@thsottiaux: OpenCode breach shows why API keys need limits

Hackers broke into OpenCode Console, the online platform of a popular open-source coding agent, and misused API keys stored there by about 1.4% of its users, with some people seeing hundreds of dollars in charges. Anthropic and Google blocked the exposed keys, and OpenAI's Codex lead @thsottiaux said OpenAI worked with OpenCode to restore affected users and refund the credits used in the attack. The open-source app itself wasn't affected. On a lighter note, he also announced you can now edit earlier messages in a thread in the Codex desktop app.

Why it mattersIf you store AI keys in any online tool, set spending limits and alerts with each AI provider, and create a separate key per tool so one leak can be switched off without breaking everything else.

Curated by Sara Simeone as part of our human editorial coverage. The original sources are linked below; curation is distinct from a Hype or Fact? assessment.

How we knowCompany figures are labelled as their own claims; anything we couldn't verify is labelled as a report or a claim.