The Shell and the Brain: A Forensic Reading of the OpenAI-Anthropic Model Swap
OpenAI did not issue a warning. It issued a migration path.
Tibo, OpenAI's product lead, posted instructions. Keep the Claude Code shell. Replace the underlying model with GPT. Developers followed. Some Anthropic accounts were banned. Claude Code lead Boris Cherny called the bans a false positive. He said 'almost certainly' they were triggered by some other risk-control mechanism. Tibo then celebrated GPT-5.6 Sol as a model that works almost anywhere, including inside Claude Code. Paid ChatGPT Work and Codex limits were reset. The market read this as a product update. It was not a product update. It was a reorg in the application stack.
No treasury was drained. No private key leaked. No bridge contract lost its pause key. Yet the architecture of AI development has changed. This is not a blockchain story in the literal sense. It uses the same forensic categories. There is a client. There is a settlement layer. There is a translation boundary between them. The ledger remembers what the headline forgets. The headline says two labs are fighting. The ledger says model and tool are now separable. An Anthropic shell passed traffic to an OpenAI brain. The shell did not care. The brain did not care. Only the account system cared, and it cared the wrong way.
I have spent the last decade reconstructing failures. The first lesson is simple. Before reading the motive, read the packet. This report is a packet-level review of the most consequential AI compatibility event I have observed in years of watching infrastructure.
Let me define the architecture before the commentary. Claude Code is not a plugin. It is a terminal-native agent environment. It ships with a default model family, Claude, but it is also a tool orchestration layer. It can read files. It can execute commands. It can run tests. It can search code. It can edit repositories. The model is responsible for planning, task decomposition, and tool calling. The shell is responsible for safety, context, and action execution.
GPT-5.6 Sol is OpenAI's latest model. It is being positioned with unusually broad tool compatibility. It can be called through the OpenAI API. It can be used inside OpenAI's Codex. It can be used inside third-party clients. The product statement matters less than the API schema. A model becomes portable when it speaks a tool-calling format that clients can parse. Anthropic speaks Anthropic Messages. OpenAI speaks its own Chat Completions or Responses schema. To connect Claude Code to GPT, a developer has to translate. There is an adapter in the middle.
Adapters are the bridges of AI. If you have used a cross-chain bridge, you know the pattern. Wrap the asset. Modify the header. Route across a boundary. Unwrap at the destination. The asset must keep its identity. The target chain must believe it received a valid packet. The Claude Code client sends a request. The adapter converts it into GPT's format. GPT returns a tool call. The adapter converts it back. From the shell's perspective, nothing changed. From the model's perspective, it was used inside a foreign terminal. From Anthropic's telemetry, however, the client signature no longer matches the expected model fingerprint.
That is where the forensic record begins.
Now I will use the only methodology that matters for this kind of event. Chronological reconstruction.
Stage one. A developer replaces the model. Stage two. A request enters Claude Code. The client constructs a request with an Anthropic API key, an Anthropic client version, and a session identifier. But the response stream is produced by a foreign model. The request metadata says Anthropic. The output distribution says OpenAI. The token cadence is different. The refusal style is different. The function-call format is slightly different because the adapter has to normalize it. Every layer creates a fingerprint. Every fingerprint is a potential signal.
In my audit work, I have spent years following transaction paths across bridges. The first question is never who is guilty. The first question is what changed in the packet. Here, the packet changed. The account was not banned because the developer asked Claude to do something illegal. The account was banned because the risk engine saw a contradiction between the client identity and the model identity. Anthropic called it a false positive. That is one possible label. The more precise label is an integrity mismatch. The system detected that the infrastructure was not in the state it expected. It did not know the intent. It knew the fingerprint.
Boris Cherny's statement is careful. He did not say model swapping is allowed. He said 'almost certainly' this was a risk-control false positive. That tells me the codebase does not contain a rule that literally says if model output is not Claude, ban account. The rule is probably more abstract. If client behavior is anomalous in a way that resembles abuse, flag it. From Anthropic's perspective, a user calling a foreign model from its own proprietary shell is anomalous. It is not abuse in the traditional sense. But the tripwire cannot distinguish. The tripwire was not designed to distinguish. It was designed to preserve the integrity of the API surface.
This is an infrastructure fragility story, not a conspiracy story. The fragile component is not the model. The fragile component is the assumption that a tool vendor's client is a neutral terminal. It is not. It collects telemetry. It has a relationship with its own model API. It has a commercial incentive to preserve that relationship. The code is the map. The revenue is the territory. The map is not the territory. The chain is both.
Now the hidden adaptation layer. Tibo's instruction cannot be a copy-paste change of an API key. Claude Code's native request format is not identical to OpenAI's. If a developer simply changed the base URL and API key, the shell would break. There must be a translation layer. That layer may be an open-source proxy, a local gateway, or a custom shim. Tibo's instruction therefore reveals an adapter stack.
What does an adapter need to handle? First, authentication. Second, message schema. Third, tool definitions. Claude Code tells the model which tools exist. GPT must understand that prompt as its own native tool schema. Fourth, output parsing. A model returns structured tool calls. The adapter must convert them into the shell's expected format. Fifth, error handling. If the model calls a tool that does not exist, the shell will crash. Therefore the adapter must keep a vocabulary of available tools. This is almost a protocol.
If you have worked with IBC on Cosmos, you have seen this design. Standardized packet format. Commitment proof. Relayer. Light client. The adapter is the relayer. The tool-calling schema is the packet. The session is the channel. The API endpoint is the chain ID. These are not metaphors. They map one-to-one. The OpenAI-Anthropic swap is a cross-chain transfer with a human at the keyboard. The bridge is only as secure as the adapter. Every bug in the adapter is a footprint left in haste. I would not deploy a bridge adapter without an audit. I suspect most developers in this wave did not audit theirs. They are not wrong to experiment. But they are ignoring settlement risk.
Let me lay out the public record as a timeline.
Day one. Tibo posts instructions on how to configure Claude Code to use GPT. The instruction includes a reference to GPT-5.6 Sol as a model that can be used almost anywhere. That is a compatibility claim, not a quality claim.
Day two. Developers report account bans. The banned users were not using Claude models inside Claude Code. The client had been rewired. The API calls were still flowing through Anthropic infrastructure, but the model outputs were not Claude.
Day three. Boris Cherny responds with the words 'almost certainly.' That phrase is a legal haircut. It does not mean code-level proof. It means reasonable conclusion. It is not an admission. It is not a denial. It is a risk classification.
Day four. Tibo resets usage limits for all paid ChatGPT Work and Codex users. That reset is a discount on the next purchase. It is also a measurement tool.
The sequence is exactly the kind of record I would construct for a failed bridge. First, a changed packet. Second, a validation failure. Third, a governance statement. Fourth, a liquidity injection. The order tells you the incentive.
Now the economics. This event is not only technical. It is a commercial reorg.
Anthropic's business model is built on the expectation that the model and the tool reinforce each other. Claude Code attracts developers. Developers use Claude models. Model usage creates revenue. If the shell and the brain are separated, Anthropic still pays for the shell's infrastructure, still manages the client, still handles support tickets, but OpenAI captures the model fees. That is the worst asset profile in software. Own the front end. Host the user. Lose the settlement layer. It would be like a DEX front end running on someone else's chain. The front end collects no swap fees. The chain collects all gas fees. No project wants to be that dumb terminal. Anthropic cannot afford to say that in public. So it says false positives.
OpenAI has done exactly what a competitor should do in a bull market. It converted another product's distribution into a funnel for GPT-5.6 Sol. The reset of usage limits for ChatGPT Work and Codex users is a classic acquisition tactic. In crypto we call it an airdrop. The airdrop is not charity. It buys a user habit and a future billing relationship. The cost sits in OpenAI's gross margin today. The revenue sits in tomorrow's API tables. Every free request is a telemetry point. Every telemetry point trains the product. The generosity is also a data flywheel. That is not a criticism. It is an accounting observation.
The wider market effect is less obvious. This event signals the end of vertical lock-in at the model level. Developers now know that the leading agent shell can be pointed at a competing model. The failure mode is not that the model is bad. The failure mode is that the adapter is fragile. So a new layer appears. Model routing. Fallback logic. Observability. Cost controls. Middleware companies will emerge. Some will be APIs. Some will be local proxies. Some will be open-source packages. The function will be the same. Decouple the agent shell from the model vendor.
MCP, the Model Context Protocol, is already the leading candidate for this standard. MCP allows tools to be exposed to models without making a tool vendor sign a formal alliance with a model vendor. Anthropic built MCP. It opens the door to exactly the kind of replacement that happened here. That is the cruel irony of open standards. The protocol that gives you interoperability also gives your competitor access to your distribution. The same dynamic occurred with Ethereum. The same dynamic occurred with Uniswap. The same dynamic will occur with Claude Code. A neutral protocol cannot be used as a moat by one party.
But neutrality is a process, not a slogan. We need to inspect where the protocol is hosted, who controls the schema, and who can update it. In blockchain terms, that is governance. If MCP semantics change under pressure from a model vendor, the adapter breaks. If a model vendor's output does not conform to the schema, the shell crashes. The standard only works if it is versioned, tested, and enforced. That requires an audit culture. The AI industry does not have an audit culture yet. It has benchmarks and release notes. Benchmarks are noise. The audit trail is the signal. Silence in the code speaks louder than the pitch.
Do not mistake dozens of model gateways for progress. The same pattern appears in Layer2s. Dozens of chains. One user base. Fragmented liquidity. Model gateways will do the same to tool calls. The winner will not be the gateway with the most integrations. It will be the project with the clearest audit trail.
I have watched IBC become a technically elegant protocol while the Cosmos application ecosystem remained fragmented and ATOM captured almost no value. MCP faces the same risk. The protocol is necessary. It may not be sufficient. The value may accrue to the routing layer that knows how to settle between models, not to the standard itself.
Now the open questions. I want to see the exact trigger signal. Did Anthropic flag on request frequency? Did it flag on token distribution? Did it flag on tool-call formatting? That is not public yet. I suspect the signal is a statistical model of output behavior, not a simple rule. If so, the account ban was a deterministic consequence of a probabilistic system. That is the most dangerous kind of risk control. It can be fooled by genuine Claude outputs. It can mistakenly punish honest users. Any risk engine that produces irreversible account bans without a public appeal chain is a custody failure. In blockchain, a custody failure is a bug. In AI, it is a policy. The distinction between a bug and a policy is not always visible in the code.
The performance question is also open. How much capability is lost when GPT is forced through Claude Code's tool-calling format? Some tool calls will be translated poorly. Some tools will be invisible. Some safety contexts will be missing. I would not trust a swap test that only measures code generation. I would measure function-call precision, error-recovery rate, and task completion time. Those are the structural metrics. A benchmark is a photograph. A task log is an audit. Precision is the only apology the chain accepts.
There is a compliance dimension as well. If AI coding tools become part of the critical software supply chain, a model swap is not a toy. It is a dependency change. In software supply chains, dependencies are audited. The same should apply to model routes. A team that switches Claude Code to GPT may be changing its security boundary. The model's safety training, data retention, and tool permissions are different. Enterprise procurement should demand model routing transparency and usage logs. This is not a feature. It is compliance.
When I proposed an on-chain surveillance framework to financial authorities, I did not recommend more surveillance. I recommended more structured data. The same principle applies here. The industry does not need more bans. It needs a public taxonomy of risk-control signals. If a risk engine flags a user, there should be a signed record of why. If an account is banned, there should be an appeal path. If a model route is changed, there should be a log entry. None of this exists today. The absence of an audit trail is itself the finding.
The largest missing item is evidence. We do not have the exact adapter code. We do not have the ban log. We do not have a model fingerprint. We have a product manager's instruction, a lead developer's risk assessment, and screenshots. Screenshots are not proof. Screenshots are noise. The hash is the identity. The absence of a public proof is not evidence of a conspiracy. It is evidence of an immature audit culture. In a mature infrastructure market, an event like this would produce a post-mortem with timeline, affected accounts, root cause, and remediation. Instead, we have a support thread.
This is the part that worries me more than the swap itself. The AI stack is becoming production infrastructure. Its confidence mechanisms are still social. The market learns about a ban from a developer's tweet. The vendor responds with a probabilistic statement. The next developer has no way to verify. The system's integrity cannot be checked by anyone outside the vendor. This is not the same as a blockchain, where a validator's signature can be checked by anyone. The ledger remembers. The risk engine forgets.
Now I have to correct my own bias. The bulls are right about some things.
This event was a successful demonstration of interoperability. A developer took a production agent shell and swapped the underlying model. It worked. The response was not a hard fork. It was a false-positive claim. That is meaningful progress. In 2017, this would have been impossible. In 2025, it is a config change. The reset of usage limits was also a rational investment. That is not a flaw. It is an asset. Companies are not charities. The AI market is in a bull phase. Winning developers matters more than protecting margin. The event will push both labs to become more open.
I also respect the restraint in Anthropic's response. It could have changed its terms to explicitly prohibit third-party model use. It did not. It left a narrow bridge between legal rigidity and developer goodwill. That is difficult governance. It is like a validator that detects a double-sign but chooses to report it as a network anomaly. The anomaly still gets fixed. The validator avoids a governance war. The price is that the community never sees the true classification. That is not ideal. But it is better than an unwritten ban enforced silently.
Headlines will treat this as a fight between labs. The product screenshots will show GPT running inside Claude Code. Pics are noise. The hash is the identity. The only identity that matters is the request route and the model output signature.
The next base layer will not be a model firm. It will be the protocol that lets models move between tools without calling their parents. That protocol is not a marketing page. It is a set of schemas, adapters, and audit logs. It needs a settlement layer, a relayer, and a light client. It needs a risk engine that can distinguish between experimentation and abuse. It needs a governance process that can be reviewed.
Every API endpoint is a potential reorg. Every default route is a potential lock-in. The ledger remembers what the headline forgets.
Watch which vendor ships a neutral routing standard and then actually allows another lab's model to use it without retaliation. That vendor will not be the winner of a model war. It will be the base layer of the next developer stack. The rest will be forks with better marketing.