# Morning digest: OpenCode's key breach, Codex limits, and data center pushback

> OpenCode's Console breach exposed saved AI keys, Codex limits are draining fast, and pushback against data centers is growing.

Published 2026-10-18T07:22:04-07:00 · Daily Digest · Canonical: https://news.littlewolflabs.com/posts/2026-10-18-morning-digest

Morning digest for Sunday, Oct 18. It's a quiet weekend: none of the big labs shipped anything official since Friday evening, so this one leans on security, policy, and a couple of fun ones.

## OpenCode's Console breach exposed some users' saved AI keys.

OpenCode says a breach on Thursday night, which it tied to a "large scale distillation attack," hit 1.4% of OpenCode Console users. That's the group who had saved their own OpenAI, Anthropic, or Google keys there. Anthropic says it revoked Claude keys it believes were affected, and OpenCode says refunds are underway. Some users posted bills of $700 to $3,000, but we haven't verified those numbers. OpenCode says the open-source tool itself isn't involved, because keys you use there never reach its servers. *What this means for you:* if you used Console with saved keys, make new keys, check your usage on each provider's site, and set spending caps. ([OpenCode](https://x.com/opencode/status/2111519637049319818), [Anthropic's Lydia Hallie](https://x.com/lydiahallie/status/2111563956666110287), [The Latent](https://thelatent.co/models/opencode-says-breach-tied-to-distillation-attack-exposed-users-ai-provider-keys))

## Codex users say their usage limits are draining fast, and OpenAI is looking into it.

After Friday's reset, people posted their 5-hour and weekly bars dropping sharply after only a little work. OpenAI's Vaibhav Srivastav asked anyone affected to run /feedback on a few of those threads and share the IDs. OpenAI hasn't announced a cause, a fix, or any change to its limits. *What this means for you:* if your bar drops oddly, file /feedback with the thread IDs. Officially, nothing about the limits has changed. ([VB's post](https://x.com/reach_vb/status/2111700756348981319))

## Three unannounced OpenAI models briefly showed up in the API.

They were named aurora-red-alpha, aurora-green-alpha, and aurora-blue-alpha, and testers say they were pulled shortly after. There are no docs, no pricing, and no word from OpenAI. One tester thinks they're image models, but that's unconfirmed. There's nothing to use or pay for yet. ([Andrew Curran](https://x.com/AndrewCurran_/status/2111656899338973391), [TestingCatalog](https://x.com/testingcatalog/status/2111724606927028578))

## Odyssey put a simulated fruit-fly brain inside its Odyssey-3 world model, and the fly now flies around generated worlds on its own.

It's an eerie, fun demo. Odyssey-3 itself has a free browser demo, and developers can apply for API access. It has no public price yet. *Try it:* if you make games or 3D work, it's free to play with. ([Odyssey](https://x.com/odysseyml/status/2111589148146749616), [The Decoder](https://the-decoder.com/odyssey-3-is-a-new-generative-world-model-that-you-can-try-for-free/))

## Cloudflare will start grading its "verified" bots on whether they actually follow site rules.

It will score whether a bot obeys robots.txt and slows down when a site says it's getting too many requests, and it plans to publish those scores later. *What this means for you:* together with Meta's terms change this week, it means robots.txt is starting to carry real weight. It's free, and there's nothing to set up yet. ([Cloudflare](https://blog.cloudflare.com/verified-bots-accountability/))

## AI companies' legal risks are bigger than what insurers will cover.

The Wall Street Journal reports that insurers put the biggest labs' potential liabilities in the tens, maybe hundreds, of billions of dollars. Munich Re's AI-error policy tops out at $50 million. Some standard business policies now offer optional exclusions for generative AI, and exclusions for AI agents are under consideration. *What to watch:* if your business uses AI agents, check your next policy renewal for AI exclusions. ([WSJ](https://www.wsj.com/tech/ai/ai-runs-into-its-next-big-obstacle-insurance-8b2d4556))

## Pushback against data centers is growing.

San Francisco's mayor signed a 45-day pause on new data centers so the city can study their effects. On Saturday, people in Halifax protested Anthropic's planned Nova Scotia data center, citing water and community concerns. *What to watch:* local permits are becoming a real limit on how fast AI computing power can grow. ([SF Standard](https://sfstandard.com/2026/10/16/mayor-lurie-data-center-moratorium/), [Global News](https://globalnews.ca/news/12106542/nova-scotians-stand-against-data-centre/))