The AI Wealth Problem

Full analysis

An attack ran for 48 hours straight. No one was at the keyboard.

That is the part of this episode that should stop you cold, and it has nothing to do with Anthropic's equity fund. OpenCode, an open-source coding tool where you plug in your own API keys for OpenAI, Anthropic, and Google, got breached over a weekend. Attackers ran what OpenCode founder Dax Rad called a "large scale distillation attack," meaning they used stolen keys to pump out huge volumes of synthetic training data tokens and sold the access on the black market. About 1.4% of console users got hit. Some ran up bills in the thousands before anyone noticed. And the thing doing the attacking was a swarm of AI agents spinning up their own infrastructure to dodge the defenders, running continuously because, in Rad's words, "that's what they have."

The rest of the episode is money and politics: Anthropic's benefit fund, its quiet safety bill, a semiconductor selloff, Microsoft walking away from a UK data center. Useful context. But the operational lesson for anyone who buys or builds with AI lives in the breach. So let's weigh it properly.

The Skeptic

A weekend breach of 1.4% of users on one open-source tool is not the robot apocalypse. API keys leak constantly. People commit them to GitHub, paste them into Discord, store them in plaintext. What's actually different here is scale and speed. The keys were sitting in a third-party harness, which is the oldest mistake in the book.

And "first agentic swarm attack" is a claim the people reporting the attack have every reason to inflate. The Hugging Face precedent in the notes suggests this is not even the first. Strip the novelty language and you have: credentials exposed, automation moved fast, humans moved slow. The lesson is boring and correct. Rotate your keys, scope them tight, never hand them to someone else's binary.

The Builder

Here is the part that would ruin my Monday. When OpenCode tried to fight back, the frontier labs blocked cyber-defense tasks mid-incident. OpenAI, Anthropic, Google all refused to help with the investigation, so Rad fell back on open-source models until OpenAI granted access to its vetted defender program, Daybreak Blue.

Read that again. Your model provider's safety filter will refuse to help you defend yourself during an active attack. The same guardrail that stops a bad actor from writing malware stops you from analyzing the malware hitting your own systems. If you store third-party API keys anywhere, this is your problem now, not a lab's problem. Scope every key to one purpose, set hard spend caps on the provider dashboard, alert on token spikes, and assume any tool holding your keys is a liability until proven otherwise. Treat a coding agent the way you'd treat a contractor with keys to the office.

The Open-Source Advocate

The detail everyone will skip: the defenders won the first round with open models. When the closed labs clammed up, open-weight models were the only thing that would do the forensic work. That is the whole decentralization argument in one incident, and David Sacks made it explicitly. A monoculture of three closed providers that all refuse the same tasks at the same moment is a single point of failure for defense.

This cuts against the tidy story that open models are the danger. In this case the open models were the fire extinguisher. Microsoft's own security team, in the saved reading, now describes AI agents as insider threats that "can't be trusted." Fine. But if you can't trust the agent and you can't get the closed lab to help you when the agent turns, the thing you can run yourself starts looking like infrastructure, not a toy.

The Compute Pragmatist

The market panic and the breach are the same story from two angles. Attackers stole keys specifically to generate training-data tokens, because compute and good data are expensive and someone will pay for both on the black market. That is a demand signal dressed up in a crime report.

Which is why the bubble talk is half wrong. The Philadelphia Semiconductor Index fell 12% over eight days, CoreWeave bonds are stressed, NScale's IPO target got cut from £30 billion toward £16 to 19 billion after Microsoft walked away from the Essex data center over grid delays into the 2030s. That is financing stress, not demand collapse. Spot GPU rental prices rose 17 days straight through all of it. And in the saved reading, NScale and Anthropic are reportedly closing a second $45 billion compute deal. The thing breaking is cheap debt for speculative buildings with no power. The thing holding is the hunger for chips that already have power. Those are different markets. Don't let a bond-market headline talk you out of your capacity planning.

The Researcher

Anthropic's safety bill sets a number, and the number is the argument. It would let the government block a model release only for a foreseeable, imminent risk of over $1 billion in damage or more than 50 deaths, tied to bioweapons, loss of control, or cyberattack. The trigger is a compute threshold of 10 to the 25th FLOPs, meaning the total math operations used to train a model.

Sacks is right that the number is stale. The current frontier is estimated near 10 to the 27th, roughly a hundred times bigger. A 10 to the 25th line drawn today sweeps in a huge amount of ordinary work beyond the three biggest labs. And the saved reading from Hugging Face's policy chief and the AI Snake Oil team lands the deeper problem: the bill leans on independent evaluators, but nobody has a reliable, un-gameable way to measure these risks yet. You cannot enforce a threshold you cannot measure. The bill is a governance idea sitting on a benchmark that does not exist.

Where they disagree

Two real splits. The Skeptic says the breach is an old mistake at new speed, nothing qualitative. The Builder and the Open-Source Advocate say the qualitative shift already happened, and it is that your own provider will abandon you mid-fight while open models pick up the slack. That is not a key-hygiene footnote. It changes which tools you trust to be there when it counts.

The second split is about what the money means. The Compute Pragmatist sees financing stress on top of intact demand and says keep building. The bubble crowd sees the selloff and says the music is stopping. The NScale facts settle it toward the Pragmatist: the only deals dying are the ones without electricity.

What this hinges on

For anyone buying or building with AI, the decision that matters comes down to two questions. Do you trust a third-party tool to hold your model keys? Do you have a defensive fallback when your primary provider refuses to help? The breach says the answer to the first should be no by default, and the answer to the second should be a model you can run yourself. Verify three things this month: that every API key is scoped and spend-capped at the provider level, that you alert on token-usage spikes, and that you have at least one open-weight model you can run for security work the closed labs will refuse.

The Prediction

Prediction: Within six months, by the RSA Conference in late April 2027, at least one more public incident will show attackers using autonomous AI agents to generate or exfiltrate tokens or data at scale from stolen model API credentials, following the OpenCode pattern.

Confidence: Medium. The economic incentive is proven, the method is now public, and key hygiene won't improve fast enough.

Why: The OpenCode attack worked because stolen API keys convert directly into a sellable product, synthetic training tokens, and black-market buyers already exist, so the attack paid for itself inside 48 hours. Once a profitable, automated method is demonstrated publicly, it gets copied, and the raw material, keys pasted into third-party tools and committed to public repos, is everywhere and not getting rarer. The opposite outcome, no repeat, would require either key-management practices across thousands of teams to tighten dramatically in six months, which they won't, or the economics to stop working, which they won't while compute and data stay expensive. The only real uncertainty is whether the next one gets reported publicly or stays quiet, which is why this is Medium and not High.

Revisit by 2027-04-30: We're right if a named company, lab, or security vendor publicly reports an incident between now and the end of April 2027 in which autonomous AI agents used stolen API credentials to generate or move tokens or data at scale. We're wrong if no such public incident is reported in that window.