AI Weekly Malaysia

The Hacker News reports that a breach of the OpenCode console may have exposed API keys for OpenAI, Anthropic, and Google. The item is currently framed as a possibility ("may have exposed"), and the fetched article text contains only the headline and site chrome — no figures on how many keys, the time window, the mechanism, or any vendor or OpenCode response. Treat the specific scope as unconfirmed until the full write-up or an official statement is available.

Why: If you have pasted an OpenAI, Anthropic, or Google API key into a third-party coding console or agent tool — OpenCode included — the concrete move is to rotate those three keys now and check each provider's usage and billing dashboard for spend you don't recognise, rather than waiting for confirmation. Going forward, issue separate keys per project with hard spend caps so one leaked console key can't drain a shared account. The text gives no timeline or affected-user list, so you cannot yet tell from it whether you were in scope; rotation is the cheap hedge.