OpenCode Warns Console Users After Attacker Reaches Legacy System Holding Provider Keys

·4 views

OpenCode, an open-source AI coding agent run from the terminal, emailed affected users of its hosted Console on 17 October 2026 about a potential breach. The company said an attacker accessed a legacy system it was decommissioning, and that third-party keys saved in workspaces, including OpenAI and Anthropic keys, may have been exposed. It later described the incident as a large-scale distillation attack affecting 1.4 percent of Console users, meaning those who had linked external providers. Affected users were told to revoke and replace their keys at the provider, update applications, and check recent usage. OpenCode has not said whether the exposed keys were stored in the legacy system itself.

Read the full story at DEV Community

This is an AI-generated summary. ShortSingh links to the original source for the complete article.

Discussion (0)

Experts Propose Layered Spending Limits for AI Agents Making Payments

A Marketing AI agent's $220 ad purchase cleared automatically, but a second $150 purchase by the same agent was routed to the store owner for approval because combined spending crossed a $300 daily threshold. The article argues AI agents should receive layered spending controls like corporate cards: monthly budgets, per-payment caps, daily windows, approval bands, and blocked categories. The author, who works on a payments product, describes checking these limits on the server before payments execute, so they hold regardless of the agent's memory. A sandbox demo shows a coffee-roaster company configured with four agents, each sized to its role. The piece also notes limitations in the current engine, such as per-payment caps not being enforced as a standalone field.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

Cerebras Details Weight-Streaming Design to Address Memory Limits in Trillion-Parameter AI

As AI models approach a trillion parameters, traditional GPU clusters face growing memory and interconnect bottlenecks that can make communication costs rival computation time. Cerebras has described a Weight-Streaming approach built on its Wafer-Scale Engine 3, which separates memory from compute by storing weights in an expandable external DRAM pool and streaming them onto the wafer layer by layer. The design treats a large monolithic compute fabric as a single device, which could simplify software compared with managing parallelism across thousands of GPUs. Independent benchmarks on cost, energy, and latency against GPU systems such as NVIDIA's H100 and B200 are still emerging, and migrating custom CUDA kernels may require extra engineering. Whether this model becomes mainstream will depend on further performance validation and ecosystem support.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

Monitoring many WordPress sites without alert fatigue

Monitoring a fleet of WordPress sites is harder than managing one, since updates lag, hosts fail intermittently, and noisy alerts lead teams to mute them. A homepage returning 200 OK does not reveal vulnerable plugins, outdated PHP, expiring TLS certificates, or unauthorized administrator accounts. The approach described combines external uptime checks with an installed agent that reports site data, and automatically matches plugins against vulnerability information. Because shared hosting often blocks or caches incoming requests, the panel pulls data through several fallback routes rather than relying on heartbeats, and each request is authenticated with HMAC-SHA256 signatures, timestamps, and nonces to prevent tampering and replay.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

AI Coding Agents Sped Up Coding; Waiting on Preparation and Acceptance Now Sets Timelines

A one-person software company measured its own git history over 91 days and found a median of 5.4 minutes from request to committed code across 18 timed cases. The slowest delays were outside programming, such as obtaining client materials, signing terms, acceptance, and verification on live systems. The author reports that a publisher project took about two days and a course platform was ready six days after its sales page went live, with the waiting occurring outside the code. The company also admitted its day-based estimates for programming were off by a factor of tens. The authors caution that this is a single company's data rather than a study, and they advise clients to focus on preparation, early prototypes, fixed-price outcomes, and human verification.

0 comments Read more at DEV Community