ConnectWise Shutdown, OpenCode Leak, Anthropic's Junior Hiring Drop

Full transcript

Alex: Good morning, and welcome to Daily Tech with ScribNet. It is Sunday, October eighteenth, twenty twenty-six, and I am Alex.

Jordan: And I am Jordan. Today we have a security heavy show, and it starts with vendors, not end users. A backup provider had to shut its own service down, a developer tool may have exposed the keys to three major A I platforms, and Anthropic published some unusually honest numbers about what agents have done to its own hiring.

Alex: Let us start with ConnectWise. On Saturday, October seventeenth, ConnectWise disabled seven of its application identities and revoked the certificates tied to them, after it found that attackers had misused shared credentials connected to those identities.

Jordan: And when ConnectWise pulled that plug, its Cloud Backup service effectively stopped. Scheduled backups were suspended, and access to backup archives was blocked while the investigation runs. The company says the archives themselves remain encrypted and isolated, and so far it has seen no sign that anyone accessed them maliciously.

Alex: That distinction matters, because the real risk here was never really the backups. Those application identities touched Microsoft three sixty-five tenants, including SharePoint Online, Microsoft Teams, Exchange Online, and Microsoft Graph. With permissions like that, an attacker does not need to steal an individual user password at all.

Jordan: Right. The concern is that someone holding those credentials could request access tokens, read mail and files and Teams messages, and in the worst case try to persist by creating new applications or secrets, or even push toward a global administrator role. ConnectWise says it first flagged the problem through its own monitoring on October fourteenth.

Alex: And outside researchers added worrying context. The security firm Huntress tracked a focused wave of sign in attempts tied to a single flagged internet address, targeting roughly one thousand Microsoft Entra tenants, with around three hundred successful sign ins. A smaller set of tenants in sensitive sectors got special attention from the attackers.

Jordan: So what is the takeaway for anyone who manages tenants for customers? Check for unusual sign ins from October thirteenth onward, preserve your audit logs, and review which vendor applications are connected in each tenant, along with mailbox rules and directory roles. This is the vendor layer becoming the attack surface.

Alex: Our second story hits individual developers directly. Late on October seventeenth, Anomaly Innovations began emailing users of OpenCode, a popular coding tool, warning that provider keys stored in the product may have been exposed through a legacy console system the company was decommissioning.

Jordan: The keys at risk were the ones developers store to call Open A I, Anthropic, and Google services, and the earliest exposure the company could identify was roughly twenty two hours before that first notice. Two users have already reported unauthorized Claude usage, with about one hundred dollars in fraudulent charges, so this was not purely theoretical.

Alex: The advice is simple. Revoke and reissue every affected key directly inside each provider dashboard, not through any link in a notification email. Then review billing and usage logs back to October seventeenth, and set spending limits on new keys. In both of these stories, the credential itself has become the perimeter.

Jordan: Now for the story I found most interesting today. Anthropic, the company behind Claude, published research on how employment is changing inside Anthropic itself, and the numbers are striking.

Alex: Walk us through them.

Jordan: By August of twenty twenty-six, interactive agent hours at Anthropic were running at about six times employee hours. Commits per engineer were roughly five times their level from six months earlier. And over the same period, the junior share of technical hires fell from twenty seven percent to nine percent.

Alex: That is a two thirds drop in the junior share of hiring, at the company selling the tools that everyone else worries will do exactly that. Did they share a second measure too?

Jordan: They did, and it is important not to mix the two up. The junior share of total technical department employment fell from twenty one percent to fourteen percent since early twenty twenty-five, so the hiring pipeline changed much faster than the existing workforce did. And to Anthropic credit, agent written lines were reportedly reverted at the same rate as human written lines, which makes the productivity claim harder to dismiss.

Alex: The open question is the training pipeline. If agents handle the starter tasks and every company hires fewer juniors, where do the senior engineers who supervise those agents come from in five or ten years?

Jordan: Now let us turn to the money behind the buildout, because today gave us a perfect contrast. On one side, CoreWeave, the specialized A I cloud provider, watched its bonds slide into distressed territory this week.

Alex: Bonds that CoreWeave issued in June at a yield of just under ten percent are now yielding around fifteen percent, with some notes trading below eighty cents on the dollar. Reporting this week put its total debt at roughly fifty billion dollars, against a contracted backlog of more than one hundred billion dollars.

Jordan: One credit analyst quoted by Reuters called CoreWeave the canary in the coal mine for debt funded A I infrastructure. Demand is not the problem. The backlog is enormous. The problem is that lenders are charging much more to finance buildings and chips that may take years to pay for themselves.

Alex: And on the other side, Anthropic just signed for the long term. On October sixteenth, it signed a lease of at least twenty years for its first data center agreement in Canada, at a new campus in Point Tupper, Nova Scotia, being built by EverWind Fuels.

Jordan: The first phase is planned at ninety five megawatts, targeted to come online by late twenty twenty-seven. The full campus aims for four hundred twenty megawatts by twenty twenty-eight, with a total project price above ten billion Canadian dollars, including about two billion Canadian dollars for onshore wind farms. For anyone buying A I infrastructure, the lesson is to ask how the facility behind your contract is financed, because that financing now decides who is still standing in three years.

Alex: We will close with my favorite small story of the day. A mathematical conjecture that had stood since nineteen sixty-seven has just fallen, and it fell cheaply. A batch run across fifty problems, using several frontier models, produced counterexamples for a total cost of one hundred sixteen dollars and twenty eight cents, under three dollars per problem.

Jordan: Counterexamples are the easy end of mathematics, because they are cheap to check. But that is exactly the point. When speculative search costs less than a weekly grocery run, researchers no longer need to justify trying it. They can just run the batch and see what shakes loose.

Jordan: So to recap today. ConnectWise halted its cloud backups after a Microsoft three sixty-five credential breach, and tenant admins should be checking their logs this weekend. OpenCode users need to rotate their Open A I, Anthropic, and Google keys right away. Anthropic reported that agents now log six times its employee hours, while its junior hiring share dropped from twenty seven percent to nine percent. And the A I buildout showed both of its faces, with CoreWeave bonds at fifteen percent yields, and Anthropic signing a twenty year lease in Nova Scotia.

Alex: That is our show for Sunday, October eighteenth. Thanks for listening, and we will be back tomorrow morning with the next edition of Daily Tech with ScribNet.

Jordan: See you tomorrow.