18 October 2026 - 12:21
Category: Breach
Decommissioning Systems Can Wait, Right
OpenCode left a dusty legacy box online just long enough to leak API keys for OpenAI, Anthropic, and Google. Same story different day, so go enjoy rotating those credentials.
Source: Cybersecurity News
The Full Story
Same story different day, as OpenCode forgot that obsolete hardware pending decommissioning actually needs turning off before attackers walk straight in. This little oversight hit 1.4% of Console users who politely linked external AI accounts, generously handing third-party API keys for OpenAI, Anthropic, and Google to an unauthorized model distillation campaign. Now developers must scramble to protect themselves by urgently rotating exposed keys, because why decommission anything on time?