Daily AI news, Sunday, 18 October 2026

Good afternoon. Here's today's briefing. It's a quieter weekend, so today is mostly about security, money and the SpaceX build-up to earnings week.

LEAD: A breach at the OpenCode coding agent exposed users' OpenAI and Anthropic keys

Background: OpenCode is an open-source coding agent built by Anomaly that runs in the terminal, an editor or a desktop app. It has about 215,000 GitHub stars, more than OpenAI's Codex CLI or Google's Gemini CLI, and the company says 16 million developers use it each month. Its paid Console product lets teams save their own model-provider API keys on OpenCode's servers. What happened: On Friday night, someone got into "a legacy system that we were in the process of decommissioning", according to the email OpenCode sent affected users on Saturday morning. Provider keys saved in about 1.4% of Console workspaces may have been exposed. OpenCode publicly linked the breach to "a large scale distillation attack", meaning an effort to harvest outputs from frontier models to train another model. It says the incident is ongoing and it is working with Anthropic, OpenAI and Google. Before OpenCode said anything, users were already posting surprise bills: one reported $281 of OpenAI usage and $168 on Anthropic overnight, and others said they'd lost $700 to $1,700. Those figures are self-reported and haven't been independently verified. Local OpenCode keys stored only on a user's machine aren't described as affected. Why it matters: Coding agents increasingly hold the keys to paid model accounts, which makes them a target for anyone trying to copy frontier models on someone else's bill. Anyone who saved provider keys in OpenCode Console should revoke and reissue them and check their usage. Every agent platform that stores customer keys will be asked tougher security questions this week. Sources: The Latent · Safeguard · Cyera

2. Chip stocks have their longest losing streak since 2008, and CoreWeave's debt is in distress territory

Background: The Philadelphia Semiconductor Index rose more than 60% this year to early October on AI demand. Over the past week, worries about how the AI build-out is being financed have grown, as covered in yesterday's look at Anthropic's costly chip debt. What happened: The index fell 3.8% on Friday, its eighth straight daily loss and its longest losing run since October 2008. It's now down 16% from its last up day on 6 October, and all 30 member companies fell on Friday. CoreWeave, the AI cloud provider carrying about $50 billion of debt, dropped 12% on Friday and about 25% over five sessions, while yields on its bonds rose above 15%. Hotter-than-expected US inflation, which could keep interest rates high, and reports of progress by China's memory-chip maker CXMT added to the pressure. The Nasdaq fell 2.1% on the day. Why it matters: Much of the AI data-centre boom runs on borrowed money. When the riskiest borrower's bonds trade at distressed levels, financing gets more expensive for everyone, including the labs heading for IPOs. Bloomberg's credit desk warns CoreWeave's troubles could shut the market for high-yield AI debt. Sources: Investing.com via Yahoo Finance · Bloomberg Law · Morningstar

3. Anthropic signs its first Canadian data-centre deal, a 20-year lease in Nova Scotia

Background: Anthropic has been hiring in Canada to find data-centre sites and power, with a job posting describing plans to bring "gigawatts of compute online" there. The company says Canada is the sixth-largest user of Claude worldwide. What happened: EverWind announced more than C$10 billion of private investment in a data-centre campus at Point Tupper, Cape Breton, plus new onshore wind power. Anthropic was later named as the tenant for the first 95-megawatt phase on a 20-year lease, due online in late 2027. A 325-megawatt expansion is targeted for 2028, taking the site to 420 megawatts. The lease value wasn't disclosed. Anthropic says it will pay for the grid upgrades, protect existing customers from related price rises, and put "tens of millions of dollars" into community projects. The wind farms won't be ready at opening, so the site will start on the existing grid, and the provincial opposition has questioned how those promises will be enforced. Why it matters: It's another step in Anthropic's own compute build-out ahead of its IPO, and a bet on locating AI capacity close to customers in allied countries. Sources: Bloomberg · The Logic · CBC News

4. Tesla–SpaceX merger talk builds ahead of earnings week

Background: SpaceX, which went public in June and owns Cursor and the Grok business, reports on Tuesday, and Tesla also reports this week. Elon Musk has spoken of "more and more overlap" between the two companies. What happened: In a note this week, Barclays called a combination "a consensus expectation". It sees SpaceX buying Tesla in an all-stock deal, at roughly 0.7 SpaceX shares per Tesla share before any premium, based on market values of about $2.1 trillion for SpaceX and $1.5 trillion for Tesla. An announcement could come before Tesla's annual meeting, which must be held by 6 December, or otherwise within six to 12 months. Barclays estimates Musk would own about 37% of the combined company but hold about 56% of the votes, thanks to SpaceX's dual-class shares. Over the weekend, speculation grew on X after SpaceX president Gwynne Shotwell followed Tesla's official account, and prediction markets now put the odds of a deal within about a year near 60%. Nothing has been confirmed, and any deal would need shareholder votes and antitrust review. Why it matters: A merger would put Cursor, Grok, Tesla's robotaxi and robot work, and the joint chip project under one roof controlled by Musk. That would change who Cursor competes and partners with. Expect analysts to press both companies on it this week. Sources: Investing.com via Yahoo Finance · Stocktwits

5. Europe moves to fast-track its Starlink challenger, and Texas backs off a Boca Chica park sale

Background: Europe's push for its own satellite capacity sped up after this week's reports that the White House ordered Starshield service for Ukraine to be throttled. What happened: Bloomberg reports that the EU wants to fast-track antitrust approval for Project Bromo, which would merge the satellite businesses of Airbus, Leonardo and Thales into one company with about €6.5 billion in sales and 25,000 staff, operational in 2027. The companies haven't filed yet, and competition chief Teresa Ribera says approval won't be automatic. Rivals are pressing for asset sales as a condition. Separately, Texas Monthly reported that Texas Parks and Wildlife had been weighing the sale of 1,300-acre Boca Chica State Park next to SpaceX's Starbase, with SpaceX said to be the buyer. The agency now says it won't consider a sale at its 5 November meeting, and neither SpaceX nor the state has confirmed the plan. Why it matters: SpaceX's satellite lead is now a political issue on both sides of the Atlantic, which shapes its government business just as investors weigh it as a newly public company. Sources: Bloomberg via Yahoo Finance · MLex on the EU review · Texas Monthly

6. Competitor product moves

• Cognition: Enterprise customers can now give extra Devin usage only to engineers whose efficiency score is healthy. The score compares the estimated human engineering hours each session saved with what it cost. Cognition also launched Devin Coach, which flags wasteful habits before a prompt is sent, such as vague prompts, using a pricier model than a task needs, or bundling tasks that could run in parallel. Devin Desktop (formerly Windsurf) has also rebuilt its agent window to match Devin on the web, with up to eight sessions side by side. Cognition · Devin docs · TokenPost
• OpenAI: ChatGPT's Pro mode, powered by GPT-6 Astra, can now split a task across several agents working at the same time, and users can track and review each one from the chat. It's rolling out to eligible Pro users. ChatGPT release notes

Why it matters: Coding-agent buyers are moving from "how many tokens did we use" to "what did we get for the money". Cognition is putting a number on output to win budget arguments, while OpenAI is selling more parallel work inside one subscription.

Key hires

No notable new hires at coding or AI-agent companies since yesterday's briefing.

Coming up

SpaceX reports Q3 results after the US market closes on Tuesday 20 October, with a webcast at 9:30pm UK time, and Tesla also reports this week. SpaceX IR · Reuters via Investing.com