Bullpen.News From Edwin Dorsey
Get Daily Recap Feedback

Thursday, November 5, 2026

Back to the front page

From X

@convequity 1 click

Convequity on X

A company gets an API key from a model provider (OpenAI, Anthropic, Google) and links it in OpenCode Console. OpenCode, the coding agent, uses that key to run models at the provider, billed to the company. It is a bearer credential: anyone with a copy can spend on the account. OpenCode disclosed unauthorized access to a legacy system being decommissioned. Keys for about 1.4% of Console users who linked external providers may have been exposed. OpenCode calls it a distillation attack. Users report charges for runs they never made. Provider terms generally make the key owner responsible, so the bill can land on the customer. A copied key works at the provider until revoked. OpenCode already runs on Cloudflare Workers, and Console is a gateway with budgets. Direct calls with a stolen key bypass Console and its budgets. Whether that legacy host ran on Cloudflare is undisclosed. In our view, customers need a control layer they own that keeps the raw provider key away from the agent and its vendor: a vault-held key, or Cloudflare ($NET) AI Gateway prepaid billing with no customer provider key, plus scoped keys, spend caps, per-user limits, alerts and full logs. F5 ($FFIV), Kong and LiteLLM offer related controls. We cannot say these would have stopped this breach. They can limit blast radius, spend and detection time: metrics we think a CFO will ask for before the next rollout.
@convequity

Convequity on X

As AI agents take over more software work, a SaaS vendor's future comes down to how much of the interface, workflow and data layers it keeps. Ahead of this quarter's software earnings, we will watch how far management is willing to change products and business models to keep that work, because strong defenses today can erode if a company refuses to change. Our SaaS Survival Scorecard evaluates the structural resilience to expanding agentic work, vendor adaptiveness, and what the market is pricing in. Route 3: customers keep working in the vendor's interface, workflows and data as agents do more of the tasks. Route 2: customers move to an agent interface such as ChatGPT or Claude but still rely on the vendor's workflows and data. At the weakest end, only the data layer remains. Route 1: customers replace the vendor, using AI to build and maintain all three layers themselves. Our view: leading security platforms like $PANW have the stronger Route 3 case, since analysts investigate inside them. Datadog ($DDOG) faces more Route 2 risk as developers work inside coding agents and call on it from there. Deeper dive available at Convequity.

Investor Letters

All letters

Problems at Twist Bioscience (TWST)

Twist Bioscience’s $200 rebound followed an Anthropic-linked short squeeze, yet its DNA and protein services face broad competition while…

TWST $8B
Hunterbrook 4 clicks

VSH Earnings Review

Vishay reported record Q3 revenue of $979 million, up 24%, and guided Q4 to about $990 million as rising backlog and margins contrast with…

VSH $3.6B
Cestrian Capital Research 3 clicks

Thursday Tailwinds #13: Nov 5, 2026

Florida marinas are 92% full as boat counts rise and permits constrain new supply, creating pricing power for existing operators such as…

SUI $14B
Trade Ideas Flow 6 clicks

eToro: Expanding Beyond Crypto

EToro trades at 2.89x EV/FCF with $304 million in trailing free cash flow, expanding from crypto into equities, commodities, currencies and…

ETOR $1.9B
Max Arnoldi 5 clicks
CHWY · long

Chewy INC

Chewy (CHWY) is presented as a long opportunity after a prior 2022 short thesis played out.

CHWY $9.2B
Value Investors Club 5 clicks

New Ideas From The Road

Aurelion Research increased healthcare exposure and sees opportunities in banking and defense, alongside research on Alcoa, Nike, ONON and…

AA $10BNKE $60B
Aurelion Research 4 clicks

Site Centers (NYSE:SITC)

Site Centers' $3 per-share return-of-capital distribution and December delisting leave a discounted liquidation stub, with two properties…

CURB $3.6B
Real Assets, Real Value 5 clicks

Coupang: 3Q26 Business Recap

Coupang’s product-commerce growth rose 9% as data-leak effects fade, while management expects margins to return to pre-incident levels by…

CPNG $27B
Speedwell Memos 3 clicks

Publications we follow

Every publication on this site, hand-picked.

129 publications

Newsletters 109

YouTube 4

Blogs 15

Seeking Alpha 74 of 278

Nominate a publication

X accounts we follow

Every account on this site, hand-picked.

91 accounts
Nominate an account

Investor letters we follow

359 firms

Sectors

Ordered by how often our editor reaches for them.