AI Lock-in: What the Conway Leak Means for Your Multi-Model Strategy

TL;DR for the busy

Anthropic accidentally leaked 512,000 lines of Claude Code source on March 31, 2026. Inside: an unannounced project called Conway, an always-on agent with a proprietary .cnw.zip extension format. In parallel, they cut access to third-party harnesses like OpenClaw with 24 hours of notice. The pattern is clear: the model layer stays competitive, the execution layer is closing. The fix for operators: local Markdown context, multi-model by default, agent memory treated as technical debt. Portability is something you build before you need it.

A client comment that made me dig

Mid-April, a CEO of a mid-size company tells me: "Cowork reorganized my whole Drive, my email, my invoicing. I can't go back."

Not "I don't want to." "I can't." That distinction matters.

This is the endowment effect applied to enterprise AI: once a tool has absorbed your processes, the psychological cost of leaving outweighs the rational cost of staying. Except with learning agents, the leaving cost stops being just psychological. It becomes technical, operational, and soon structural.

Which is exactly what the Conway leak forces us to look at.

What leaked (and shouldn't have)

On March 31, 2026, Anthropic accidentally publishes 512,000 lines of Claude Code source on npm via a packaging error. Researcher Chaofan Shou identifies the source map within hours. Anthropic sends a DMCA. Too late: the code is already mirrored across multiple repos.

Beyond the security angle, researchers find 44 hidden feature flags. Three deserve attention:

• Project Conway: always-on agent, separate UI from chat
• CNW extension framework: proprietary .cnw.zip format
• Webhook system and persistent memory: for sessions lasting days, sometimes weeks

Conway would run continuously on external triggers (email, ticket, deploy) without you in front of the screen. Not another feature, a different category of product. Cowork acts when you ask. Conway would act for you, all the time.

Anthropic hasn't announced it. But the code talks.

The thesis: Anthropic is building the next big walled garden

Stack up what's shipped in the last 6 months:

• Claude Code (2024) — Devs, on request
• Cowork (January 2026) — Non-technical, extended on request
• Channels (March 2026) — Everyone, remote piloting
• Routines (April 2026) — Everyone, cloud-hosted
• Conway (internal testing) — Everyone, always-on

The pattern is not a model, it's a learning execution layer. The more you use it, the better it knows you. The better it knows you, the more value it has. The more value it has, the harder it is to replace.

Classic switching cost, 2026 edition.

The mechanism worth understanding: data portability is legally framed (GDPR, etc.). When you switch providers, you can pull your files. But agent context portability — how it learned to work for you over 6 months — has no standard, no obligation, no framework. That's the new capture angle, and nobody is talking about it.

The OpenClaw episode in early April confirms the strategy. OpenClaw is a third-party harness, built by Peter Steinberger. It let users run Claude through an alternative UI using their Pro or Max subscription. On April 4, 2026, Anthropic cuts access. Official reason: their own tools are optimized for prompt caching, third-party harnesses bypass these optimizations, so unsustainable server load.

The economic argument holds. A Max subscriber at $200/month could theoretically consume thousands of dollars in direct API via OpenClaw. That's arbitrage, not a feature.

But the execution was brutal: less than 24 hours of notice, no grace period, no migration window. Steinberger, who has since joined OpenAI, publicly called it "a betrayal of open-source developers." The signal for operators is clear: the line between "open" and "captive" moves based on what threatens Anthropic's economics. That's their right. It's your problem if you built on it without a plan B.

The antithesis: Anthropic is also the most open of the major labs

It would be dishonest to stop there. Anthropic plays open in places they could have closed, and that changes the strategic read.

December 2025: Anthropic donates the Model Context Protocol (MCP) to the Linux Foundation, in a new entity called the Agentic AI Foundation. MCP now has more than 10,000 active public servers and has become the de facto standard adopted by OpenAI, Google, and Microsoft. Governance stays neutral, maintainers continue to prioritize community input. They could have kept it proprietary. They gave it away.

Same nuance on pricing. Claude Opus 4.7 lists at $5/M input tokens and $25/M output. But with prompt caching, cache reads drop to $0.50/M (90% reduction). Batch processing cuts another 50%. At optimized usage, you're at 5% of sticker price. That's not dumping, but it's not captive pricing either.

And on Mythos, the internal model "too dangerous to deploy": Anthropic publishes its Responsible Scaling Policy, defining its own capability thresholds beyond which a model needs additional safeguards before deployment. You can call that marketing, but no other major lab publishes its red lines that explicitly.

So the honest read: Anthropic locks the experience layer (Conway, .cnw.zip, always-on agents) while opening the connectivity layer (MCP, public RSP). That's sophisticated. The right question isn't "is Anthropic evil?" but "what's open, what's closed, where do I put my eggs?"

The inversion test: what would block you from leaving?

Before I give you my recommendation, here's an exercise I run with clients. Flip the question. Instead of "how do I know I'm in good shape with Anthropic?", ask "what would block me from leaving tomorrow?"

Typical answers I get during audits:

• "We have 18 months of custom prompts in the agent memory." → Behavioral capture.
• "Our team is only trained on Claude." → Human switching cost.
• "All our automations run through Routines." → Infrastructure lock-in.
• "Our end clients only know ChatGPT and Claude." → Marketing lock-in.
• "We optimized all our prompts for the Claude tokenizer." → Technical lock-in.

Check 3+ boxes and you're not a customer anymore. You're captive. The day Anthropic doubles prices, kills a feature, or pivots (reminder: OpenClaw, 24-hour notice), you eat the loss.

This isn't a doomsday scenario, it's risk management. Any serious company thinks about supplier redundancy. AI deserves the same treatment.

The practical synthesis: 3 principles that work

I work with SMBs, scale-ups, craftspeople, industrial operators. The question is always the same: "What do we use, how do we avoid getting burned 18 months from now?"

1. Keep your context in Markdown, locally

Your processes, guides, meeting notes, prompts that work: all in .md on disk or in a repo. Not in the proprietary memory of a single tool.

Concrete benefits:

• Readable by any model (Claude, GPT, Gemini, DeepSeek, Mistral, local models)
• Version-controlled via git, no loss
• Readable in 20 years, independent of provider changes
• Enables multi-model without rewriting

The structure I use with clients: 4 folders, that's it. Projects (active, short-term), Hats (permanent roles), Resources (processes, guides, frameworks), Archives (done, kept for reference). Point your agent at it, regardless of which agent. If you switch providers, your context follows.

Not sexy. Just works.

2. Multi-model by default, not by exception

DeepSeek V4 Flash at $0.14/M input handles 70% of routine tasks (classification, summaries, simple extraction). Opus stays ahead for complex code and agent workflows. Mythos, when it lands in broad access, takes the deep research layer.

Building your stack around a single provider is putting a noose on yourself. Building around 2-3 you switch by task is architecture. Multi-model adds 1-2 days of setup. It potentially saves you several weeks of migration later.

Concretely: an LLM router in your code (LiteLLM, OpenRouter, or your own wrapper), prompts tested on at least 2 providers, and an internal benchmark on your own business tasks. Not an MMLU benchmark, a benchmark on your tasks.

3. Be wary of agent memory, not tools

Cowork, Conway, Microsoft Copilot, Salesforce Einstein, all of them learn how you work. That's their value and their capture mechanism. Not a bug, the business model.

If you deploy an always-on agent for a client, address these 3 questions from day one:

• Who owns the memory (you, your client, the vendor)?
• How does it export if we want to switch?
• What do we keep outside the agent (as documented knowledge) so we don't depend solely on its memory?

Not a blocker. A checklist. You can still use the tools. You just know where you stand.

The 4.7 tokenizer detail: why dependency costs you without warning

If I had to keep one fact to illustrate the silent cost shift, it's this one. Opus 4.7 uses a new tokenizer that can produce up to 35% more tokens for the same text, at stable sticker price.

So even without changing your usage, your bill can rise 35%. Not malicious: it's probably a better tokenizer, more efficient for the model. But this is what happens when you depend on a single platform. Internal changes hit your P&L without you being able to react.

Not a conspiracy. Just the reality of dependency, in any market.

What to take away

Anthropic isn't running a heist. They're executing a classic business strategy, and doing it better than most: capture devs with Code, expand to non-technical users with Cowork, build stickiness with Conway, keep MCP open to stay credible on the ecosystem.

The problem isn't Anthropic. The problem is if you build your business on it without thinking about your exit. Not just data, but operational memory, learned processes, extracted patterns.

My current recommendation to clients: use Claude where it's best, which is many places. But keep your knowledge outside the garden. Local Markdown, multi-model in the stack, agents treated as replaceable tools, not as irreplaceable colleagues.

Portability is something you build before you need it. Not after.

To confirm in the coming months — Conway hasn't shipped yet, neither has Mythos, the industry can pivot. But the pattern is clear enough that I'm wiring my clients up for it now.

If this article helped you think through your AI strategy, let's talk. Digital Easy runs multi-model audits for SMBs and scale-ups who want AI without the dependency. Book a 20-minute Discovery Call.