KDCube
← AI Industry News

Agent Credentials Crack, Agent Cloud Hits $1B, Agents Get Employee IDs

An OpenCode breach exposed stored OpenAI, Anthropic, and Google API keys and ran up real charges, while Daytona hit a $1B valuation building isolated "Agent Cloud" compute. Meanwhile NVIDIA floated a ~$2,000-per-GPU agent software fee and SK Telecom started issuing agents employee IDs and human supervi...

Highlights

  • A breach of the open-source coding agent OpenCode exposed stored OpenAI, Anthropic, and Google API keys for roughly 1.4% of users, with victims reporting unauthorized charges up to ~$1,700 in a suspected large-scale distillation attack. (TechCrunch)
  • Daytona raised a $60M Series B at a $1B valuation to build "Agent Cloud" — isolated compute sandboxes already used by OpenAI, Anthropic, NVIDIA, and Meta — framing per-agent compute as its own cloud primitive. (Fortune)
  • At NVIDIA GTC Berlin, Jensen Huang floated a ~$2,000-per-GPU annual software fee for running agents on AI factories — a live signal that agent inference is becoming a licensed line item. (TechSpot)
  • SK Telecom published its first AI Governance Report, assigning agents employee ID numbers, named human supervisors, token-use monitoring, and a retire/improve lifecycle. (SBS News)

Key Signals

  1. OpenCode breach turns agent credentials into the attack surface disclosed Oct 17, reported Oct 19-21

    Anomaly Innovations disclosed that attackers sat in OpenCode's systems for at least 48 hours, siphoning linked-provider keys and running up real charges — with some Google Cloud projects suspended for detected abuse. (TechCrunch, BleepingComputer) The twist: the activity looked like a distillation attack, using stolen keys to pump queries through frontier models. Anyone who connected a provider to a coding agent should rotate keys now and treat per-agent credential scoping as mandatory, not optional.

  2. Agent Cloud becomes a fundable primitive Oct 20

    Daytona's jump to a $1B valuation — with revenue run-rate up ~25x since January — signals that "every agent needs a computer" is now an infrastructure category, not a feature. (Fortune) It extends the runtime hardening theme from this week's microVM and sandbox stories: isolation and ephemeral compute are where the money and the security posture are converging.

  3. SK Telecom treats agents as a governed workforce Oct 26

    SKT's governance report registers each qualifying agent with an employee ID, a supervising human (team lead or executive for higher-autonomy agents), and monitoring of role, token use, and work history — plus suspension or retirement when performance reviews fail. (SBS News, Seoul Economic Daily) It's the most concrete operating model yet for agent identity and accountability inside a large enterprise.

Why It Matters / What To Watch

  1. Credential walls are now the agent-security frontline.
    • Rotate and re-scope any keys linked to third-party coding agents; assume stored provider keys are a prime target. (BleepingComputer)
    • Watch whether providers formalize reimbursement and anomaly-based key suspension as the default response to agent credential abuse. (TechCrunch)
  2. Agent compute and governance are both getting priced and formalized.
    • Model the per-agent compute and licensing bill: dedicated Agent Cloud sandboxes plus NVIDIA's mooted ~$2,000/GPU/yr agent-software fee change the unit economics of running fleets. (Fortune, TechSpot)
    • Steal SK Telecom's primitives — agent IDs, named supervisors, token/work-history logging, retire-or-improve reviews — as a template for your own agent registry. (SBS News)

Quick Links