OpenCode

OpenCode Reports Possible Exposure of Third-Party API Keys After Legacy System Breach

OpenCode disclosed that an attacker accessed a legacy system on October 16, potentially exposing API keys from external providers that users had stored in the Console. The incident affected only 1.4 percent of Console users, and the targeted system was already undergoing decommissioning. The company described the exposure as possible rather than confirmed and provided no details on the attack vector, duration, or number of keys involved. Some affected users reported unauthorized charges on their provider accounts. OpenCode stated that the incident was limited to keys stored in the Console and did not impact keys saved locally in its command-line or desktop applications. The firm notified impacted users by email on October 17 and is working with Anthropic, OpenAI, and Google. It recommended revoking and rotating exposed keys directly with each provider.

AI Agents Becoming Core InfoSec Skill Like Microsoft Office Proficiency

Working with AI in information security is shifting from a specialized skill to a baseline expectation similar to using Microsoft Office tools. The key difference lies in the cost of errors: poor Word usage wastes time, while mishandling AI agents burns subscription limits and corporate funds. The article details practical workshops from the Engineering October series covering AI agents from beginner tools to securing the agents themselves. Core concepts include distinguishing models from agents, managing context windows to prevent forgotten instructions, and using skills, MCP connectors, and sub-agents for efficiency. Real-world examples show agents handling CVE analysis, alert triage, and threat report reviews while highlighting risks like hallucinations and data exposure. Guidance covers safe deployment in isolated environments and the irreplaceable role of human expertise in strategy and verification.