years ago and what it means today is wider than most of us expected. The gap between today and five years from now will be wider still.

A five-day task completed in a single attempt by an AI doesn’t erase the value of the developer who would have spent those five days. It means those five days are now available for different work. The hard part isn’t accepting that. The hard part is figuring out what the different work actually is.

The ability to write code is no longer scarce. Knowing what to build is.

Full Korean analysis on spoonai.me.

• Storyboard18: Claude Max Sparks Developer Anxiety – Storyboard18
• Claude Code Reddit Discussion Analysis – AI Tool Discovery
• Fortune: Claude Code Creator on the Future – Fortune
• Stack Overflow Traffic Collapses 75% – byteiota
• Junior Developer Hiring Crisis 2026 – byteiota

I counted once. During a 45-minute refactoring session with Claude Code, I pressed “y” to approve permissions 87 times. That’s roughly once every 30 seconds. I wasn’t coding. I was babysitting a permission dialog.

On March 24, Anthropic shipped auto mode for Claude Code, and the permission problem is essentially solved. A separate classifier model now evaluates every tool call in real time, auto-approving safe actions and blocking dangerous ones. No manual approvals for file reads. No --dangerously-skip-permissions flag. Just a classifier sitting between Claude and your system, making judgment calls.

Here’s how it actually works, what it blocks, and why it matters more than you’d think.

The Problem Was Worse Than You Remember

If you’ve used Claude Code for anything beyond trivial tasks, you know the friction. The default permission mode requires approval for every tool call. Reading a file? Approve. Searching code? Approve. Running git status? Approve.

The workaround most developers eventually discovered was --dangerously-skip-permissions, which does exactly what the flag name warns: it bypasses every safety check. According to Anthropic’s blog post, a significant number of users ended up there simply because the approval loop was unbearable.

There was an allowlist option too. You could register specific tools: claude --allowed-tools "Bash(git diff)" "Bash(git log)". But this was static. The safety of a command depends on context, not on the command itself. rm deleting a temp file is fine. rm targeting your .env is not. A static list can’t distinguish between the two.

Inside the Classifier

Auto mode introduces a classifier model that intercepts every tool call before execution. When Claude generates a tool invocation, the classifier reviews three things: whether the action stays within the scope of your original request, whether the target is trusted infrastructure, and whether the action might be driven by malicious content embedded in files or web pages (the prompt injection defense).

The classifier runs on Claude Sonnet 4.6 regardless of your main session model. Even if you’re on Opus 4.6, the classifier is always Sonnet. This is a deliberate design choice: the classifier fires on every single tool call, so it needs to be fast and cost-effective. Running Opus for classification would add unacceptable latency.

User Request → Claude generates tool call
                    ↓
            [Classifier on Sonnet 4.6]
                    ↓
        Safe? → Auto-execute (no prompt)
        Risky? → Block → Claude redirects

When the classifier blocks an action, it doesn’t just stop. It redirects Claude to find an alternative approach. If Claude wanted to run a destructive bash command, the classifier blocks it and Claude attempts the task through a safer path.

What Passes, What Doesn’t

Read-only operations pass almost universally: file reads, code searches, directory listings, git log, git diff. These are the operations that generated most of the permission fatigue in the first place.

File writes pass when they match your stated intent. “Update the button styles in Header.tsx” gives Claude a clear scope. Modifying that file’s Tailwind classes goes through automatically. But if Claude suddenly tries to edit your next.config.js during a styling task, the classifier catches the scope creep.

The classifier consistently blocks mass file deletions, rm -rf patterns, external network requests to unknown endpoints, access to .env files and credentials, git push --force, and anything that looks like it could affect production infrastructure.

The key insight is that this isn’t a static ruleset. The classifier reasons about intent. It’s asking “does this action make sense given what the user asked for?” rather than “is this command on the approved list?”

The Workflow Difference

Before auto mode, here’s what a typical refactoring session looked like: ask Claude to extract a component, approve file read, approve another file read, approve code search, approve file write, approve another file read, approve test file creation, approve test execution. Eight approvals for one task.

After auto mode, it’s: ask Claude to extract a component, come back five minutes later to a completed PR-ready diff. The reads, writes, and test runs all happened automatically because they stayed within scope.

Enabling auto mode is one command:

claude --enable-auto-mode

You can also toggle it mid-session with /permissions. Anthropic’s docs recommend running in isolated environments (containers, VMs) as an additional safety layer, which is honest about the classifier’s limitations.

Token usage and latency increase slightly since the classifier processes every tool call. In my testing, the overhead added roughly 200-400ms per tool call. Barely noticeable when the alternative was waiting for me to context-switch back to the terminal.

Auto Mode + Hooks + Agents

Auto mode gets more powerful when combined with two other recent Claude Code features. Hooks let you run custom scripts before and after tool calls, so you can auto-format code after every write or run linting checks before commits. Agents enable parallel task execution, splitting independent work across multiple Claude instances.

The three together create a workflow where you describe what you want, and Claude Code handles execution end-to-end. Hooks enforce your standards, auto mode removes friction, and agents parallelize independent work.

This is available now as a research preview on Team plans. Enterprise and API access is coming soon. It requires Sonnet 4.6 or Opus 4.6, with no support yet for Haiku, Claude 3 models, or third-party providers like AWS Bedrock or Google Vertex.

What’s Still Missing

The classifier’s decision criteria aren’t transparent. When an action gets blocked, you don’t get a detailed explanation of why. You learn the boundaries by trial and error. For a tool that’s supposed to reduce friction, opaque blocking decisions create a different kind of friction.

There’s also the question of adversarial robustness. The classifier runs on Sonnet 4.6. If someone crafts a file with embedded instructions designed to fool the classifier, how well does it hold up? Anthropic hasn’t published adversarial testing results yet.

And the “use isolated environments” recommendation is telling. It means Anthropic knows the classifier will make mistakes, and they’re asking you to limit the damage when it does.

Still, the tradeoff is clearly worth it. Permission fatigue was pushing developers toward --dangerously-skip-permissions, which is worse than any classifier failure mode. Auto mode is the first real middle ground.

The best permission system is one that disappears. Auto mode isn’t perfect, but 87 fewer “y” presses per session is hard to argue with.

Full Korean analysis on spoonai.me.

Sources:

• Auto mode for Claude Code – Anthropic Blog
• Claude Code Permission Modes – Docs
• Simon Willison’s Coverage
• 9to5Mac – Claude Code Auto Mode

$200 million. That’s the size of the contract Anthropic signed with the Pentagon in July 2025. Seven months later, the same government that hired them branded them a national security threat. Two months after that, a federal judge called the whole thing unconstitutional in a 43-page ruling that reads like a civics lesson for the AI age.

This isn’t just a legal story. If you build software that uses Claude, or any AI API from any provider, the outcome of this case determines whether AI companies can maintain the safety guardrails you depend on — or whether the government can force them to remove those guardrails under threat of blacklisting.

The Contract That Started a Constitutional Crisis

Anthropic became the first AI company to deploy its models across the Pentagon’s classified networks. The $200 million deal was a milestone for both the company and the military. Then in September, the Department of Defense tried to deploy Claude on GenAI.mil, a military AI platform, and things fell apart.

According to CNBC’s detailed reporting, the DOD demanded that Anthropic remove two specific restrictions from its usage policy: a prohibition on using Claude for fully autonomous lethal weapons and a prohibition on domestic mass surveillance. Anthropic agreed to nearly every other Pentagon request — classified network operation, military intelligence analysis, logistics optimization — but drew two hard lines.

The Pentagon’s response was extraordinary. In February 2026, Defense Secretary Pete Hegseth designated Anthropic a “supply chain risk.” CNN reported that this label had never before been publicly applied to an American company. It was previously reserved for entities like Huawei and Kaspersky — companies from adversarial nations suspected of government-directed espionage. Federal agencies were ordered to stop using Claude. Defense contractors including Amazon, Microsoft, and Palantir were required to certify they weren’t using Claude in military work.

Inside the 43-Page Ruling

Judge Rita Lin of the U.S. District Court in San Francisco didn’t mince words. During the March 24 hearing, she pressed DOD lawyers on the justification for branding Anthropic a supply chain risk, telling government counsel “That seems a pretty low bar.”

Two days later, she issued a preliminary injunction that immediately suspended the designation. The ruling’s key passage is worth reading in full: “Nothing in the governing statute supports the Orwellian notion that an American company may be branded a potential adversary and saboteur of the U.S. for expressing disagreement with the government.”

Lin found something damning in the Pentagon’s own internal records. The government moved against Anthropic specifically after the company raised its concerns publicly, what the DOD’s own documents characterized as acting “in a hostile manner through the press.” Lin’s ruling was blunt: “Punishing Anthropic for bringing public scrutiny to the government’s contracting position is classic illegal First Amendment retaliation.”

The First Amendment angle is what makes this case a potential landmark. The judge didn’t rule on whether autonomous weapons are ethical or whether mass surveillance is constitutional. She ruled on something more fundamental: whether the government can retaliate against a company for publicly disagreeing with it. And she said no.

Case Timeline
------------------------------------------
Jul 2025    Anthropic signs $200M DOD contract
Sep 2025    DOD demands removal of weapons/surveillance limits
Feb 2026    Hegseth designates Anthropic "supply chain risk"
Mar 24      Hearing in SF federal court
Mar 26      Judge Lin issues 43-page preliminary injunction
Apr 2 (est) Government appeal deadline

Timeline of the Anthropic v. Pentagon case

Why Developers Should Care

If you’re building on Claude’s API, you’re building on top of Anthropic’s usage policies. Those policies include restrictions on autonomous weapons and mass surveillance. Those restrictions are exactly what the Pentagon tried to force Anthropic to remove. If the government had succeeded — if the supply chain risk designation had stood — the precedent would have applied to every AI company with government contracts.

Think about what that means in practice. OpenAI‘s usage policies restrict “weapons development” and “surveillance.” Google’s Gemini policies prohibit “generating content that facilitates violence.” If the Pentagon can blacklist a company for maintaining such policies, every AI provider would face the same choice: remove your safety guardrails or lose government business entirely.

The ripple effects extend to the developer ecosystem. If AI providers are forced to remove safety restrictions for government use, those changes could propagate to commercial APIs. Safety policies that cover all deployments of a model — not just government deployments — would need to be restructured. The architecture of how AI companies implement use-case restrictions would fundamentally change.

I’ve written about Claude Code’s sub-agent system and how it orchestrates autonomous multi-step tasks. That capability operates within Anthropic’s safety framework. The legal viability of that framework is literally what this case is about.

The Silence Is Deafening

Here’s what’s conspicuously absent from this story: any public statement from OpenAI, Google DeepMind, Meta AI, or any other major AI company. Not a statement of support for Anthropic. Not a statement against the supply chain risk designation. Nothing.

The game theory explains the silence. Supporting Anthropic publicly means painting a target on your own back — the same government that blacklisted Anthropic could do the same to you. Opposing Anthropic means alienating the developer community and safety researchers who form the core of your talent pipeline. So everyone stays quiet and watches.

But the silence itself is a signal. Anthropic fought this battle alone, and the precedent it sets will benefit every AI company that maintains ethical limits on its technology. The companies that stayed silent will inherit the legal protection without sharing any of the risk. That calculus will be remembered.

What Happens Next

Judge Lin gave the government one week to appeal. An appeal is widely expected, which would send the case to the Ninth Circuit. From there, the Supreme Court could eventually take it up, particularly given the constitutional questions involved.

Legal experts describe the ruling as “landmark” while cautioning that preliminary injunctions are temporary measures. The full trial on the merits hasn’t begun and could take months. The government could also try alternative approaches to achieve the same goal — regulatory pressure, executive orders, or new procurement rules — that don’t trigger the same First Amendment analysis.

What’s already established, regardless of appeals, is the framework. An AI company set ethical limits on military use of its technology. The government retaliated. A federal court found that retaliation unconstitutional. Every future dispute between AI companies and government agencies over safety guardrails will be argued in the shadow of this case.

For developers, the practical takeaway is this: the safety policies embedded in the AI tools you use today exist because companies have chosen to maintain them. This case will determine whether that choice remains legally protected.

A company said no to autonomous weapons. The government called it a national security risk. A judge called the government’s response Orwellian. Now every AI company is deciding whether to publicly stand for the guardrails they’ve quietly built into their products.

Full Korean analysis on spoonai.me.

• CNBC — Preliminary Injunction Ruling
• CNN — Supply Chain Risk Designation Blocked
• CNBC — Hearing Details
• NPR — Post-Ruling Reaction
• Anthropic Official Statement

I sent “review the latest PR and leave comments” from my iPhone while waiting for coffee. By the time I sat down at my desk, Claude had already run git diff, analyzed 340 lines of changes across 6 files, and posted three review comments on GitHub. My Mac did the work. I did not touch it.

That scenario became real on March 25, 2026, when Anthropic shipped three features that, individually, are incremental — but combined, create something I have not seen from any other AI tool. Computer Use gives Claude direct control over mouse, keyboard, and screen. Cowork runs tasks in the background on Claude Desktop. Auto Mode uses an AI classifier to auto-approve safe developer commands. And Dispatch, the iPhone-to-Mac bridge, ties them all together.

I wrote about each of these features separately when they launched:

This piece is about what happens when you stop treating them as individual features and start using them as a single system.

How the Pieces Fit Together

The mental model is straightforward once you see it. Computer Use is the hands. Cowork is the workspace. Auto Mode is the judgment. Dispatch is the remote control.

Computer Use lets Claude interact with anything on your screen. According to Engadget, Claude reaches for the most precise tool available first. If a Slack connector exists, it uses the API. If a Google Calendar integration is set up, it goes through that. Only when there is no dedicated connector does Claude fall back to direct screen control — clicking buttons, typing text, navigating tabs. It opens browsers, finds files, runs terminal commands. No configuration required.

Cowork is the background execution environment in Claude Desktop. It launched in January, but without Computer Use it was limited to text-based tasks — drafting documents, organizing files through the filesystem API. With screen control, Cowork becomes a workspace where Claude can do virtually anything you would do manually. And it keeps working while you are away.

Auto Mode addresses a friction point in Claude Code that every developer knows: the permission prompt. Previously, you either approved every git status, every cat, every ls manually — or you set --dangerously-skip-permissions and hoped nothing went wrong. Auto Mode introduces a middle path. An AI classifier evaluates each command before execution. Safe operations run automatically. Destructive operations get blocked or require explicit confirmation. It needs Claude Sonnet 4.6 or Opus 4.6.

The combination changes the interaction model. Instead of sitting at your computer directing Claude step by step, you describe the outcome you want from your phone and Claude orchestrates the execution across tools, apps, and code.

A Real Workflow, Step by Step

Here is an actual sequence I tested. From my iPhone, I sent via Dispatch: “Check the open issues on our GitHub repo, pick the top-priority bug, create a branch, fix it if it’s straightforward, and open a draft PR.”

Claude woke up on my Mac. In Claude Code with Auto Mode, it ran gh issue list --label bug --sort priority — auto-approved by the classifier because listing issues is read-only. It identified the top issue, read the description, and checked the relevant source files. It created a branch with git checkout -b fix/issue-247 — also auto-approved. It made changes across two files. When it reached git push origin fix/issue-247, the classifier flagged it as a write operation to a remote and asked for confirmation through a notification on my phone. I approved. Claude opened a draft PR with gh pr create --draft.

The entire sequence took about four minutes. The classifier intervened exactly once, on the push. Everything else flowed automatically.

For non-coding tasks, the workflow is similar but uses Computer Use instead of Claude Code. “Summarize today’s meeting notes from Notion and post to #engineering on Slack” triggers Cowork. Claude opens the browser, navigates to Notion (or uses a connector if available), reads the notes, generates a summary, and posts it to Slack. If I am at my desk, I can watch it happen in real time — the mouse moving, pages loading, text appearing. If I am away, it runs in the background and sends a completion notification.

The Safety Architecture Matters

More autonomy requires more safety infrastructure. Anthropic built this as a two-layer system.

The input layer runs a server-side prompt injection probe. Every piece of external content Claude reads — files, web pages, API responses, shell output — gets scanned before entering the agent’s context. Prompt injection is when malicious instructions are hidden in content to hijack the AI’s behavior. If the probe detects a suspicious pattern, it adds a warning tag. Claude is trained to treat flagged content as suspect and anchor on the user’s original request.

The execution layer is the Auto Mode classifier itself. Before each tool call runs, a separate model evaluates it against a risk taxonomy: mass deletion, data exfiltration, credential access, unintended network requests. The classifier model is distinct from the model performing the task, creating an independent safety check.

User Command (iPhone)
       |
       v
  [Dispatch] ──> Mac
       |
       v
  [Cowork / Claude Code]
       |
       v
  [Input Layer: Prompt Injection Probe]
       |
       v
  [Agent Context]
       |
       v
  [Execution Layer: Auto Mode Classifier]
       |
    safe? ──yes──> Execute
       |
      no ──> Block / Ask User

This is not theoretical risk. Security researcher Johann Rehberger found a data exfiltration vulnerability in Cowork just two days after its January 2026 launch. Anthropic patched it quickly, but the incident proves that autonomous agents operating on real computers face real attack surfaces. Computer Use is currently in research preview, and apps handling sensitive data are disabled by default.

I would not run this on a machine with production credentials to AWS or a password manager unlocked. Not yet. For development work on isolated repos and general productivity tasks, the safety layer feels sufficient. For anything with real-world financial or security consequences, manual oversight is still warranted.

What This Replaces

The value proposition is not any single feature. It is the consolidation. Before this week, achieving what Claude now does out of the box required stitching together Zapier for app automation, n8n or Make for workflow orchestration, Alfred or Raycast for Mac automation, and custom scripts for Git operations. Each tool had its own configuration, its own failure modes, its own pricing.

Claude replaces a meaningful portion of that stack with a single natural-language interface at $20/month (Pro) or $100/month (Max). The limitation is macOS only, and the Computer Use feature is in research preview — meaning Anthropic might change the API or restrict functionality based on safety findings.

Microsoft’s Copilot handles Office 365 well but does not control the OS. Google’s Gemini experiments with Android device control but has no desktop equivalent. Apple Intelligence integrates deeply with macOS but does not connect to developer tools. Anthropic is the first to ship a developer-and-productivity agent that operates at the OS level with a phone-based remote control.

Whether this becomes the default way developers work depends on two things: reliability at scale (can it handle 50 tasks a day without misclicking?) and security hardening (can it safely operate on machines with production access?). Both are solvable problems with the architecture Anthropic has laid out.

One sentence from your phone. Your Mac does the work. The question is not whether this is possible — it is how much of your workflow you are willing to hand over.

Full Korean analysis on spoonai.me.

Sources:

• Anthropic Blog: Dispatch and Computer Use
• Engadget: Claude Code and Cowork Can Now Use Your Computer
• MacRumors: Claude Use Mac Remotely from iPhone
• Anthropic Engineering: Claude Code Auto Mode
• WinBuzzer: Claude Code Cowork Auto Mode
• Builder.io: Claude Code Updates

Here’s a number that stopped me cold: Anthropic‘s annualized revenue hit $19 billion. That’s 1,167% year-over-year growth. For context, the company earned its first dollar in revenue roughly three years ago. It has since grown over 10x every single year.

The source isn’t a press release or a pitch deck. It’s anonymized credit card transaction data from 28 million U.S. consumers, reported by TechCrunch on March 28. Claude paid subscriptions have more than doubled in 2026, and the trend was still accelerating through early March. People aren’t just trying Claude. They’re pulling out their wallets.

What makes this particularly interesting isn’t the raw growth. It’s the combination of factors that created it, and whether they’re repeatable.

The Pentagon Effect

In late January, Anthropic and the U.S. Department of Defense publicly clashed over the use of Claude’s AI models. Anthropic drew a hard line: no lethal autonomous operations, no mass surveillance of American citizens. The DoD wasn’t thrilled. The story made national news.

What happened next was unexpected. TechCrunch reported on March 6 that previously churned users returned to Claude in record numbers. Between January and February, the return rate hit a historical high. Consumers didn’t just notice the Pentagon dispute. They rewarded Anthropic for it.

This is the “Patagonia effect” applied to AI. When a company takes a principled stand that costs it something, a segment of consumers responds by opening their wallets. Anthropic turned a government contract dispute into a marketing event, and it wasn’t even intentional.

The Super Bowl Gambit

Anthropic ran Super Bowl ads that directly targeted OpenAI. The message: ChatGPT is showing you ads. Claude never will.

The timing was strategic. OpenAI had announced ad integration for ChatGPT’s free tier, creating immediate anxiety among users who’d grown comfortable with an ad-free experience. Anthropic’s ads essentially said, “If you don’t like where ChatGPT is heading, we’re the alternative.”

The Super Bowl spots went viral. They sparked a wave of ChatGPT-to-Claude migration conversations across developer communities, Reddit, and X (formerly Twitter). Whether those conversations converted to sustained subscribers is the real question, but the January-February credit card data suggests many of them did.

Claude Code: The Durable Growth Engine

The Pentagon dispute and Super Bowl ads are one-time events. They spiked awareness but won’t keep subscribers paying month after month. The product that actually retains paying users is Claude Code.

Claude Code launched publicly in May 2025. Less than a year later, it has run-rate revenue above $2.5 billion. Business subscriptions quadrupled since January 2026. Enterprise usage represents over half of Claude Code revenue. According to SaaStr, no B2B software product in history has grown this fast.

The March feature blitz amplified this. Anthropic shipped 14+ features in March alone: Computer Use for desktop automation, auto mode for permission-free coding, hooks for custom automation pipelines, enhanced agents for parallel tasks. Each feature makes Claude Code stickier for its existing users and more attractive to new ones.

Claude Code usage grew 300% since the Claude 4 model launch. Run-rate revenue is up 5.5x. Anthropic also shipped an enterprise analytics dashboard for tracking spend and code acceptance rates, signaling that large organizations are Claude Code’s highest-value customer segment.

The Traffic Numbers

Semrush data fills in the picture. Claude.ai hit 220 million monthly visits in January 2026, then jumped 30.9% to 288 million in February. Meanwhile, the Model Context Protocol SDK hit 97 million monthly downloads in March, up from 2 million at launch in November 2025. That’s 4,750% growth in 16 months. The developer ecosystem is building momentum that feeds back into consumer adoption.

Most new subscribers are on the Pro plan at $20 per month. This is the key signal that Claude is expanding beyond its power-user base into the general consumer market. Higher tiers exist ($100 and $200), but the mass-market growth is happening at the entry level.

5 Outages in March

Growth this fast breaks things. The New Stack documented that Anthropic suffered 5 service outages in March while shipping 14+ features. A major incident on March 2 took down claude.ai for hours. Errors spiked again on March 11 and March 25. On March 27, Opus 4.6 and Sonnet 4.6 models experienced concentrated failures.

The root cause: networking performance degradation between serving stack components. Anthropic migrated workloads to healthy infrastructure to recover. The pattern is familiar: growth is outrunning infrastructure scaling, and the engineering team is fighting to keep up.

For enterprise customers, reliability is a hard requirement. Five outages in one month is a credibility problem, regardless of how impressive the feature velocity is. Anthropic needs to solve this if it wants to keep converting enterprise trials into long-term contracts.

ChatGPT vs. Claude: A Different Kind of Race

ChatGPT still has far more total users. That’s not in dispute. But the credit card data reveals something the user-count comparison misses: Claude is winning on conversion rate.

ChatGPT’s massive free tier means millions of users who never pay. Claude’s free tier is more limited, pushing higher proportions of engaged users toward paid plans. Anthropic isn’t trying to win on total users. It’s trying to win on revenue per user.

The ad model divergence amplifies this. As ChatGPT integrates advertising into its free experience, users who specifically value an ad-free product have a clear alternative. Anthropic is betting that enough users will pay $20/month to avoid ads, and the credit card data says that bet is paying off.

The question isn’t whether Claude can overtake ChatGPT in total users. It probably can’t, at least not soon. The question is whether Claude can build a more profitable business with a smaller but more paying user base. The $19 billion ARR number suggests the answer might be yes.

Credit card transactions are the purest signal in tech. They show what people actually value, not what they click on. In 2026, an unprecedented number of people decided Claude was worth paying for.

Full Korean analysis on spoonai.me.

Sources:

• Anthropic’s Claude popularity with paying consumers is skyrocketing – TechCrunch
• Anthropic March 2026 Roundup – The New Stack
• Ramp AI Index March 2026
• Anthropic ARR – SaaStr