OpenCode breach may expose your OpenAI, Anthropic, Google keys
A distillation attack hit 1.4% of Console users overnight, some billed on stolen keys — plus an open 4B decision model and Meta's quiet terms reversal.
Copy markdown
Rotate your provider keys now
OpenCode disclosed an overnight "large-scale distillation attack" that hit 1.4% of Console users with linked AI providers; attackers may have accessed stored OpenAI, Anthropic and Google API keys, and some users report unauthorized charges. If you've saved keys in OpenCode Console, revoke and reissue them now and check your provider billing.
The black market your keys feed
Security firm Bitsight reportedly flagged MONST3R-AI, a criminal pentest tool that runs entirely on stolen OpenAI, Anthropic and Google keys. A leaked key isn't just a surprise bill — it becomes someone else's attack infrastructure, so scope keys narrowly and rotate on any suspicion.
Intern-Decision puts a decision model on your own box
Shanghai AI Lab open-sourced Intern-Decision in 0.8B, 2B and 4B sizes (Apache-2.0, built on Qwen3.5). It takes a shared state, named questions and up to eight images and returns typed JSON — choices, scores, yes/no with calibrated confidence — in a single forward pass, no free-form text. The 4B reports a 90.02 average across seven suites, edging the hosted TypeSafe Jev, and GGUF/vLLM builds are already up, so you can run structured agent decisions locally instead of paying per call.
Meta quietly drops its business-site scraping clause
Ahead of its Oct 30 commercial-terms update, Meta reportedly removed the clause that let it train on content scraped from business-linked websites. If you run a site tied to a Meta business presence, that narrows what Meta can harvest — though the rest of the new terms still take effect on the 30th.