Wednesday, November 4, 2026

@convequity Oct 19 1 click

Convequity on X

A company gets an API key from a model provider (OpenAI, Anthropic, Google) and links it in OpenCode Console. OpenCode, the coding agent, uses that key to run models at the provider, billed to the company. It is a bearer credential: anyone with a copy can spend on the account. OpenCode disclosed unauthorized access to a legacy system being decommissioned. Keys for about 1.4% of Console users who linked external providers may have been exposed. OpenCode calls it a distillation attack. Users report charges for runs they never made. Provider terms generally make the key owner responsible, so the bill can land on the customer. A copied key works at the provider until revoked. OpenCode already runs on Cloudflare Workers, and Console is a gateway with budgets. Direct calls with a stolen key bypass Console and its budgets. Whether that legacy host ran on Cloudflare is undisclosed. In our view, customers need a control layer they own that keeps the raw provider key away from the agent and its vendor: a vault-held key, or Cloudflare ($NET) AI Gateway prepaid billing with no customer provider key, plus scoped keys, spend caps, per-user limits, alerts and full logs. F5 ($FFIV), Kong and LiteLLM offer related controls. We cannot say these would have stopped this breach. They can limit blast radius, spend and detection time: metrics we think a CFO will ask for before the next rollout.

@junkbondinvest Oct 19

junkbondinvestor on X

Remember when Avis went from $100 to $714 in just a few weeks this spring? Today it’s back at $100. What goes up, must come down. $CAR https://t.co/HsCdjshnuX

@convequity Oct 19

Convequity on X

As AI agents take over more software work, a SaaS vendor's future comes down to how much of the interface, workflow and data layers it keeps. Ahead of this quarter's software earnings, we will watch how far management is willing to change products and business models to keep that work, because strong defenses today can erode if a company refuses to change. Our SaaS Survival Scorecard evaluates the structural resilience to expanding agentic work, vendor adaptiveness, and what the market is pricing in. Route 3: customers keep working in the vendor's interface, workflows and data as agents do more of the tasks. Route 2: customers move to an agent interface such as ChatGPT or Claude but still rely on the vendor's workflows and data. At the weakest end, only the data layer remains. Route 1: customers replace the vendor, using AI to build and maintain all three layers themselves. Our view: leading security platforms like $PANW have the stronger Route 3 case, since analysts investigate inside them. Datadog ($DDOG) faces more Route 2 risk as developers work inside coding agents and call on it from there. Deeper dive available at Convequity.

@leevalueroach Oct 19 1 click

Lee Roach on X

Geo Group $GEO sold its 3 Adelanto ICE facilities (2,644 beds) to DHS for $950M, about $359K per bed. The market currently values GEO at about $92K of EV per remaining owned bed, and that EV also includes the electronic monitoring and services businesses.

@finphysnerd Oct 19 1 click

Myles on X

If you're naturally bearish like me I think it pays to push long when positioning gets washed out like it is now even if fundamentals are bad. Retail has been selling, hedge fund net leverage is low, $RSP and $QQQ have been smashed. You are going to be right 60-80% of the time,

@finphysnerd Oct 19

Myles on X

Closing my $QQQ and $SMH shorts here and lowering my $IWM exposure. I think we're bottoming here so keeping net long exposure, but the Q's and tech have really lagged over the last 2 weeks. Very happy with this trade.

@StableBread Oct 19 11 clicks

Fajasy on X

I first wrote up an AI data center company that rents out $NVDA GPUs to AI startup companies on April 15, 2026, when it still traded as a SPAC at $10.70/share, just above its ~$10.60 trust value. The merger was a success, and the stock peaked at $39.20/share on June 1st. Now it trades below its SPAC price. That company is Boost Run $BRUN, which has fallen to $8.89/share, down 77.3% from its peak, even after it announced its largest disclosed contract on October 6 (worth $525.6M). The three larger listed GPU clouds have fallen from their 2026 highs as well, through the October 16 close: → CoreWeave $CRWV: Down 55.5% to $61.39/share. → $IREN: Down 60.2% to $26.99/share. → Nebius $NBIS: Down 42.3% to $165.47/share. So $BRUN fell with the group, but further than all three. I’d blame the drop from $39.20 on two causes that have nothing to do with $BRUN’s core operations: (1) higher rates and borrowing costs, and (2) $BRUN’s float growing ~3.1x, which was expected once its lockup ended and its warrants were called. Yet the business carries less risk than it did as a SPAC: → Contracts: $1.61B with disclosed terms and TCV over $2.6B, including $1.43B signed since my April write-up. → Customers: Thinking Machines Lab (the AI startup founded by former OpenAI CTO Mira Murati) and Cohere make up 61.9% of the $1.61B on three- to five-year terms, after three customers made up 75.9% of 2025 revenue, led by RunPod, a GPU cloud platform, at 44.5%. → Year-end target: If Thinking Machines’ GPUs are fully running by December 31 and the June order starts on November 30, the five disclosed contracts running by year-end cover $300.6M (75.1%) of the $400M ARR target. → Merger: Closed on May 8, 2026, with zero redemptions. → Balance sheet: The merger proceeds paid off its short-term bridge loans, the going-concern language is gone, and pro forma cash is $191.8M, up from the $108M I used in my June 3 update, right after the merger. But $BRUN still has to get the GPUs bought, financed, and running by December 31: → To reach the $1.0-1.2B of GPU spending management expects for 2026, $BRUN has to deploy $663-863M of GPU servers in H2 2026, 2.3-3.0x its cash and contracted prepayments. → CFO Erik Guckel said on the Q2 call that $BRUN is working on new ways to finance the build, but I found no new facility, lender, or term sheet in its filings or press releases from August 14 to October 16. → $BRUN’s named customers are private AI startups without investment-grade ratings, so its contracts are harder to borrow against. → If lessors funded 70% of the H2 2026 build instead of 79.5% (as in H1 2026), $BRUN would need $199-259M of its own cash for the build, more than its $191.8M of pro forma cash. → Both 10-Qs came late, after notices of late filing on May 26 and August 14, and $BRUN still reports three material weaknesses, the most serious kind of gap in a company’s financial reporting controls. → Founder and CEO Andrew Karos controls 87% of the vote. At $8.89/share, $BRUN’s EV is $989.7M. That’s 2.5x its $400M target for year-end ARR, down from 5.4x at the $22.93 price in my August 16 update. At 2.5x, $BRUN trades below all three peers, including $IREN at 3.2x. So did the thesis break, or just the stock? That’s what I answer in my new ~5k-word update on $BRUN, including my bear, base, and bull cases (Excel model included).

@ToddWenning Oct 19 13 clicks

Todd Wenning on X

One of the big knocks on the thesis is that $HD or $LOW would copy whatever they're doing. HD had the chance back in the mid-2000s when Howden Millwork was forced to retreat, but didn't. $FND also built a multi-billion enterprise under their noses. The key is to focus on a niche and then be really good at that niche, which I think HWDN can do.