OpenCode Console breach exposes API keys of 1.4% of users

·1 views

OpenCode, an open source AI coding agent, said attackers breached an older system overnight, affecting 1.4% of users of its online Console platform where some keep API keys for AI services. Affected users were emailed, and only Console workspaces were exposed, while the open source app and command-line tool were reportedly unaffected. Developers reported unexpected spend alerts from OpenAI, Anthropic and Google, with some charges reaching hundreds or over $1,000, and providers blocked suspected keys, with OpenAI pledging refunds for attack-related credits. OpenCode linked the incident to a large-scale distillation attack, a framing some skeptics dispute, and has not disclosed how the intrusion occurred, how keys were stored, or the extent of misuse. Affected users have been advised to revoke and replace their keys with each provider.

Read the full story at DEV Community

This is an AI-generated summary. ShortSingh links to the original source for the complete article.

Discussion (0)

Vite+ Proposed as a Toolchain for AI Agent Development

A blog post by Jan Michalek argues that Vite+ is an excellent toolchain for building AI agents. The article is published on the author's personal blog and was shared on Hacker News, where it gained 6 points. The Hacker News discussion had no comments at the time of this report. The source text provided contains only the link and metadata, so the specific technical arguments and details of the author's case are not available here.

0 comments Read more at Hacker News

ProgrammingDEV Community ·

A Five-Rule Checklist for Deploying Next.js on a VPS in Production

A guide on deploying Next.js apps to a VPS argues that basic tutorials omit practical rules needed for production stability. It recommends installing Node 22 LTS from NodeSource rather than the outdated default Ubuntu package, and using npm ci so the server matches the lockfile. The author stresses confirming a finished build, since restarting during a build can leave a half-written directory serving stale content. The piece also warns that NEXT_PUBLIC_ variables are baked in at build time and require a rebuild, while builds can be silently killed by memory limits on 1 GB servers. Finally, it advises using PM2 as a process manager and running the build before restarting the app.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

Walk&Relax: Open-Source Web App Combines Nature Sounds, Step Counting and Sleep Timer

Walk&Relax is an open-source web application that merges relaxation audio, walking tracking and bedtime tools into one free platform. It generates nature sounds such as rain, wind, birdsong and crickets entirely offline using Web Audio synthesis, avoiding downloads and subscriptions. The app uses a phone's motion sensors to count steps and estimate calories burned, with an indoor pace mode also available. It further offers a sleep timer that fades audio gradually, along with a dimmable OLED bedside clock and a guided breathing exercise. The project was developed as a submission to the Hacktoberfest Open-Source AI Challenge and can be deployed on Render.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

Routing AI Agent Models by Step Cut Latency 86%, After Fixing Root Causes of a $48,000 Error

A follow-up post from a billing-agent team describes how it addressed upstream causes of an incident in which its agent settled a $48,000 credit that should have gone to a human. The team tested whether dumping a 350-page finance handbook into a long-context prompt could replace its retrieval pipeline, finding the cost gap real but modest and raising concerns about recall and traceability. The root cause traced to a naive chunking script that split a formula from the condition that made it inapplicable, so the agent saw the formula without its precondition. The team responded with section-aware parent-child chunking that returns full sections and version-stamps documents. The post also covers why a six-step ticket took 42.6 seconds and cost $0.184, and the latency gains from routing models by step.

0 comments Read more at DEV Community