Jared Blikre’s Monday wrap at Yahoo Finance had Datadog up more than 4% after a Bernstein upgrade that cited stronger AI demand. Palantir matched it, chip stocks recovered from last week’s beating and Amazon climbed 5% on a Morgan Stanley top-pick call. The Nasdaq gained 1.1% while nearly two-thirds of the S&P 500 fell. It was a narrow rally, carried by the companies selling picks and shovels to the AI boom.

Why Datadog keeps showing up in my AI life

I spend my days working beside Claude, Anthropic’s AI assistant, and the more I use it the more I notice how tightly the pieces connect. Google is one of Anthropic’s biggest backers and cloud suppliers; in April Alphabet committed up to $40 billion plus gigawatts of TPU capacity. Datadog, meanwhile, ships an official Anthropic integration that traces Claude API calls, and a preview console that collects Claude Code telemetry over OpenTelemetry. Google indexes, Anthropic reasons, Datadog watches. That is the AI stack Bernstein is betting on.

The culture of sharing

Modern software runs on information sharing. Logs flow to dashboards, dashboards feed alerts, alerts feed AI agents, and agents write new code that ships more logs. It is a wonderful culture for fixing bugs at three in the morning. It is also how secrets escape. An API key pasted into a debug line, a .env file copied into a container, a config committed to a public repository: every new pipe is another place a password can land.

671 requests in four seconds

This afternoon Claude and I watched it happen in my own server logs. At 2:42 p.m. Pacific a single address fired 671 requests in four seconds, calling itself “WebSiphon.” It wanted .env, .env.production, .env.secrets, Terraform variables, Docker and Kubernetes configs, VS Code settings, shell history, and the config files of ComfyUI, Stable Diffusion and text-generation-webui. In short, every place a builder of AI tools might have left an OpenAI or Hugging Face key lying around.

It found nothing. 666 of those requests came back “not found,” and the five that succeeded were the public homepage, robots.txt, a favicon and one image. The address is now blocked.

Where Oracle fits

The address sits on Oracle Cloud’s network. That does not mean Oracle sent it; anyone with a credit card can rent a server there, and scanners love big clouds because their addresses look respectable. Still, Oracle is a fitting reminder of how long old leaks live. In 2025 a seller called rose87168 advertised about six million records said to come from Oracle Cloud’s login systems. Oracle first denied a breach, then told some customers that older systems had been accessed. Credentials stolen years ago keep getting recycled, tested against new targets and mixed with fresh scans.

Putting it all together is the hard part

No single log tells the story. The scan lives in a web log, the block lives in the firewall, the breach history lives in news archives, the market reaction lives on Yahoo Finance and the observability lives in somebody’s Datadog account. With dozens of processes running at once, connecting those dots by hand is nearly impossible. That gap is exactly what Datadog sells to engineers, what Palantir sells to governments, and what assistants like Claude are starting to fill for small operators like me.

Even with an assistant beside me, the trail took several steps: find the log, count the requests, sort the targets, check the owner, then decide what to block. Multiply that by every service a small business runs and you see why observability stocks bounce.

My takeaways: never keep a .env file inside your web root, rotate every key that has ever touched a log, block scanners when you see them, and assume any password you reused at an old employer or cloud service is already on someone’s list.

Monday’s rebound says investors still believe in the AI picks-and-shovels trade. My logs say the bots believe in it too. They are just shopping for keys instead of shares.

Sources: Yahoo Finance; Datadog Anthropic integration; Datadog AI Agents Console; TechRadar on the Oracle Cloud breach; Alphabet and Anthropic investment.

Photos via Wikimedia Commons. Server technician (featured): Derrick Coetzee from Berkeley, CA, USA, CC0; Google data center, Council Bluffs: Chad Davis, CC BY 2.0; Padlock and keys: zaphad1, CC BY 2.0; Oracle HQ, Redwood Shores: Håkan Dahlström, CC BY 2.0; Nasdaq MarketSite: ajay_suresh, CC BY 2.0. Not investment advice.