> ## Content Index > Fetch the complete content index at: https://www.thenewway.ai/llms.txt > Use this file to discover other available public pages before exploring further. # OpenCode says a breach may have exposed API keys for 1.4% of Console users - URL: https://www.thenewway.ai/opencode-breach-may-have-exposed-users-saved-api-keys/ - Published: 2026-10-19T15:42:33.000Z - Updated: 2026-10-19T15:42:33.000Z - Description: OpenCode ties it to "a large scale distillation attack"; OpenAI has revoked the affected OpenAI keys and refunded unauthorized use. Three more stories inside. - Author: The New Way OpenCode, the open-source coding agent, says a breach hit 1.4% of users of its hosted Console and may have exposed the OpenAI and Anthropic keys they'd saved there. It leads because OpenCode's notice has 2.79 million views on X, and because part of the fix is yours: OpenAI has revoked its keys, and nobody else has said the same. Also today: DeepSeek's V4.1 Flash update claims a win over GPT-5.6 Sol that Artificial Analysis's own run doesn't reproduce; DeepSeek opens its search engine to agents, free in Claude Code and Codex until November 1; and Anthropic says Claude writes about 90% of Claude Code's own code. 📌 **In this issue** • [OpenCode says a breach may have exposed API keys for 1.4% of Console users](https://www.thenewway.ai/opencode-breach-may-have-exposed-users-saved-api-keys/#opencode-says-a-breach-may-have-exposed-api-keys-for-14-of-console-users) • [DeepSeek ships V4.1 Flash 1017, which an outside coding test puts behind GPT-5.6 Sol](https://www.thenewway.ai/opencode-breach-may-have-exposed-users-saved-api-keys/#deepseek-ships-v41-flash-1017-which-an-outside-coding-test-puts-behind-gpt-56-sol) • [DeepSeek sells web search to agents, free in Claude Code and Codex until Nov. 1](https://www.thenewway.ai/opencode-breach-may-have-exposed-users-saved-api-keys/#deepseek-sells-web-search-to-agents-free-in-claude-code-and-codex-until-nov-1) • [Anthropic says Claude writes 90% of Claude Code's own code, cutting reverts 40%](https://www.thenewway.ai/opencode-breach-may-have-exposed-users-saved-api-keys/#anthropic-says-claude-writes-90-of-claude-codes-own-code-cutting-reverts-40) --- ## What changed this week ### OpenCode says a breach may have exposed API keys for 1.4% of Console users OpenCode, the open-source coding agent, said Saturday that a breach hit 1.4% of users of OpenCode Console, its optional hosted service. Only users who "had external providers linked" were affected. Their notice says OpenAI and Anthropic keys "saved in your workspace may have been exposed" and asks them to revoke and replace those keys. OpenCode ties the breach to "a large scale distillation attack," harvesting a model's answers to train another, and hasn't said how the two connect. It says it's working with Anthropic, OpenAI and Google. A follow-up email a user posted to Hacker News Monday says OpenAI revoked the exposed OpenAI keys and refunded "any unauthorized usage." No email means you weren't hit, OpenCode says. Got one? Revoke your Anthropic and Google keys yourself: the follow-up names only OpenAI. > We had a security breach last night related to a large scale distillation attack that impacted 1.4% of OpenCode Console users > > We have notified them all this morning via email. If you did not get an email you were not impacted, it was a subset of users who had external providers… > > — OpenCode (@opencode) [October 17, 2026](https://x.com/opencode/status/2111519637049319818?ref%5Fsrc=twsrc%5Etfw&ref=thenewway.ai) --- ### DeepSeek ships V4.1 Flash 1017, which an outside coding test puts behind GPT-5.6 Sol DeepSeek shipped an update to its open-weight, MIT-licensed V4.1 Flash model Saturday, build "1017." Its model card scores it 42.3 on Terminal-Bench 4.0, a test of AI agents working in a terminal, ahead of GPT-5.6 Sol's 39.9\. Artificial Analysis ran the test itself, every model at maximum effort, and measured 33.8, behind GPT-5.6 Sol's 39.9 and Claude Opus 5's 49.0, as of Monday 15:02 UTC. The win over Sol doesn't hold. [deepseek-ai/DeepSeek-V4.1-Flash-1017 · Hugging FaceWe’re on a journey to advance and democratize artificial intelligence through open source and open science.![](https://storage.ghost.io/c/9c/1f/9c1ff71c-2859-44c2-a962-1337982a6484/content/images/icon/favicon-8250e7b4-6458-4028-b49b-014e93e0aaba.ico)![](https://storage.ghost.io/c/9c/1f/9c1ff71c-2859-44c2-a962-1337982a6484/content/images/thumbnail/DeepSeek-V4.1-Flash-1017-b6539ce0-2968-4105-8aac-ba01554f331d.png)](https://huggingface.co/deepseek-ai/DeepSeek-V4.1-Flash-1017?ref=thenewway.ai) --- ### DeepSeek sells web search to agents, free in Claude Code and Codex until Nov. 1 DeepSeek opened its in-house search engine to developers Saturday as a Search API and a Fetch API, each priced at $0.75 per 1,000 successful requests. If you run Claude Code or Codex on DeepSeek's models, their web lookups already go through these APIs, and those calls stay free until November 1\. DeepSeek says the in-house engine behind them already serves "hundreds of millions of requests daily" — a pitch aimed at agents that need to browse the live web without building their own crawler. [Search & Fetch | DeepSeek API DocsThe Search API and the Fetch API give agents and RAG applications access to live web content:![](https://storage.ghost.io/c/9c/1f/9c1ff71c-2859-44c2-a962-1337982a6484/content/images/icon/favicon-6cf6c2e9-e40e-4800-94d9-32ca8aa0ad4f.png)DeepSeek API Docs![](https://storage.ghost.io/c/9c/1f/9c1ff71c-2859-44c2-a962-1337982a6484/content/images/thumbnail/deepseek-social-card-c9b67a77-5e80-434d-a057-ed8bf0b6eae7.jpg)](https://api-docs.deepseek.com/guides/search/?ref=thenewway.ai) --- ### Anthropic says Claude writes 90% of Claude Code's own code, cutting reverts 40% Claude writes about 90% of Claude Code's own code, Anthropic's engineering blog said Friday. From June to September, merged pull requests more than doubled, and the fraction that had to be undone afterward fell by more than 40%. Two rules did the work: a round cap stops review after three passes, and findings are tagged Important, Nit, or Pre-existing so a bug the PR didn't cause doesn't block it. PRs needing five or more review rounds fell from 8.9% to 1.5%. [How the Claude Code team does code review / claude.dev BlogHow do you review code at the volume agents produce it? On the Claude Code team, once we had high coverage and deep reviews, we started optimizing for the minimum amount of human review time that doesn't raise reverts or incidents.![](https://storage.ghost.io/c/9c/1f/9c1ff71c-2859-44c2-a962-1337982a6484/content/images/icon/favicon-4a778208-ee8c-467f-a476-003876557fd6.png)AnthropicAddy Osmani and Morgan Westlee Lunt and Qing Wang![](https://storage.ghost.io/c/9c/1f/9c1ff71c-2859-44c2-a962-1337982a6484/content/images/thumbnail/og-8b283202-11d0-4a4c-ba8b-b7a8a9f962ae.png)](https://claude.dev/blog/solving-code-review-at-anthropic/?ref=thenewway.ai) --- ## Also worth your time - [Codex's 28-day upgrade-or-reset run reaches Day 14](https://www.reddit.com/r/codex/comments/1x9ju0w/day%5F14/?ref=thenewway.ai) - [Postgres 19 slips to around November 19](https://www.theregister.com/databases/2026/10/16/postgres-19-delayed-after-ai-reviewers-find-more-bugs-than-humans-can-fix/5303471?ref=thenewway.ai) - [I built a programming language that LLMs can't use](https://blog.picheta.me/post/killswitch-lang/?ref=thenewway.ai) - [Show HN: Sphinx — a hook that quizzes you on your AI's code before shipping](https://sphinx-six-theta.vercel.app/?ref=thenewway.ai) --- Know someone who'd want this in their inbox? Forward it — that's how this grows. And if we got something wrong, or you think we buried the real story today, hit reply. A person reads every one. --- *The New Way is written with AI. It gathers the day's stories, checks them against their sources and drafts every summary. A person decides what runs and reviews every issue before we hit send.*