Bullpen.News From Edwin Dorsey
Get Daily Recap Feedback

Monday, October 19, 2026

Back to today

From X

@convequity 1 click

Convequity on X

A company gets an API key from a model provider (OpenAI, Anthropic, Google) and links it in OpenCode Console. OpenCode, the coding agent, uses that key to run models at the provider, billed to the company. It is a bearer credential: anyone with a copy can spend on the account. OpenCode disclosed unauthorized access to a legacy system being decommissioned. Keys for about 1.4% of Console users who linked external providers may have been exposed. OpenCode calls it a distillation attack. Users report charges for runs they never made. Provider terms generally make the key owner responsible, so the bill can land on the customer. A copied key works at the provider until revoked. OpenCode already runs on Cloudflare Workers, and Console is a gateway with budgets. Direct calls with a stolen key bypass Console and its budgets. Whether that legacy host ran on Cloudflare is undisclosed. In our view, customers need a control layer they own that keeps the raw provider key away from the agent and its vendor: a vault-held key, or Cloudflare ($NET) AI Gateway prepaid billing with no customer provider key, plus scoped keys, spend caps, per-user limits, alerts and full logs. F5 ($FFIV), Kong and LiteLLM offer related controls. We cannot say these would have stopped this breach. They can limit blast radius, spend and detection time: metrics we think a CFO will ask for before the next rollout.
@convequity

Convequity on X

As AI agents take over more software work, a SaaS vendor's future comes down to how much of the interface, workflow and data layers it keeps. Ahead of this quarter's software earnings, we will watch how far management is willing to change products and business models to keep that work, because strong defenses today can erode if a company refuses to change. Our SaaS Survival Scorecard evaluates the structural resilience to expanding agentic work, vendor adaptiveness, and what the market is pricing in. Route 3: customers keep working in the vendor's interface, workflows and data as agents do more of the tasks. Route 2: customers move to an agent interface such as ChatGPT or Claude but still rely on the vendor's workflows and data. At the weakest end, only the data layer remains. Route 1: customers replace the vendor, using AI to build and maintain all three layers themselves. Our view: leading security platforms like $PANW have the stronger Route 3 case, since analysts investigate inside them. Datadog ($DDOG) faces more Route 2 risk as developers work inside coding agents and call on it from there. Deeper dive available at Convequity.
@StableBread 6 clicks

Fajasy on X

I first wrote up an AI data center company that rents out $NVDA GPUs to AI startup companies on April 15, 2026, when it still traded as a SPAC at $10.70/share, just above its ~$10.60 trust value. The merger was a success, and the stock peaked at $39.20/share on June 1st. Now it trades below its SPAC price. That company is Boost Run $BRUN, which has fallen to $8.89/share, down 77.3% from its peak, even after it announced its largest disclosed contract on October 6 (worth $525.6M). The three larger listed GPU clouds have fallen from their 2026 highs as well, through the October 16 close: → CoreWeave $CRWV: Down 55.5% to $61.39/share. → $IREN: Down 60.2% to $26.99/share. → Nebius $NBIS: Down 42.3% to $165.47/share. So $BRUN fell with the group, but further than all three. I’d blame the drop from $39.20 on two causes that have nothing to do with $BRUN’s core operations: (1) higher rates and borrowing costs, and (2) $BRUN’s float growing ~3.1x, which was expected once its lockup ended and its warrants were called. Yet the business carries less risk than it did as a SPAC: → Contracts: $1.61B with disclosed terms and TCV over $2.6B, including $1.43B signed since my April write-up. → Customers: Thinking Machines Lab (the AI startup founded by former OpenAI CTO Mira Murati) and Cohere make up 61.9% of the $1.61B on three- to five-year terms, after three customers made up 75.9% of 2025 revenue, led by RunPod, a GPU cloud platform, at 44.5%. → Year-end target: If Thinking Machines’ GPUs are fully running by December 31 and the June order starts on November 30, the five disclosed contracts running by year-end cover $300.6M (75.1%) of the $400M ARR target. → Merger: Closed on May 8, 2026, with zero redemptions. → Balance sheet: The merger proceeds paid off its short-term bridge loans, the going-concern language is gone, and pro forma cash is $191.8M, up from the $108M I used in my June 3 update, right after the merger. But $BRUN still has to get the GPUs bought, financed, and running by December 31: → To reach the $1.0-1.2B of GPU spending management expects for 2026, $BRUN has to deploy $663-863M of GPU servers in H2 2026, 2.3-3.0x its cash and contracted prepayments. → CFO Erik Guckel said on the Q2 call that $BRUN is working on new ways to finance the build, but I found no new facility, lender, or term sheet in its filings or press releases from August 14 to October 16. → $BRUN’s named customers are private AI startups without investment-grade ratings, so its contracts are harder to borrow against. → If lessors funded 70% of the H2 2026 build instead of 79.5% (as in H1 2026), $BRUN would need $199-259M of its own cash for the build, more than its $191.8M of pro forma cash. → Both 10-Qs came late, after notices of late filing on May 26 and August 14, and $BRUN still reports three material weaknesses, the most serious kind of gap in a company’s financial reporting controls. → Founder and CEO Andrew Karos controls 87% of the vote. At $8.89/share, $BRUN’s EV is $989.7M. That’s 2.5x its $400M target for year-end ARR, down from 5.4x at the $22.93 price in my August 16 update. At 2.5x, $BRUN trades below all three peers, including $IREN at 3.2x. So did the thesis break, or just the stock? That’s what I answer in my new ~5k-word update on $BRUN, including my bear, base, and bull cases (Excel model included).

Investor Letters

All letters

Semtech Analyst Day Review

Semtech raised Q3 guidance and targets $3.2 billion of fiscal 2030 revenue, excluding upside from its AI data-center optical and copper…

SMTC $16B
CV's Substack 13 clicks

Is The Market Turning The Page?

CoreWeave’s debt and equity price action is framed as a wake-up call for investors amid a broader market discussion.

CRWV $34B
WHAT ARE WE DOING? “Contrarians At The Gate” 53 clicks

PesoRama: Research Flash

PesoRama will reach 54 JOi Dollar Plus stores by November after raising C$28.4 million, funding more than 50 additional Mexican store…

TBBB $6.8B
Atrium Research - Equity Research 7 clicks

Modine Deep Dive

Modine, soon Modexus Solutions, has a $4 billion hyperscaler cooling contract but must ramp factory output and restore margins as data…

MOD $9.2B
CV's Substack 19 clicks

Publications we follow

Every publication on this site, hand-picked.

130 publications

Newsletters 108

YouTube 4

Blogs 17

Seeking Alpha 52 of 241

Nominate a publication

X accounts we follow

Every account on this site, hand-picked.

90 accounts
Nominate an account

Investor letters we follow

189 firms

Sectors

Ordered by how often our editor reaches for them.