OpenCode Breach Puts AI API Keys at Risk
OpenCode’s hosted Console sprang a leak, and it may have exposed OpenAI, Anthropic, and Google API keys. The company claims 1.4% of Console users were affected and notified; its co-founder insists that keys stored solely in local apps weren’t dragged into the mess.
Surprise! Users are already reporting unauthorized AI bills.
If you received the dreaded notice, revoke and replace the affected keys in each provider’s dashboard, update connected apps, and scrutinize your usage and billing. Deleting a key from Console doesn’t actually revoke it, and Console budgets won’t stop requests made directly to the providers. Set strict provider spending limits and alerts where available.
Bring your own key shouldn’t mean bankroll somebody else’s prompts.
Broadcom Wi-Fi Bug Bypasses Passwords for Router Takeovers
A 16-year-old vulnerability in Broadcom’s Wi-Fi Protected Setup (WPS) software is now old enough to drive, letting nearby attackers run code as root on millions of affected routers without a network password. Security researcher Quentin Kaiser proved the exploit works on Belgian ISP gateways, though he hasn’t observed any real-world attacks yet.
While Broadcom quietly issued an incomplete fix in 2018, the chipmaker never secured a CVE identifier, leaving countless devices exposed and blissfully ignorant.
Kaiser’s tested devices remained unpatched as of Oct. 15. Ask your ISP or manufacturer whether your model is affected and about potential fixes. Because turning off WPS won’t necessarily stop an intrusion, permanently unsupported affected routers should head straight to the nearest dumpster.
Your Wi-Fi password can’t guard a door this bug walks around.
Cyber Job Ads Slide; AI Security Listings Surge
US cybersecurity job postings fell 26.4% to 235,786 in January–September 2026 compared with the same period last year, reaching a four-year low, CyberSN reports. Before you panic, remember that’s fewer corporate wanted ads, not a headcount of actual humans shown the door.
Meanwhile, AI security engineer postings more than tripled to about 2,400. But those eye-popping gains are confined to a tiny niche—we aren’t seeing an AI replacement boom swallowing the entire field. Case in point, penetration tester postings fell nearly in half.
Even AI’s broader footprint requires a reality check: CyberSN’s data shows 14.6% of postings mentioned AI or machine learning over the nine months, slightly below 2025’s share. Sure, September spiked to 20%, but that’s recent momentum, not a yearlong generative takeover. Last year’s uncharacteristically hot market makes the annual comparison look especially brutal; zoom out, and overall postings were only about 4% below 2024.
And no, the robots aren’t directly causing the overall hiring freeze. A separate Ramp–Revelio study of 21,559 US firms actually linked intensive AI adoption to roughly 10% higher employment after two years compared with slower-moving peers. (Though, to be fair, that finding isn’t exclusive to the cyber realm.)
Rather than chasing shiny AI objects, security leaders still need warm bodies to staff core defenses. A spike in AI specialists won’t magically triage your overflowing alert queue, fix busted access controls, or execute an incident response plan when things inevitably break. Teams must build automation skills without starving their everyday trenches.
Apparently, the fabled cyber talent shortage and corporate headcount budgets still aren’t speaking.
BeyondTrust Zero-Day Gives Hackers Root Access
Google reports that suspected China-linked hackers exploited a critical BeyondTrust Remote Support zero-day.
The vulnerability enables root access, credential theft, and potential downstream compromise.
I’d prioritize reviewing BeyondTrust session logs and stored credentials for evidence of attackers using trusted connections to access downstream systems.
Verify patch status, audit privileged sessions, and rotate potentially compromised credentials.
Robot Accused of Groping Teen in Germany
German police seized a humanoid robot after it allegedly groped a 16-year-old girl outside a fast-food restaurant in Cologne.
Investigators are examining whether its movements were remotely controlled or preprogrammed to determine who may be legally responsible.
Manufacturers should build operator tracking and tamper-resistant logs into robots to help investigators determine whether a robot’s actions were controlled by a person or performed autonomously.
Organizations deploying robots should restrict remote access, monitor operator activity, and test emergency shutdown controls.
Fake Chrome App Amasses 100K Downloads
Google removed a fake Chrome app from Google Play after its listing surpassed 100,000 downloads.
Originally released as Ball Bounce, the app impersonated Chrome but displayed a chat interface, with no confirmed malware or data theft.
This shows why users can’t rely on app store listings alone, since fake apps can imitate trusted brands and appear legitimate despite passing store reviews.
Verify app publishers before installation and use managed app catalogs to prevent unauthorized downloads.
Anthropic Grants AI Watchdogs Employee-Level Access
Anthropic is granting METR researchers employee-level access to assess its AI safety practices.
The researchers can publish findings without prior approval, although certain sensitive information may be redacted.
I think the real test will be whether METR can publicly identify significant AI risks and whether Anthropic takes meaningful action to address them.
Organizations should review independent AI evaluations and conduct security assessments before granting access to sensitive data.
How Secure Are Your Applications?
A 2026 Cloud Security Alliance report found that 80% of surveyed organizations experienced security incidents involving known application vulnerabilities.
How to reduce application security risk:
- Use DevSecOps tools to scan application code and third-party dependencies for vulnerabilities and prioritize security updates.
- Secure APIs with authentication, authorization, and rate limiting while enforcing least privilege and encrypting sensitive data.
- Store credentials in dedicated secrets managers and monitor application logs for suspicious activity and potential exploitation.
Report exploitable application exposure and remediation performance against risk thresholds to the board.