In the space of a few days in February 2026, two of the biggest AI providers moved against the same practice. Anthropic made explicit that OAuth tokens from consumer subscriptions can’t be used in third-party tools. Days later, Google began restricting Google AI Ultra subscribers who had connected their accounts to OpenClaw, the popular open-source agent framework.
Headlines called it a “ban wave”. The more useful way to see it is as the end of a pricing loophole. Here’s what happened, why providers care so much, and how to run AI agents in a way that won’t get you locked out.
What happened
OpenClaw’s rise
OpenClaw is an open-source agent framework that launched in November 2025 and grew extremely fast. Implicator reports it passed 200,000 GitHub stars. Its creator, Peter Steinberger, joined OpenAI on 15 February 2026, and the project moved to a foundation structure.
One reason for its popularity: users could sign in with their existing AI subscriptions through OAuth, instead of paying separately for API usage. For heavy users, a flat monthly subscription looked far cheaper than metered API billing.
Anthropic’s move
Around 20 February, Anthropic made clear that OAuth tokens from Claude subscription accounts are not to be used in third-party tools. According to reports, the terms had already contained similar language, but it hadn’t been enforced until the economics became impossible to ignore.
Google’s move
Shortly afterwards, Google AI Ultra subscribers, a plan costing $249.99 a month, began reporting that they’d been suspended from Google’s Antigravity service after using OpenClaw’s OAuth integration. A thread on the Google AI Developers Forum collected complaints about restrictions with little warning or explanation. Some users reported automated responses to appeals, and at least one said a new account was restricted immediately too.
There were also worries that restrictions could spread to Gmail, Drive and other services on the same Google account, since those services share one identity. Some coverage raised this as a risk, but Implicator noted that broader account lockouts weren’t definitively confirmed. The confirmed impact was losing access to the AI service itself.
Why providers care: “token arbitrage”
Consumer AI subscriptions are priced on an assumption: people chat with the model through the provider’s own apps, at human speed. Most subscribers use far less than the maximum, and heavy users are balanced out by light ones. It’s the same logic as a gym membership.
Autonomous agents break that assumption. An agent framework can run around the clock, fire off long-context requests in loops and consume as much compute in a day as a normal subscriber might in months. When that traffic runs on a flat subscription instead of metered API pricing, the provider absorbs the difference. That gap between a subscription’s price and the API cost of the same usage is what people started calling token arbitrage.
From the providers’ side, there were other reasons too:
- Capacity: subscription tiers are provisioned for interactive use. Automated traffic can degrade service for everyone else.
- Security: handing a long-lived OAuth token to a third-party tool with broad system access increases the risk of token theft and misuse.
- Accountability: API accounts come with usage policies, rate limits and billing designed for automated use. Consumer accounts don’t.
Was it handled well?
Fairly, many developers felt it wasn’t. Restrictions arrived with little warning, communication was minimal and appeals seemed to go nowhere. People paying $250 a month reasonably expected clearer rules before enforcement. Even if the policy logic is sound, restricting paying customers without a clear explanation or grace period damages trust.
It’s also worth being fair to the users. Many didn’t think of themselves as exploiting anything. They signed in with a button a popular tool provided. When the official terms are vague and the enforcement is sudden, individuals end up carrying the risk of a decision made by tool authors and platforms.
How to run AI agents without putting your account at risk
1. Use API keys for automation
If software is calling a model on your behalf, use the provider’s API with an API key and metered billing. That’s what the API exists for, and it’s covered by terms designed for automated use. Subscriptions are for the provider’s own apps and officially supported tools.
2. Check whether a tool’s login method is officially supported
Some first-party tools, such as a provider’s own CLI or IDE integrations, are designed to work with subscriptions. Third-party tools that ask you to “sign in with” a consumer subscription deserve a closer look. Read the provider’s current terms rather than trusting a README.
3. Control API costs deliberately
The main reason people used subscriptions was cost. You can keep API spending under control with a few habits:
- set spending limits and alerts in the provider’s console,
- use smaller, cheaper models for routine agent steps and reserve top models for hard reasoning,
- use prompt caching for repeated context and batch APIs for non-urgent jobs,
- cap the agent’s loop count and token budget per task.
4. Separate critical accounts from experiments
This is ordinary risk management, not a way around any rules: don’t let one account be a single point of failure for your email, documents and business. Use a Workspace or organisation account for business-critical services, keep recovery options up to date, and experiment with new tools in a way that follows each provider’s terms.
5. Limit what agents can touch
Agents with shell access and broad OAuth scopes are a security risk regardless of billing. Run them in a sandbox or container, give them only the credentials they need, and watch for prompt injection from content they read.
The bigger picture
This episode marks a shift. In 2024 and 2025, AI providers competed partly on generous consumer plans. As agents became mainstream, the gap between chat usage and agent usage became too large to hide inside one flat price. Expect clearer separation from now on: subscriptions for people using official apps, and metered APIs for software acting on their behalf.
For developers, the practical rule is simple. If a program is doing the work, pay for it the way programs are meant to pay, and build your cost controls around that.
Related reading
- Claude’s 1M Token Context: What It Costs and How to Use It
- Open-Source CLI Coding Agents Compared
- OpenAI, Anthropic and the Pentagon: A Timeline
Sources: Implicator, Engineer’s Codex, Google AI Developers Forum.
