Daily Brief

When an agent sends an invoice using your token, who actually made the request? Kamil Potrec of Keycard breaks down how agents get credentials today (personal tokens, static keys, over-privileged service accounts) and what proper agent auth requires: per-agent identity, delegation, short-lived scoped credentials, federation with legacy systems, policy and audit. He compares SDKs and gateways for keeping credentials out of an agent's reach, including the gateway tradeoffs. Chapters: 0:00 Intro 0:43 How agents get credentials today 3:46 What's wrong with this picture 5:15 Using OAuth for agents

Most teams spin up a new open model with the default vLLM recipe and hope for the best. Runpod forward-deployed engineer Chris Vela shows how to choose configs from data instead, starting with the use case and concurrency, and demos BenchPod, a benchmarking dashboard built on vLLM that tests configs live without restarts. He runs Kimi K3 on a B300, shows how tuning max batch tokens cuts inter-token latency, and asks whether you need a frontier model at all. Chapters: 0:00 Intro 0:29 What Runpod does 1:32 Everyone's guessing at vLLM configs 2:53 Version and CUDA gotchas 3:48 BenchPod: benchmar

Pattern-based SAST catches bad code, but not valid code with flawed intent: broken access control, business logic gaps and authentication holes. Taylor Luttrell-Williams of Sonar introduces the SonarQube Hunter Agent, which maps a repo, runs three specialist agents and adversarially validates every finding, and announces Sonar joining the OpenAI Daybreak cyber partner program. The live demo turns up 46 issues in a Python app, including a user who can make themselves admin and an MFA bypass. Chapters: 0:00 Intro 0:46 Why SAST misses intent bugs 2:37 How Hunter Agent works 4:12 Sonar joins Open

Coding agents are opening PRs faster than anyone can review them. Manish Kapur (Sonar) and Addy Osmani (Anthropic) discuss "light" vs. "dark" software factories, how Anthropic scaled from about 2,500 to 30,000 merged changes a day with Claude doing first-pass review backed by real verification evidence, new data from Sonar's State of Code survey, and why every loop in the factory needs independent, multi-layered verification. They close with a lightning round on labeling agent-written PRs and when it's safe to merge. Chapters: 0:00 Intro 1:57 Throughput is up, merges are failing 2:49 Light vs

Candid Health is rebuilding the medical billing stack for healthcare providers, automating the work required to get claims submitted correctly and providers paid. Medical billing is a $200–300 billion market, and much of it still runs on decades-old software and manual processes. Today, Candid serves more than 200 healthcare organizations, processes about $7 billion in claims each year, and recently raised a $120 million Series D to keep expanding into the broader healthcare market. In this Founder Fireside, co-founder and CEO Nick Perry joins YC's Gustaf Alströmer to share how Candid went

An agent’s sandbox can die without taking the whole agent with it. That’s the idea behind “the brain and the hands,” Anthropic’s architecture for Claude Managed Agents. Now that the dust has settled on Opus 5.5, it is universally agreed to be the best model in the world. In this conversation with Katelyn Lesse and Angela Jiang, Anthropic’s Heads of Engineering and of Product, goes inside the systems that turn model capabilities into products developers can use. We cover: - Why Anthropic separated the agent harness, session state and execution environment. - Letting agents use credentials wi