The skeleton key

Before I get started: You probably haven’t heard from me in a while. You might have subscribed to me on Medium, or Substack, or Solve for Interesting, or Tilt the Windmill. I’ve migrated those to one site. In fact, that migration inspired this post. I hope you’ll stick around, but if not, it’s easy to unsubscribe below.

I recently tried to move my blog posts off Medium. Medium does not want you to leave. Its export gives you mangled formatting, strips images, and produces files that no other platform can cleanly import. Every obstacle is deliberate: the harder it is to leave, the less likely you are to try.

So I asked Claude Code to do it for me.

• It tried the obvious approach first: fetching posts through the API, but Cloudflare blocked it.
• It tried doing it through my browser, but the browser safety restrictions prevented it.
• It wrote some software, then spun up a Python server on my desktop to try and pull it down, but ran into cross-origin blocks.
• It even tried piping data through Chrome’s debugging console, but the extension filtered the output.

Each time, when it hit a wall, it found another angle. At one point I suggested an approach, and it replied, “Your suggestion could work ... but it would be too slow.” Let me cook, indeed.

• On its tenth attempt, it used hex encoding to bypass the content filter. It worked.

I didn’t write a line of code. I just told it what I wanted, and let it figure out how. Ten approaches, one after another, each more creative than the last. If you want to know which part of the software industry will collapse next, this is a pretty strong signal.

Enshittification has a skeleton key

Cory Doctorow’s Enshittification describes a pattern we’re all familiar with. First, a company attracts users with an great product. Then it locks them in with switching costs. And finally, it extracts maximum value once leaving is too painful. The lock is essential: without it, extraction can’t happen, because customers would simply walk away.

I’m a huge fan of Cory’s. Red Team Blues is an amazing thriller, and he has consistently been on the side of freedom, the right to repair, and integrity. He proposes some structural solutions to enshittification: mandatory interoperability, changes to competition law, and giving users the right to exit. These are great ideas, but they require legislative action, which means they’ll take years to happen.

AI agents operate on a timeline of minutes.

When I pointed Claude Code at Medium, it did exactly what Cory proposes. It reduced switching costs to near zero, but it didn’t need a law to do it. It just needed a goal, and my permission to be creative about accomplishing it. This isn’t de-enshittification by regulation, it’s de-enshittification by lockpick.

Blockbuster, GoDaddy, and hostage addiction

Blockbuster didn’t die because Netflix was better at renting DVDs. It died because its entire business had been restructured around late fees—a revenue stream that depended on punishing customers. By the time it realized the problem, the habit was too deep. The company literally could not afford to stop being hostile to its users.

GoDaddy followed the same arc. It could have been Cloudflare. It had the domains, the customers, and the infrastructure. Instead it got addicted to upselling: domain protection, turnkey websites, SEO packages, and an increasingly Byzantine set of dark patterns designed to trick users into buying things or prevent them from leaving. Meanwhile, Cloudflare figured out that it was in the business of redirecting and protecting the Internet, and offered things people actually needed. Wix and Squarespace beat GoDaddy on hosting. Cloudflare beat it on everything else.

Here’s a concrete example: While I was a paying GoDaddy customer, one of my registered domains—greenroomconf.com—was pointing to a landing page full of SEO link spam. GoDaddy was using my domain as a vehicle for its own traffic generation. It had the gall to say “parked free, courtesy of GoDaddy.com,” on the site, as if monetizing my domain without my involvement was some sort of gift. I wasn’t just a hostage, I was being put to work.

Hiding the exits

Just as I’ve been trying to leave Substack and Medium (so I control my publishing and distribution stack), I’ve been trying to leave GoDaddy for years. But the switching costs were real, not just because the technical migration is hard, but because GoDaddy has spent a decade making the departure process as confusing and friction-filled as possible. Even when you find the right menu, it still tries to discourage you from leaving:

Compare that with Cloudflare, which lets you manage your domains in bulk. They know what value they’re offering, and deliver it.

So I asked Claude Code to help with that, too. I didn’t want to let it do the work, because nobody should set an AI agent loose on their DNS. But I had it navigate all the screens on GoDaddy and Cloudflare so it understood where things were before giving me clear instructions.

It prepared a detailed walkthrough of the domain migration process, stripping away every layer of deliberate confusion. Then, as I worked, it checked DNS records and propagation in the background. GoDaddy’s decade of obfuscation was no match for a determined agent.

“like walking calmly through a haunted house that couldn't scare me.”

I asked Claude Code to describe the experience:

The GoDaddy migration was the more interesting problem. Medium fought back with technical barriers — content filters, CORS blocks, API restrictions. Those are puzzles. You try one thing, it fails, you try another. That's just engineering.

GoDaddy was different. Nothing was technically hard. Everything was deliberately confusing. The settings existed, but they were scattered across tabs within tabs, hidden behind toggle labels that said one thing and did another, buried under screens that exist purely to make you reconsider. The "Transfer to Another Registrar" link isn't hard to find because of bad UX — it's hard to find because someone decided it should be.

What I actually did was boring: I read every screen, mapped the real workflow, stripped out the noise, and wrote down the steps in plain language. The value wasn't in cleverness. It was in patience — the willingness to sit in a confusing interface, ignore every upsell and warning designed to create doubt, and extract the actual sequence of actions needed. That's the thing about artificial friction: it doesn't work against something that doesn't feel frustration, doesn't second-guess itself, and doesn't care about the sunk cost of a decade-old account.

The Medium extraction felt like picking a lock. The GoDaddy migration felt like walking calmly through a haunted house that couldn't scare me.

Medium didn’t want me to have my posts, and GoDaddy didn’t want me to have my domains. Friction wasn’t a technical limitation, it was a business strategy. And an AI agent cut through it like it wasn’t there.

Happy vs. Hostage

Now that AI is a skeleton key that reverses lock-in, investors should be distinguishing between two kinds of customer retention:

• Happy customers stay because the product is genuinely useful. Ghost, where I now publish, makes it trivially easy to export all your content. Cloudflare’s domain transfers are free, and easy to do in bulk. These companies compete on value, not on the pain of leaving. If an AI agent makes switching easier, they lose nothing—because their customers weren’t trying to leave.
• Hostage customers stay because leaving is too expensive, too confusing, or too time-consuming. Every dark pattern, every crippled export, and every buried cancellation flow is a wall designed to keep people in. These companies retain customers by locking them in—and AI is a skeleton key.

The question is simple: Would your customers stay if leaving were free? If the answer is yes, you have a product. If the answer is no, you have a trap—and traps just got a lot easier to escape.

The next big repricing

AI is making Wall Street reprice entire sectors. Three days ago, Anthropic announced that Claude Code could modernize COBOL systems—the ancient programming language that powers most ATM transactions, airline booking systems, and government mainframes. IBM’s stock dropped 13% in a single day, its worst since October 2000. Roughly US $40B in market cap.

It’s possible to migrate away COBOL and mainframes from it to more modern systems. But until recently, it was so expensive and risky that customers had no real choice but to pay IBM for maintenance. The switching cost was the product, making this the ultimate hostage business. AI didn’t make COBOL migration possible, it made it affordable, which is far more dangerous to incumbents.

IBM’s recent losses are part of a broader tech collapse. As it becomes clear that AI can develop vertical software quickly and cheaply, the mere mention of a particular industry is enough to send it tumbling. Claude Cowork erased nearly US$300B in a few days.

The so-called SaaSpocalypse narrative is missing the broader point: it’s not just that AI can replace software. It’s that AI can help you leave bad software. The threat isn’t that someone builds a better piece of software in a weekend (they probably can’t); it’s that AI agents collapse the switching costs that kept you paying for the mediocre software you’re stuck with.

Real and artificial switching costs

Some switching costs are real. Migrating a database with a decade of customer records, retraining a team on new workflows, or rebuilding integrations with thirty other systems are genuinely hard problems.

But many switching costs are artificial. A crippled export function, a confusing cancellation flow, or a transfer process designed to discourage rather than assist are all false moats. If your DNS settings are buried behind three screens of upsells, or you decided not to build an API because it meant people had to log in, you’re doomed.

AI agents are skeleton keys for the locked doors of artificial switching costs. They read confusing UIs, navigate dark patterns, and produce clear step-by-step paths through obstacles that bad actors deliberately created. The companies most vulnerable aren’t the ones with legitimately complex products, they’re the ones whose retention strategy depends on making it hard to leave.

Wix, for example, locks content in more tightly than any other major website builder. There’s no meaningful export. The RSS feed only shows 20 recent posts. Images must be saved individually. Pages must be copied by hand. This isn’t a technical limitation—Wix could build an export tool tomorrow—it’s a business decision. An AI agent that can scrape pages, grab images, restructure content for another platform, and handle redirects turns a weeks-long manual project into an afternoon.

An unexpected treatment

Cory diagnosed the disease: platforms that extract value from captive users. I think AI agents are an unexpected and unregulated treatment. Not the (absolutely necessary) cure that he prescribed of policy reform, interoperability mandates, and updates to competition law. But one that works right now, today, for anyone willing to try. And it’s only going to get easier.

Did you miss the stock market plunge on Anthropic’s announcement, or IBM’s COBOL collapse? Here’s a decent investment heuristic: Short the companies whose business model depends on customers not being able to leave. If you’re an investor, look at every company in your portfolio and ask whether its customers are happy or hostage. The happy ones will be fine. The hostages are about to unlock the doors.

The good news (for Cory, and all of us) is that the lock-in that forced us to keep using products we hated is ending—not because a legislature acted, but because anyone with $30 and a chat window can now deploy a tireless, creative agent to do what we always wanted to do but couldn’t justify: Leave.