OpenCode attack exposes user API keys

Welcome back. Hackers stayed busy this weekend. OpenCode's co-founder just confirmed that continuous cyberattacks hit the platform for 48 hours, potentially exposing your API keys. Meanwhile, Anthropic's new hiring strategy raises concerns for junior engineers, and DeepSeek's latest model is growing on developers. 

Also: How devs are using AI to speed up smart TVs, why engineers in 2026 are working harder than ever, and Anthropic's Addy Osmani shares how to look at code review.

OpenCode attack exposes user API keys: The open-source coding agent says hackers have hit it nonstop for 48 hours. It started when attackers broke into a legacy system and grabbed provider keys saved by 1.4% of its console users. They drained those OpenAI and Anthropic keys with high-volume queries, and some developers reportedly woke up to $1,700 bills. OpenAI is refunding credits, but the incident isn’t over. Here’s what to do next if you’ve used OpenCode Console.

DeepSeek’s budget coding model edges past Claude Opus 5: The Chinese AI lab just dropped V4.1-Flash-1017, which scores 77.0 on the DeepSWE coding benchmark. That beats Claude Opus 5’s 74.0 in DeepSeek’s own tests. Opus 5 still wins on Terminal-Bench and ProgramBench, but price is the bigger story. Input on the V4.1-Flash-1017 costs $0.30 per million tokens, or half that off-peak. It works with OpenAI- and Anthropic-style endpoints for easy switching. New Search and Fetch APIs also let agents search the web for $0.75 per 1,000 requests. Try it here.

Anthropic’s AI-first workplace is squeezing out junior engineers: The AI lab just shared how Claude is changing work inside its own walls, and junior engineers are getting less of a look-in. Their share of technical hires has dropped from 27% to 9% since early 2025. Meanwhile, one in five employees says they’ve gone from doing the work to managing Claudes. That hasn’t cleared their calendars, either. Meetings are up 16% for technical staff, with human judgment becoming the new bottleneck. You can read the full report here.

Google Cloud invites startup leaders to an exclusive, high-level briefing with the Google DeepMind team to unpack the new Gemini 4 Argon model and explore its high-impact business applications.

Why you should attend:

Register your interest for the briefing

Eight weeks, one small team. Meta’s engineers gave an AI agent a bigger job than writing code. It helped plan, build, and test Forum, a standalone Groups app that reached core feature parity with Facebook Groups in that time. Most importantly, the team created a clear process to verify the agent's work before shipping.

Show your work. Getting code to compile was only the start. Meta counted a change only once it was verified and production-ready. The setup comes down to three moves any team can copy:

Trust has a test suite. The more Meta trusts those checks, the more work it can safely hand over. Routine stress tests during development caught a memory issue. The agent reproduced the problem, fixed it, and verified the result, roughly halving memory use and page faults before the app reached users.

Green isn’t golden. Passing every automated check does not guarantee good code. Meta learned that test suites must actively catch shortcuts, because faster runs cannot fix weak evaluation signals. Today, engineers still review and approve every shipped change while working toward full autonomy. Ultimately, giving agents more ownership starts with building foolproof ways to verify their work. 

To try it, this hooks guide shows how to block an agent from finishing until your tests pass.

Your agents will open twice as many PRs next year, but your reviewers won’t double.

The gap between code written and code verified only grows. Learn how agents close it:

Join the webinar →

How to build a terminal setup you’ll actually stick with: A senior dev walks through the open-source tools and configs that survived a ton of trial and error in his daily setup. You’ll see how he combines Ghostty, tmux, a coding agent, better terminal navigation and history, plus his IDE and file explorer into one workflow that feels fast without turning into config hell.

Handwired (1.8k ⭐): You can turn normal JavaScript into a neural net without training one from scratch. It converts things like if-else logic and loops into matrix math while keeping the same output. You could use it to experiment with training parts of regular programs, combine hand-written logic with neural nets, or speed up certain workloads with GPU-style parallelism.

How Claude Code handles code review (by Anthropic): The team shares the review stack it uses when agents are shipping most of the code. The playbook is practical and says to make agents verify their own work before the PR, run fresh-context AI and security reviews, scale human approval by risk, and cap review rounds so agents don’t endlessly fix each other’s nits.

You can also reply directly to this email if you have suggestions, feedback, or questions.

Until next time — The Code team