Why Pay Hundreds of Millions for Open Source

On May 18, Anthropic confirmed its acquisition of Stainless—a startup that generates SDKs for the AI industry, used by OpenAI, Google, Cloudflare, and others. The price: over $300 million. Six weeks earlier, Anthropic spent $400 million in stock to buy Coefficient Bio, a six-person AI biotech firm. Two months before that, it acquired Vercept, a Seattle AI agent startup—a nine-person acqui-hire. And the starting point was December 2025: Anthropic bought Bun, the JavaScript runtime, the same month Claude Code hit $1 billion in annualized revenue.

Four acquisitions in six months. At first glance, a company stockpiling developer tools. But one detail changes the question: nearly everything they bought is open source. Bun is MIT-licensed. Astral’s uv and Ruff are MIT and Apache 2.0. The SDK code Stainless generates belongs to its customers with full modification rights. Every path allows a fork—zero licensing fees.

So the question becomes: why would Anthropic and OpenAI spend hundreds of millions to acquire what they could legally fork and maintain themselves? The answer is the same logic, repeated across three different cases.

Bun: Team, Risk, and Competitor Preemption

Bun is a JavaScript runtime written in Zig, with 7 million monthly downloads and 82,000 GitHub stars. Claude Code’s native installer runs directly on Bun—3 milliseconds to start, 15 times faster than Python. Mike Krieger, Anthropic’s CPO, put it bluntly: “Bun represents exactly the kind of technical excellence we want to bring into Anthropic” (Anthropic announcement).

After the acquisition, Anthropic didn’t turn Bun into an internal tool—it remained open source, MIT-licensed, publicly released. But the development direction tilted sharply toward Claude Code’s needs: built-in image processing APIs, experimental HTTP/3 support, test runner sharding and parallelism.

In May 2026, Bun founder Jarred Sumner submitted a Zig-to-Rust porting guide on GitHub. Four days later, over one million lines of Rust code were merged into the main branch (DevClass). Sumner claimed the team “hasn’t been typing code ourselves for many months now”—the entire rewrite was driven primarily by AI agents. The rewrite solved Bun’s persistent memory leak issues while also resolving an awkward strategic conflict: Zig’s founder had added a “strict no AI/LLM policy” to the language’s code of conduct, while Anthropic’s core business is AI.

Could an external fork have pulled off this rewrite? No. Zig is a niche language, and runtime internals are deeply complex. A fork can run the code, but making fundamental changes to core logic, debugging memory issues, and optimizing performance without the original team’s line-by-line understanding is flying blind. One million lines of Rust merged in four days—only the original team, augmented by Anthropic’s AI agents, could have done it. This is the first gap between fork and acquisition: the team is the tacit knowledge.

Three more gaps are equally important.

Second, dependency reliability. Claude Code generates over $1 billion in annualized revenue, and its runtime dependency is tied to a zero-revenue, VC-backed startup. If the upstream gets acquired by a competitor, goes bankrupt, or changes direction, a fork protects the code but leaves you carrying the entire maintenance burden of a runtime—security patches, platform support, performance optimization. Acquisition eliminates that uncertainty.

Third, competitor preemption. If OpenAI had bought Bun, Claude Code’s runtime dependency would be controlled by a rival. A fork can’t prevent that. An acquisition can.

Fourth, roadmap control. A fork is defense; acquisition is offense. After the acquisition, Bun’s priorities shifted toward Claude Code’s needs. With only a fork, divergence from upstream means walking further down your own branch, making long-term maintenance costs grow nonlinearly.

Bun’s price—sold for zero revenue after raising $26 million—was a reasonable bill relative to the risks it covered.

Stainless: Same Logic, Different Layer

Bun is a runtime; Stainless is the connectivity layer. But the framework for explaining the acquisition doesn’t need to change.

Stainless converts OpenAPI specs into production-grade SDKs across TypeScript, Python, Go, Java, Kotlin, Ruby, PHP, and C#, plus CLI tools and API documentation sites. Anthropic has used Stainless since day one of its API: 825 source files in anthropic-sdk-python carry the header # File generated from our OpenAPI spec by Stainless. OpenAI’s Node SDK doesn’t just use Stainless-generated code—its release scripts upload builds directly to pkg.stainless.com (openai-node repo).

Stainless’s customer list covers the core of the AI API ecosystem: OpenAI, Google, Meta, Cloudflare, Replicate, Runway, Cerebras, LangChain. Founder Alex Rattray wrote that roughly a quarter of the world’s professional developers have used an SDK or documentation site generated by Stainless (Stainless blog).

Same question: alternatives exist—Fern, Speakeasy, the open-source OpenAPI Generator with 50+ language support. Why didn’t OpenAI and Google switch to one of those, instead of letting Stainless become a shared dependency until Anthropic bought it?

The answer fits the same framework. Team: Stainless’s 49-person team includes Robert Craigie (creator of Prisma Client Python) and four years of SDK generation engineering—every API change automatically reflected across every language in every SDK. That pipeline’s tacit knowledge is expensive to replicate. Competitor preemption: Stainless served Anthropic and all its major competitors simultaneously. After the acquisition, the hosted product was shut down, cutting off OpenAI and Google’s automated SDK sync. Roadmap: Stainless also generates MCP servers—turning API specs into Model Context Protocol servers—which sits directly on top of the agent connectivity standard Anthropic created. Anthropic open-sourced MCP in late 2024 and donated it to the Agentic AI Foundation under the Linux Foundation in December 2025 (AAIF announcement). The MCP ecosystem now has over 10,000 public servers. Owning the toolchain that auto-generates SDKs and MCP servers means having the fastest execution speed on a standard everyone can use.

Forbes called the Stainless acquisition an “infrastructure denial play” (Forbes). The label captures the effect on competitors but misses why competitors didn’t defend themselves in advance. The answer is in the third layer of the fork framework: before Stainless was bought, OpenAI and Google could fork the SDK code but couldn’t fork the maintenance capability, and competitor preemption is a risk that only becomes visible at the moment of acquisition.

OpenAI on the Other Side, Same Logic

Zoom out from Anthropic and the symmetry is immediate. In April 2025, OpenAI tried to acquire AI code editor Windsurf for roughly $3 billion, but the deal collapsed when the exclusivity period expired—Google stepped in with a licensing deal in July, and key team members joined Google DeepMind (Fortune). OpenAI had also previously tried to buy Cursor and was rejected (TechCrunch). In March 2026, OpenAI finally closed two substantive deals: Astral—the team behind Python toolchain uv, Ruff, and ty; and Promptfoo—an AI security testing platform.

Astral is the strongest symmetric validation of this framework. uv is an MIT-licensed package manager with over 126 million monthly downloads—Simon Willison called it “load-bearing” for the Python ecosystem (Willison). Same for Ruff and ty. OpenAI could absolutely fork them. But it didn’t want the code—it wanted Charlie Marsh’s team and the authority to set the roadmap. Through Astral, Codex no longer just generates code; it enters the full developer workflow from dependency management to linting.

The two companies’ acquisition strategies mirror each other:

Behind these deals stand the same VCs: a16z invested in both Stainless and Astral, Sequoia backed Stainless, Accel backed Astral. Capital is actively facilitating AI labs’ consolidation of shared infrastructure, not encouraging these tool companies to remain independent.

Put Bun, Stainless, and Astral side by side, and the acquisitions aren’t coincidences or shows of wealth. They’re repeated executions of the same judgment: an MIT license gives you the freedom to fork, but not the original team’s understanding, the ability to block competitor acquisition, or the authority to set the roadmap. When an AI lab generates $30 billion in annualized revenue, its core product depends on a third-party runtime, and competitors are racing for the same tools—the answer to “why not just fork it” is the justification for the acquisition price.

From Model Wars to Pipeline Wars

The core question of AI competition in 2024 was “whose model is best.” In 2026, it’s “whose infrastructure do agents run on.” The driver is the maturation of agent architectures—when AI shifts from answering questions to taking action, the ceiling on capability is no longer determined by parameter count but by what systems agents can connect to, and how fast and reliably they can connect. Anthropic’s phrasing: “agents are only as capable as the systems they can reach” (Anthropic).

Under this framework, the four acquisitions fall on different links of the same thesis. Bun solves agent startup speed—3 milliseconds of cold start is the foundation of CLI agent experience. Vercept adds agent capability depth. Stainless solves the breadth and maintenance efficiency of agent connections to external APIs. Coefficient Bio validates the vertical industry thesis—when a lab’s infrastructure is strong enough, extending into industry applications becomes a natural next step.

And the core driver of the entire acquisition strategy returns to the opening question: none of these acquired assets are irreplaceable—the code is open source, alternatives exist—but the dependency risk and depth of tacit knowledge they carry make “forking” a superficially cheap but genuinely expensive false choice.

How Far Does This Trend Go

Assessing this requires holding two opposing forces in view simultaneously. The tightening force is rising: after Anthropic acquired Bun, its Zig version was replaced by one million lines of AI-generated Rust code in four days—not “continued maintenance” but a ground-up rewiring of the infrastructure itself. Stainless’s hosted product was shut down. Every case is shared infrastructure being internalized.

The loosening force also exists. MCP is a neutral standard, A2A is a neutral standard, AGENTS.md is a neutral standard. Stainless alternatives—Fern, Speakeasy—exist. But the critical question isn’t whether alternatives exist; it’s the hidden cost of migration: four years of SDK generation pipeline, nine-language sync, zero-dependency bundle optimization—this accumulated engineering isn’t reproducible by switching tools.

The outcome depends on the speed differential. If competitors can rebuild their toolchains in 6-12 months, the acquisition’s long-term value converges to the team and tacit knowledge. If Anthropic can push the Stainless-Bun integration to a point competitors can’t replicate with independent tools—not just generating SDKs, but creating systematic differences in Claude agent connection experience from performance to reliability—then the first-mover advantage becomes a product moat.

For teams building in the AI ecosystem, these acquisitions change how risk is calculated. Previously, seeing an MIT license on an open-source tool felt safe—fork as last resort. Now, an additional layer is necessary: whose capital stands behind the maintainers? Who influences the roadmap? If the tool gets acquired by a competitor, how much maintenance burden can you carry post-fork? These aren’t hypotheticals—they’re what happened in 2026.