AI Lock-in: What the Claude Code Leak and Conway Mean for Your Multi-Model Strategy

TL;DR for the busy

On 31 March 2026, Anthropic accidentally published more than 512,000 lines of Claude Code's source. Inside: KAIROS, an always-on agent mode. The next day, a separate analysis revealed Conway, a permanent agent platform with its own extension format, .cnw.zip. A few days later, Anthropic stopped honouring Claude subscriptions in third-party tools like OpenClaw. The pattern is clear: the model layer stays competitive, the execution layer closes. The fix for operators: local Markdown, multi-model by default, agent memory treated as technical debt. Portability is built before you need it.

A client comment that made me dig

In mid-April, an SME owner told me: "Cowork reorganised my whole Drive, my emails, my invoicing. I can't go back."

Not "I don't want to". "I can't". That nuance is everything.

It's the classic endowment effect applied to business AI: once a tool has absorbed your processes, the psychological cost of leaving exceeds the rational cost of staying. Except that with learning agents, the cost of leaving is no longer just psychological. It becomes technical, operational, and soon structural.

That's exactly what the Claude Code leak and the discovery of Conway force us to look at.

What leaked (and shouldn't have)

On 31 March 2026, Anthropic accidentally published more than 512,000 lines of Claude Code source on npm, through a source map file left in the package. Researcher Chaofan Shou spotted it within hours. Anthropic called it a human packaging error and pulled the package. Too late: the code had already been copied to many forks and mirrors.

Beyond the security angle, the code revealed features not yet launched. The most discussed is KAIROS: a daemon mode where Claude Code runs as a permanent background agent, consolidating its memory while you're away.

The next day, 1 April, TestingCatalog published a separate analysis of the Claude app's code: Anthropic is testing Conway, an always-on agent platform. Three elements deserve attention:

• An interface separate from chat: Conway runs in its own instance, with its own spaces
• A proprietary extension format: tools, tabs and context handlers installable as .cnw.zip files
• Webhooks: public URLs able to wake the agent when an external service calls them

Conway would act continuously on external triggers (email, ticket, deploy) without you in front of the screen. Not one more feature, a different product category. Cowork acts when you ask. Conway would act on your behalf, permanently.

Anthropic had announced nothing when this article was published. But the code speaks, twice in the same week.

The thesis: Anthropic is building the next big walled garden

Line up what has shipped over the past months:

• Claude Code (February 2025): developers, on demand
• Cowork (January 2026): non-technical users, extended on-demand
• Channels (March 2026): remote control from a messaging app
• Routines (April 2026): automations hosted in Anthropic's cloud
• KAIROS and Conway (not launched): always-on

The pattern isn't a model, it's a learning execution layer. The more you use it, the better it knows you. The better it knows you, the more valuable it becomes. The more valuable it becomes, the harder it is to replace.

It's classic switching cost, 2026 edition.

The mechanism to understand: data portability is legally framed (GDPR, Data Act). When you switch providers, you can get your files back. But the portability of agent context, meaning how it learned to work for you over six months, has no standard. It's the new capture angle, and nobody talks about it.

The OpenClaw episode in April confirms the strategy. OpenClaw is a third-party harness, created by Peter Steinberger, that let you use a Claude subscription to drive Claude through an alternative interface. On 4 April 2026, Anthropic announced that subscription limits would no longer apply to third-party tools such as OpenClaw: their usage moved to pay-as-you-go billing, separate from the subscription. The official reason: subscriptions weren't built for the usage patterns of these tools, which bypass Anthropic's caching optimisations.

A defensible economic argument. A flat-rate subscription consumed by a third-party tool that doesn't benefit from the cache costs more to serve than planned. That's arbitrage, not a feature, and Anthropic offered refunds to affected subscribers.

But the signal is clear. Steinberger, who had moved to OpenAI two months earlier, said he only managed to get a one-week delay, and summed it up: "first they copy some popular features into their closed harness, then they lock out open source." The signal for operators: the line between "open" and "captive" moves according to what threatens Anthropic's economics. That's their right. But it's your problem if you built on it without a plan B.

The antithesis: Anthropic is also the most open of the major labs

It would be dishonest to stop there. Anthropic plays open on fronts where they could have closed, and that changes the strategic reading.

December 2025: Anthropic donates the Model Context Protocol (MCP) to the Linux Foundation, in a new entity called the Agentic AI Foundation. The Linux Foundation counts more than 10,000 published MCP servers, and the protocol has been adopted by ChatGPT, Gemini, Microsoft Copilot, Cursor and VS Code. They could have kept it proprietary. They gave it away.

On pricing, same nuance. Claude Opus 4.7 lists at $5/M input tokens and $25/M output. But with prompt caching, cache reads drop to $0.50/M, a 90% reduction, and batch processing halves the price again. On cached input processed in batch, you pay 5% of the list price. That's not dumping, and it's not captive pricing either.

And on safety, Anthropic publishes its Responsible Scaling Policy, with capability thresholds beyond which a model requires extra safeguards before deployment. Mythos illustrates it: Anthropic does not plan to make Claude Mythos Preview generally available and reserves it for partners securing critical software. You may find that marketing. Anthropic isn't alone, either: OpenAI and Google DeepMind publish comparable frameworks. But it's a transparency you don't find on the product layer.

So here's the honest reading: Anthropic locks down the experience layer (Conway, .cnw.zip, always-on agents) while opening the connectivity layer (MCP) and publishing its safety rules. It's sophisticated. The right question isn't "is Anthropic evil?" but "what's open, what's closed, and where should I put my eggs?"

The inversion test: what would block you from leaving?

Before I give you my recommendation, here's an exercise I run with clients. Flip the question. Instead of "how do I know I'm in good shape with Anthropic?", ask "what would block me from leaving tomorrow?"

Typical answers I get during audits:

• "We have 18 months of custom prompts in the agent's memory." → Behavioural capture.
• "Our team is only trained on Claude." → Human switching cost.
• "All our automations run through Routines." → Infrastructure lock-in.
• "Our end clients only know ChatGPT and Claude." → Marketing lock-in.
• "We optimised all our prompts for the Claude tokenizer." → Technical lock-in.

If you tick 3 boxes or more, you're not a customer anymore. You're captive. And the day your provider decides to change its prices, cut a feature or pivot (remember: OpenClaw, one week's grace), you take the hit.

This isn't a doomsday scenario, it's just risk management. Every serious company thinks about supplier redundancy. AI should be treated the same way.

The practical synthesis: 3 principles that work

I work with SMEs, scale-ups, craftspeople, manufacturers. The question always comes back: "What do we use, and how do we avoid messing up in 18 months?"

1. Keep your context in Markdown, locally

Your processes, guides, meeting notes, prompts that work: all in .md on disk or in a repo. Not in the proprietary memory of a single tool.

Concrete benefits:

• Readable by any model (Claude, GPT, Gemini, DeepSeek, Mistral, local models)
• Versioned with git, so nothing gets lost
• Readable in 20 years, independent of provider changes
• Enables multi-model without rewriting

The structure I use with clients: 4 folders only. Projects (active, short term), Hats (permanent roles), Resources (processes, guides, frameworks), Archives (done, kept for reference). You point your agent at it, whatever the agent. If you switch providers, your context follows.

Not sexy. It works.

2. Multi-model by default, not by exception

For everyday tasks (classification, summaries, simple extraction), cheap models like DeepSeek cost a fraction of Opus, often less than a tenth per token. Opus stays ahead for complex code and agent workflows. Don't take my word for the split: measure it on your own tasks.

Building your stack around a single provider is putting a rope around your neck. Building around 2 or 3 that you switch by task is architecture. Multi-model adds a bit of setup up front. It spares you a full migration the day you have to switch.

In practice: an LLM router in your code (LiteLLM, OpenRouter, or your own wrapper), prompts tested on at least 2 providers, and an internal benchmark on your own business tasks. Not an MMLU benchmark, a benchmark of your tasks.

3. Be wary of agent memory, not tools

Cowork, Conway, Microsoft Copilot, Salesforce Einstein: they all learn how you work. That's their value and their capture mechanism. Not a bug, the business model.

If you deploy an always-on agent for a client, settle these 3 questions from day one:

• Who owns the memory (you, your client, the provider)?
• How does it export if you want to switch?
• What do you keep outside the agent (as documented knowledge) so you don't depend solely on its memory?

It's not a blocker. It's a checklist. You can still use the tools. You just know where you're stepping.

The 4.7 tokenizer detail: why dependency costs you without warning

If I had to keep a single fact to illustrate how costs shift silently, it's this one. Opus 4.7 uses a new tokenizer: the same text can produce between 1 and 1.35 times more tokens depending on the content type, at an unchanged price per token.

So even without changing your usage, your bill can rise by up to 35% on some content. Not out of malice: it's probably a better tokenizer, more efficient for the model. But it's typical of what happens when you depend on a single platform. Internal changes hit your P&L without you being able to react.

It's not a conspiracy. It's just the reality of dependency, in any market.

What to take away

Anthropic isn't orchestrating a heist. They're executing a classic business strategy, better than most: capture developers with Claude Code, expand to non-technical users with Cowork, prepare stickiness with always-on agents, keep MCP open to stay credible on the ecosystem.

The problem isn't Anthropic. The problem is building your business on it without thinking about your exit. Not just the data, but the operational memory, the learned processes, the extracted patterns.

My recommendation to clients right now: use Claude where it's best, which is a lot of places. But keep your knowledge outside the garden. Local Markdown, multi-model in the stack, agents treated as replaceable tools and not as irreplaceable colleagues.

Portability is built before you need it. Not after.

To be confirmed in the coming months: Conway and KAIROS had not launched when this article was published, and the industry can turn. But the pattern is clear enough that I'm starting to wire my clients for it now.

If this article helped you clarify your AI strategy, let's talk. Digital Easy runs multi-model audits for SMEs and scale-ups that want AI without the dependency. Book a 20-minute Discovery Call.