Zum Hauptinhalt springen
Echtzeit-Radar & Feeds
Alle RSS Feeds ➔
👥 Community & Social
•••••
Unix & Linux ServerSecurity: Mehrere Probleme in Octavia (Ubuntu)(25.09.2026 um 02:44 Uhr)
•
Linux Tipps & HardeningSecurity: Mehrere Probleme in libreoffice (Debian)(25.09.2026 um 02:45 Uhr)
•••••••••
Unix & Linux ServerSecurity: Mehrere Probleme in Octavia (Ubuntu)(25.09.2026 um 02:44 Uhr)
•
Linux Tipps & HardeningSecurity: Mehrere Probleme in libreoffice (Debian)(25.09.2026 um 02:45 Uhr)
••••
Intelligence View
⚡ tsecurity.de Intelligence

Credit-Based vs. Classic SaaS Pricing: what the GitHub and Anthropic billing shifts reveal

TL;DR Within two weeks in June 2026, GitHub Copilot moved its monthly plans to metered AI credits and Anthropic pulled programmatic Claude usage out of the flat subscription into a separate credit pool billed at API rates. If you are…

0
↗ Quelle (dev.to)
Reagiere als Erste:r — dein Feedback zählt!




TL;DR



Within two weeks in June 2026, GitHub Copilot moved its monthly plans to metered AI credits and Anthropic pulled programmatic Claude usage out of the flat subscription into a separate credit pool billed at API rates. If you are building an AI SaaS, the question is no longer whether to meter usage, but which billing model fits your cost structure: credit-based or classic subscription.






The problem



Most AI products still run on the classic billing model: pay a fixed monthly fee, use the product as much as you want. AI coding tools sold that promise too, and it worked while most users were light users. Agents broke it.



On June 1, 2026, GitHub Copilot switched its monthly plans to usage-based billing. Premium Request Units were replaced by "GitHub AI Credits" tied to actual token consumption at API list prices; annual plans keep the old model until they renew. The plan base prices stayed the same (Pro at 10 dollars, Pro+ at 39, Business at 19 per seat), but token-heavy work got more expensive. Developers who ran their April usage through the new billing preview reported projections jumping from roughly 29 dollars to 750, in one case from 50 to around 3,000. By June 2, the community thread had collected 435 comments and over 900 downvotes against just 22 upvotes.



Two weeks later, on June 15, Anthropic splits Claude subscriptions. The scope is narrower than Copilot's move, and worth stating precisely: only programmatic usage leaves the flat subscription, meaning the Agent SDK, claude -p, Claude Code GitHub Actions, and third-party apps authenticating through the SDK. Interactive use, including Claude Code in the terminal, stays in the base subscription. Most subscribers will not notice anything. But if you build automation on top of Claude, that usage now draws from a capped monthly credit pool (20 dollars for Pro, 100 for Max 5x, 200 for Max 20x), billed at full API rates, with no rollover.



Both moves point to the same underlying economics: the inference cost of complex agent sessions is not sustainable under flat rate. Developers report single agentic sessions burning 30 to 40 dollars in credits. A 10-dollar subscription does not add up against that.



If the model providers cannot make flat rate work for agentic usage, neither can you. So how should you price an AI product?






The solution: two viable models



There is no single right answer, but there are two coherent ones. The mistake is picking neither and hoping flat rate holds.






Credit-based pricing



Users buy a balance of credits and spend them as they consume AI features. Each action (a chat completion, a RAG query, an image generation) costs a known amount of credits, and credits map to your real token cost plus margin.



This fits products where usage and cost vary a lot per user. It passes the variability of AI cost through to the people who actually create it, which is exactly what GitHub and Anthropic just did. The hard parts are metering accuracy, top-up flows, and making the credit-to-value mapping legible so users do not feel nickel-and-dimed.






Classic subscription



A fixed monthly fee for a tier of features. This still works, but only when you can bound the AI cost per user: cap requests, gate expensive features behind higher tiers, or rate-limit heavy actions. The risk is the GitHub problem in miniature. If your heaviest users can consume unlimited expensive inference on a flat fee, your margin erodes silently.



The honest version of classic subscription in 2026 includes hard usage caps and a clear upgrade path, not unlimited promises.






How it works in practice



Whichever model you choose, the same infrastructure has to sit underneath it. This is the real lesson of the two-week window: cost governance is not a feature you add later, it is a foundation you build first.



A production-ready AI SaaS needs at least four things from day one:




1. Token tracking      -> count input, output, and cached tokens per request
2. Per-user budgets -> enforce limits before the expensive call, not after
3. Rate limiting -> protect both cost and stability under load
4. Multi-provider fallback -> never be hostage to one vendor's price change






That last point matters more after this June than before it. Anthropic's split is a single-provider cost event. If your app routes only to one vendor, a pricing change like this lands directly on your P&L. An abstraction layer across OpenAI, Anthropic, Google, and xAI turns "the provider raised prices" into "switch the default model," which is a config change, not a crisis.



When I built nextsaas.ai, an AI-first Next.js boilerplate, I made both pricing models a config switch rather than a rewrite, and I put token tracking, budgets, rate limiting, and provider fallback in the core. Not because I predicted this exact fortnight, but because variable AI cost was always going to reach every application eventually. June 2026 just made the deadline concrete.






Try it yourself



Before you ship your next AI feature, answer one question: if your ten heaviest users tripled their usage tomorrow, would your pricing survive it? If the answer is no, you are running the flat-rate bet that GitHub and Anthropic just walked away from.



Pick credit-based if usage varies wildly per user. Pick classic subscription if you can bound the cost per tier. Either way, build the metering first.



If you found this useful, follow me on Dev.to or GitHub.

IoC Intelligence (1 Indikatoren)
dev[.]to
CTI Threat Relationship Graph3 Knoten / 2 Relationen
CVE / Incident Software MITRE ATT&CK CWE Weakness IoC
SOC Incident Playbook: Remote Code Execution (RCE) Defense
Syntax validiert (0 Fehler)
title: Detect Exploitation - Credit-Based vs. Classic SaaS Pricing: what the GitHub and Anthropic billing shifts reveal
id: b28329b9-cf92-4a8d-83f4-a76fa3cd0648
status: experimental
description: Automatisch generierte SIEM-Erkennungsregel basierend auf CTI Intelligence
references:
  - https://tsecurity.de/
author: iShareStuff CTI Automated Detection Engine
date: 2026-09-25
logsource:
  category: network_connection
  product: any
detection:
  selection:
      DestinationHostname:
        - 'dev.to'
  condition: selection
falsepositives:
  - Legitime administrative Zugriffe oder Penetrationstests
level: high
tags:
  - attack.initial_access
Syntax validiert (0 Fehler)
rule CTI_Threat_Indicator {
    meta:
        author = "iShareStuff CTI Automated Detection Engine"
        date = "2026-09-25"
        description = "YARA Signature for "
    strings:
        $str = "Credit-Based vs. Classic SaaS " ascii wide
    condition:
        any of them
}
Syntax validiert (0 Fehler)
index=security sourcetype IN ("cisco:asa", "pan:traffic", "zeek_conn", "suricata", "WinEventLog:Security")
(dest_host="dev.to")
| stats count earliest(_time) as first_seen latest(_time) as last_seen by src_ip, dest_ip, dest_host, signature
| eval first_seen=strftime(first_seen, "%Y-%m-%d %H:%M:%S"), last_seen=strftime(last_seen, "%Y-%m-%d %H:%M:%S")
| sort - count
Syntax validiert (0 Fehler)
destination.domain: ("dev.to") and event.category: "network"
Syntax validiert (0 Fehler)
CommonSecurityLog
| where DestinationHostName in ("dev.to")
| summarize EventCount = count(), FirstSeen = min(TimeGenerated), LastSeen = max(TimeGenerated) by SourceIP, DestinationIP, DestinationPort, Activity
| extend DetectionRule = "iShareStuff-CTI-Compiled"
| sort by EventCount desc
🎯
MITRE ATT&CK Matrix Navigator 14 Taktiken
Reconnaissance
-
Resource Development
-
Initial Access
Execution
Persistence
-
Privilege Escalation
Defense Evasion
Credential Access
-
Discovery
-
Lateral Movement
-
Collection
-
Command and Control
Exfiltration
-
Impact
tsecurity.de Cognitive Threat RAG
Fokus-Vektor:

Kognitive Analyse für identifizierte Bedrohung: Erhöhte Bedrohungslage im Bereich Credit-Based vs. Classic SaaS Pricing: w.... Basierend auf 368k Vektor-Korrelationen werden sofortige Isolationsmaßnahmen für betroffene Endpunkte empfohlen.

🛡️ Angriffsfläche & Exposure

Netzwerk/Remote-Zugriff ohne Vorauthentifizierung möglich.

⚡ Empfohlene Sofortmaßnahmen
  • 1. Perimeter-Inspektion: Relevante Portfreigaben und exponierte Endpunkte unverzüglich scannen.
  • 2. Patch-Applikation: Hersteller-Hotfix einspielen oder betroffene Daemons in isolierte DMZ-Segmente überführen.
  • 3. Telemetrie & EDR-Alerts: Prozessaufrufe und Child-Processes auf anomale Shell-Spawns überwachen.
🔗 Semantisch verwandte Zero-Days MariaDB 11.7 VEC
Ähnliche Beiträge
🔍 Verwandte News

Auch interessante Nachrichten Credit-Based vs. Classic SaaS Pricing: what the GitHub and Anthropic billing shifts reveal

Thematisch verwandte Begriffe: CreditBased, Classic, SaaS, Pricing · 6 Treffer

Laden...

Videos werden geladen ...

Laden...

Beiträge werden geladen ...

Laden...

Videos werden geladen ...

Laden...

Beiträge werden geladen ...

Laden...

Videos werden geladen ...

Laden...

Beiträge werden geladen ...

Laden...

Videos werden geladen ...

Laden...

Beiträge werden geladen ...

Laden...

Videos werden geladen ...

Zum Aktualisieren ziehen
ZERO-DAY CVE-2026-87722 | Uncontrolled Resource Consumption (CWE-400 / CWE-1333) in regex search q…
Advisory →
tsecurity.de Icon
Offline-Lesen, Eilmeldungen & 0ms Ladezeit

Installiere tsecurity.de direkt auf deinen Home-Bildschirm für das ultimative Vollbild-Magazinerlebnis ohne Browser-Leisten.

Nächster Beitrag
Themen-Radar & Intelligence Matrix
Echtzeit-Taxonomie nach Angriffsvektoren & Plattformen

tsecurity.de Live Threat Radar

🔴 LIVE RADAR
MONITORING
AKTIV
CVE-DATENBANK
LIVE
🔍
Community Radar & Live Chat
Sentinel Bot online • Live-Stream
Dein Cluster: Security Explorer
Match:
lädt…
Verbindung zum Community-Stream wird aufgebaut...
Bearbeitungsmodus — Senden überschreibt deine Nachricht
Community-Puls — was gerade passiert
lädt…
Aktivitäten deiner Analysten
lädt…
Neues Thema oder Eilmeldung einreichen

Reiche interessante Links, Zero-Days oder Debatten ein. Die Community entscheidet per Upvote über die Veröffentlichung.

Heiß diskutierte Einreichungen
📂 Keine gespeicherten Artikel vorhanden.
Zurück Ziehen Vor
Links: vorheriger Artikel • Rechts: nächster Artikel • unten: schließen
News NIS-2 Frühwarnung Tier-1 Intel TTP ⏱️ 3 Min vor 10 Min
Artikeldaten werden geladen...
↗ Original-Quelle