AI Wrapper Startups: How to Tell If One Has a Moat

An AI wrapper startup has a moat only if a customer would lose something real by switching when the model supplier launches the same product at a lower price. A thin wrapper, a prompt and an interface on someone else's model, is a feature waiting to be absorbed. A thick wrapper owns the workflow, proprietary or customer data, integrations with permission to act, evaluation and distribution, and treats models as interchangeable parts. The test is not whether a company trains its own model, but what it controls that its supplier does not.

The risk is not theoretical. On 3 June 2025 Varun Mohan, chief executive of Windsurf, posted that Anthropic had cut "nearly all" of its first-party capacity for Claude 3.x models with less than five days' notice (TechCrunch). Windsurf's agent had been built around Claude Sonnet, the model most developers then preferred for coding, and it claimed about $100 million of annual recurring revenue that April (reported). OpenAI, Anthropic's chief rival, had reportedly agreed to buy it. Anthropic said it was "prioritizing capacity for sustainable partnerships". Within six weeks the OpenAI deal had lapsed, Google had hired the founders, and Cognition had bought the rest.

What is an AI wrapper?

"Wrapper" became investors' shorthand from 2023 for an application that resells another company's model. The first wave came in June 2020, when OpenAI opened GPT-3 through a paid API and Jasper and others built writing tools on it. The accurate version of the debate is about thickness, not whether a model is rented.

Sierra, the customer-service agent company, describes using a "constellation of models" from OpenAI, Anthropic and its own fine-tuned layers (Bret Taylor, May 2026). That is what thickness looks like.

Step 1: List every platform the startup depends on

An AI application usually sits on three platforms owned by someone else, and each can be both supplier and competitor:

• The model. A lab's API, whose owner can change prices, rate limits and access, retire models, reserve capacity for its own products or launch a rival.
• The device or operating system. iOS, Android, Windows or macOS decides defaults and integration. Apple and Google's app-store fees, historically up to 30%, tax subscriptions sold in apps.
• The channel. An app store, browser, messaging app or cloud marketplace decides how customers find and pay.

In 2025 the model layer was where the risk showed most. OpenAI, Anthropic and Google all launched coding agents, Codex, Claude Code, Jules and Gemini CLI, competing directly with coding tools that were among their largest API customers. Claude Code reached a run-rate above $2.5 billion by February 2026 (company claim, reported). A lab that serves an application's traffic sees which uses pay. Assume it will act on that knowledge.

Step 2: Run the switch test

Ask one question: if the main model supplier launched the same product tomorrow at a lower price, what would customers lose by moving?

Jasper is the case that taught investors to ask it. Launched in early 2021 on GPT-3, it reported about $45 million of revenue in 2021 (reported) and on 18 October 2022 raised $125 million at about $1.5 billion. Six weeks later OpenAI released ChatGPT free. The capability Jasper rented was now a consumer product its customers could use directly, and ChatGPT Plus offered it for $20 a month from February 2023. The freelancers and individual marketers who drove Jasper's growth had little to lose by switching.

Jasper cut staff in July 2023, changed its chief executive that September, and saw its internal valuation cut by about 20% to about $1.2 billion (reported). It survived by building what ChatGPT did not supply to a marketing department: brand-voice controls, company knowledge, workflow and an enterprise sales relationship. It did not survive as the category leader it had been priced as.

Step 3: Check the model bill and whether it rises with use

A wrapper's largest variable cost is the model call, and its supplier sets that price. Find what share of revenue goes to model suppliers and whether it rises or falls as customers use the product more.

Cursor grew faster than almost any software company, from about $100 million of annualized revenue in January 2025 to about $2 billion in February 2026 (company and press-reported run-rates). Yet an investor estimate in mid-2025 put its payments to Anthropic at about $650 million against about $500 million of revenue (estimate, not a disclosure). A thick product can still have thin economics if its price unit does not track its cost unit. Cursor fixed this with usage pricing and its own models, Composer (October 2025) and Composer 2 (March 2026). Our guide on how to price an AI product explains the mechanics.

Step 4: Measure supplier concentration and the cost of a cut-off

The book prices a supplier shock in a stylized example. A coding app has $120 million of ARR, a model bill of 60% of revenue, three-quarters of it from one supplier, and other serving costs of 10%. The supplier withdraws first-party capacity.

The hedged rival sends only 40% of tokens to the same supplier, 30% to another lab and 30% to its own model at a quarter of the cost. It earns a higher margin before any shock and loses about a fifth of its gross profit when the shock comes. Multi-model support is insurance, but it is a moat only when the alternatives are close in quality. An in-house model is what turns a supplier's decision from an existential event into a bad quarter.

Step 5: Ask what any deal does to the other suppliers

Windsurf's position had a single point of failure, and a sale made it worse. By agreeing to be bought by OpenAI, it changed Anthropic's incentives overnight: coding was Anthropic's largest commercial use, and supplying a product about to be owned by its rival would have handed that rival usage data on its best models. Then the deal failed for a reason Windsurf could not control. Under OpenAI's agreement with Microsoft, Microsoft had rights to OpenAI's intellectual property, including acquisitions; Windsurf did not want the owner of GitHub Copilot to get its code, and Microsoft reportedly declined to waive the right.

On 11 July 2025 Google paid about $2.4 billion for a non-exclusive licence and hired Mohan and co-founder Douglas Chen. On 14 July Cognition agreed to buy the rest, with $82 million of ARR and more than 350 enterprise customers. The editor was renamed Devin Desktop in June 2026. Our case study of what happened to Inflection AI explains how these licence-and-hire deals divide the money. Cursor, facing the same supplier, eventually solved the problem by joining one: SpaceX, which had absorbed xAI, completed a purchase of Cursor valued at about $60 billion in August 2026.

Step 6: Weigh distribution against the incumbent's bundle

Incumbents hold the distribution that start-ups must buy. Microsoft can add Copilot to Office, Google can add Gemini to Workspace, Salesforce can add agents to the CRM screen. Bundling wins when the AI feature is good enough, uses data the incumbent already holds and spares the buyer a separate procurement. It loses when a specialist is much better on a workflow that matters to a budget-holder who can buy separately.

Coding is the clearest example of the second case. GitHub Copilot was first, bundled into Microsoft's developer ecosystem, and had about 4.7 million paid subscribers by December 2025 (Microsoft, reported), yet Cursor and Claude Code grew faster because developers judged them better and engineering leaders could buy them on their own. Legal research (Harvey), customer service (Sierra, Decagon) and enterprise search (Glean) are other categories where AI-natives grew against bundles through 2026.

A moat checklist for AI applications

The go-to-market and distribution study collects the evidence behind these questions, and our guide to how AI companies make money shows how application margins fit the wider stack.

Which factor of the intelligence equation decides a wrapper's fate?

The Intelligence Equation argues that durable value requires four factors at once, and the application layer turns on the second and third together: unit economics that hold at real usage, and a position the next layer cannot route around. Jasper and Windsurf both had products that worked and customers who paid. Each depended on a supplier that could cut it off or reach its customers directly, and each lost the independent value it had built when that supplier moved. An application that resells a model is, in the book's words, running "a public experiment in which product its supplier should build next".

The takeaway

The wrapper question is about thickness, not about whether a startup trains its own model. A defensible AI application owns the workflow, data, integrations and customer relationship, routes across several models, prices so that heavy use pays for itself, and has an answer to what customers would lose if its supplier shipped the same product. Jasper, Windsurf and Cursor show what happens to thin positions and concentrated suppliers. Chapter 14 of the book, Distribution and Platform Risk, sets out the full analysis.