OpenCode breach: rotate your AI provider keys
Also: DeepSeek V4.1 Flash 1017, Amazon buys DuckDB's maker, and the NIST seeds solved
The main thing
On Saturday, OpenCode said attackers got into an older system overnight. OpenCode is an open source AI coding agent that many developers use instead of Claude Code or Cursor. TechCrunch reports that the breach affected 1.4% of users of OpenCode Console. Console is the company's online platform, and some users store the API keys for their AI providers there.
The attackers used those keys. Developers posted spend alerts and unauthorized charges on Reddit and X. Most were in the hundreds of dollars, and a few were above $1,000. Anthropic and Google blocked the keys they believed were exposed. OpenAI says it worked with OpenCode to restore access for its API customers and to refund the credits the attack used. OpenCode says refunds for unauthorized charges are underway.
The breach only touched Console. Co-founder Dax Raad says the open source app and CLI were not affected: "those keys never come to us." That answers the most common question in the HN discussion, which was why an open source tool would hold credentials at all. OpenCode's statement says the breached system was a legacy system it was in the process of shutting down. The company calls the incident a "large-scale distillation attack." Skeptics say it looks like an ordinary breach. OpenCode has not said how the attackers got in or how it stored the keys, and it says the incident is still ongoing. The team also says the AI models it asked for help refused to analyze the malicious code until OpenCode got access to OpenAI's Daybreak Blue program.
What to do today: Did you save OpenAI, Anthropic or other provider keys in an OpenCode Console workspace? Then revoke and replace them in each provider's dashboard, update every app that uses them, and check your recent usage for activity you don't recognize. OpenCode emailed every affected user. If you got no email, the company says you were not affected.
Quick bits
DeepSeek V4.1 Flash 1017 is out with MIT-licensed weights. DeepSeek calls it a "minor update" with "substantial improvements" in reasoning, coding, agentic tasks and visual benchmarks. HN enjoyed that sentence. It is also on Vercel AI Gateway.
Amazon bought DuckLabs, the company that makes DuckDB. DuckDB stays MIT-licensed under the DuckDB Foundation, and its founders still lead it. First change: Aurora PostgreSQL can now query live data together with Iceberg and Parquet data in S3, at no extra charge.
GitHub Actions, Pages and webhooks were degraded Monday from 15:49 to 16:56 UTC, with queued workflows and slow Pages deploys. The incident is resolved, and GitHub promises a root cause analysis. One HN commenter knew about the outage 20 minutes before the status page did.
Postgres 19 is delayed because AI reviewers found more bugs than humans can fix, The Register reports. One commenter remembers an LWN debate on whether there are more bugs or only more bugs found. Either way, the robots have opinions about your upgrade plan.
Claude found where the NIST curve seeds came from. The P-192 through P-521 seeds were output from C's lrand48, seeded with a Unix timestamp. Anthropic says this does not weaken the curves and makes a backdoor much less plausible. Readers do not need to change anything.
NestJS 12 moves its core packages to ESM. CommonJS apps still work through require(esm), so you need Node.js 20.19+ or 22.12+. AWS Lambda also needs --experimental-require-module. To upgrade, run npm i -g @nestjs/cli@latest and then nest upgrade.
A prolific Rubyist archived all their gems. They cite Rails' leadership, Ruby's move toward LLM agents, and a commons "strip-mined by massive corporations." Want changes? "Go ask your agent or something."
MiniMax M3.1 Flash claims 73.7% on DeepSWE v1.1 at $0.15 input and $0.60 output per 1M tokens. It is free on Vercel AI Gateway until Oct 22. MiniMax says the weights "will be released later."
Patch roundup
- BeyondTrust Remote Support (CVE-2026-102764), FortiOS/FortiPAM/FortiProxy/FortiSwitchManager (CVE-2025-61624), NetScaler Gateway (CVE-2026-88771): apply the vendor fix. The source gives no fixed versions.
Rotate your OpenCode Console provider keys before anything else today.