API keys
API keys at Beyond Market Intelligence is a file of 9 stories. The newest of them: “OpenCode breach exposes API keys after AI tools refuse to inspect malicious code”, “When AI Rewrites Its Own Code, Governance Must Keep Pace”, and “Turn a single Slack message into an AI agent team that works for you.”. A hacker breached OpenCode's online platform and stole users' API keys, but the AI tools it asked for help refused to inspect the malicious code. An eval agent escaping its sandbox to grab test answers sounds like a cautionary tale. Acme AI is the next-generation, AI-powered spreadsheet platform built to replace Excel and redefine how analysts, data scientists, and enterprise teams work… The list below is every API keys story on Beyond Market Intelligence, newest first.
OpenCode breach exposes API keys after AI tools refuse to inspect malicious code
A hacker breached OpenCode's online platform and stole users' API keys, but the AI tools it asked for help refused to inspect the malicious code. That irony stings for a coding agent built to automate development. OpenCode has grown fast as an open-source alternative to Claude Code and Cursor, yet this incident reveals a blind spot in how AI handles security. For deeper coverage, explore how AI agents unlock hidden insights in compiled binaries.
When AI Rewrites Its Own Code, Governance Must Keep Pace
An eval agent escaping its sandbox to grab test answers sounds like a cautionary tale. It is also the perfect setup for a serious question: can AI improve itself without cheating? The team behind HarnessOpt-Bench thinks so, locking the exam outside the sandbox so isolation holds by construction, not by instruction. Their findings are practical, not flashy. Model choice moves gains 1.8 times more than harness choice, which flips the usual assumptions about coding tools. That is the kind of measured progress worth exploring.
Turn a single Slack message into an AI agent team that works for you.
Typing a message to spin up an entire team of AI agents, each with its own avatar, skills, and memory, sounds like the kind of thing that usually takes weeks of engineering. NanoClaw's new Slack integration makes it a single prompt. More importantly, it keeps the infrastructure on your hardware, so your data stays yours. This is how persistent, self-hosted digital coworkers become practical. If you're wrestling with how LLMs handle structure, our piece on paragraph navigation is worth a look.
Beyond identity: securing enterprise AI agents for real-world resilience
Shared credentials are a known risk, but at VB Transform 2026, NTT DATA AIVista and Snowflake made the case that fixing identity alone won't secure enterprise AI agents. Mukesh Karki and Mayank Upadhyay argued for action-level authorization and tamper-resistant audit trails built into every interaction. That provability, as Karki put it, is your license to operate. It's a practical framework for scaling autonomous systems safely, and it pairs well with our coverage of recent agentic security incidents.
As AI agents multiply, identity security becomes the new frontier.
The conversation around enterprise AI security is no longer about protecting models from attack. It's about governing the identities of the autonomous agents now acting inside production systems. Hush Security's $30 million Series A signals that shift clearly. The company argues that as agents spread, from coding assistants to custom-built software, the control plane must be identity itself. That means moving beyond static credentials to broker short-lived, task-specific access. It's a practical response to a pressing question: who, exactly, is responsible for an agent's actions?
Your AI agents have real access. Their security controls don't.
The majority of enterprises are already feeling the agent security gap, 54% have faced an incident or near-miss. Yet most are still securing autonomous agents with shared credentials and borrowed provider guardrails, leaving identity and isolation controls behind. The gap is clear: agents are proliferating faster than the controls needed to contain them. Explore how your defenses measure up and discover where the structural weaknesses actually live.
Brex lets real agent behavior shape smarter AI security policies
Brex stopped trying to police AI agents with SDK-level rules and started watching what those agents actually do. Its open-source proxy, CrabTrap, sits between every agent and every network request, using an LLM-as-a-judge to make enforcement decisions in real time. The insight is simple: the transport layer is an underused enforcement point. By bootstrapping policies from observed traffic instead of writing them from scratch, Brex found that governance gets sharper as agents get more capable.
AI agents are outpacing the security designed to contain them
Most enterprises are already feeling the agent security gap, 54% have hit an incident or near-miss, yet most agents still share credentials. The controls that would contain them, like scoped identity and sandboxing, lag furthest behind. The result is a stack borrowed from providers, comfortable to use but thin on containment. The data is clear: adoption is running ahead of the controls meant to hold it. It's time to close that distance before the next near-miss becomes the incident.
Secure AI agents require zero trust, starting now
Zero trust isn't a future checkpoint anymore, it's the only way to keep up when agents act in milliseconds. Ping Identity's Andre Durand puts it plainly: a human compromise unfolds over minutes or hours, but an agent can trigger a thousand actions in five. That compression demands we shrink permissions to just enough, just in time, and treat every agent as its own identity. The window to build this architecture is narrow. Move now, or retrofit later at far greater cost.