Three side doors in ten days: Coinbase, Warp, OpenCode

OpenCode's console, a Warp vendor and Coinbase's analytics provider: three leaks in ten days, two blamed on AI agents. What leaked, and what to ask vendors.

MATT Research10 min read
Illustration: Three side doors in ten days: Coinbase, Warp, OpenCode

In the ten days to 28 October 2026, three companies disclosed leaks that came through the tools around a product: a hosted AI console, a vendor inside an agent platform, and an analytics service. OpenCode lost AI provider keys that customers had stored with it. Warp says an attack on one of its vendors reached AI agent records for up to 1% of its users. Coinbase says contact details for a small subset of its customers leaked from Amplitude, the analytics provider it uses.

In two of the three, the company says AI agents did the attacking. In all three, the tool held something an attacker could use the moment it left: keys that bill someone else for AI, a record of what developers' agents did, and a list of people to approach while posing as support.

The 30‑second version

  • →OpenCode, 17 October: attackers got into an older part of its hosted console and reached the OpenAI, Anthropic and Google keys that 1.4% of console users had stored there. Developers reported charges from several hundred dollars to $1,700 overnight.
  • →Warp, 23 to 26 October: Warp spotted an attack on one of its vendors within hours. Its CEO says it came from "an agent swarm" and reached agent trace and telemetry data for an upper bound of roughly 1% of users.
  • →Coinbase, 27 to 28 October: an incident at Amplitude exposed contact data for a "small subset" of Coinbase customers and for other Amplitude clients. Coinbase says it "has not had a data breach" and that funds were untouched.
  • →OpenCode's own investigation slowed when the AI models it used began refusing requests, until it got a security model built for defenders.
  • →Key facts are still missing: Warp's vendor is unnamed, Amplitude has made no public statement, and no one has published how the attackers got in.
Timeline of October 2026: 17 October, OpenCode's console is breached and AI provider keys stored by 1.4% of console users are exposed; 18 October, OpenCode's co-founder says attackers kept at it non-stop for 48 hours; 23 October, Warp spots an attack on a vendor within hours, later attributed by its CEO to an agent swarm; 26 October, Warp discloses that agent trace and telemetry data for up to roughly 1% of users was reached; 27 to 28 October, an incident at Amplitude, Coinbase's analytics provider; 28 October, Coinbase says it has not had a data breach and that a small subset of customer contact data was affected.
Sources: OpenCode, Warp's CEO and Coinbase Support on X; BleepingComputer.

OpenCode: the keys in the console

OpenCode is an open-source AI coding agent. OpenCode Console is its hosted service, where teams can store the API keys they use for OpenAI, Anthropic and Google models so that members can work without handling them. On 17 October OpenCode said on X ↗ that it had suffered "a security breach last night", which it tied to "a large scale distillation attack", affecting 1.4% of console users, all of them people who had linked an outside provider. The open-source app and command-line tool were out of scope, co-founder Dax Raad told TechCrunch ↗, because "those keys never come to us".

The keys went to work fast. BleepingComputer ↗ reported that the earliest possible exposure was 00:30 UTC on 17 October, and that developers found unauthorised charges from several hundred dollars to $1,700 overnight; some had Google projects suspended for activity "consistent with hijacked resources". Anthropic and Google blocked the keys they believed were exposed, OpenAI said it would refund API credits used in the attack, and OpenCode said refunds were under way.

OpenCode called it a distillation attack: stolen model access used to copy a model's behaviour at scale. TechCrunch notes that this explanation remains unproven. The inside view is clearer. "They've been non stop trying to attack our systems for the past 48 hours," Raad wrote the next day ↗, adding that his team needed agents running around the clock "because that's what they have". His team's investigation also stalled, he said, when the AI models it was using started refusing requests, until it was given access to Daybreak Blue, OpenAI's security programme for defenders.

Warp: the agent records at a vendor

Warp began as a terminal and now calls itself an agentic development environment, where developers direct AI agents that write, test and deploy code; BleepingComputer ↗ puts its users at more than 800,000. On 26 October its CEO, Zach Lloyd, posted ↗ that on the Friday before, 23 October, Warp had found "an active and narrow-banded exploitation of a vendor" in its infrastructure, detected "within hours".

His account of the attacker is the striking part. The attack "appears to have come from an agent swarm" using "a very sophisticated penetration and escalation technique", most likely starting from "a hole in a vendor dependency". It reached "a limited amount of agent trace and telemetry data", for what Warp puts at "an upper bound of roughly 1%" of users. On our arithmetic, 1% of more than 800,000 is up to about 8,000 developers.

Warp has brought in CrowdStrike and law enforcement, notified everyone it has positively identified as affected, and says they will receive instructions. It has not named the vendor or said what the traces contained. That matters, because an agent's trace is a working record: the task it was given, the commands it ran, the files and code it read, and whatever a developer pasted into the session, sometimes including a key. A trace sits much closer to source code than to page analytics.

Coinbase: the contact list at the analytics provider

Late on 27 October, US time, Coinbase's support account posted ↗ that "Coinbase has not had a data breach." Amplitude, "an analytics vendor", had a security incident that touched "a small subset of Coinbase customer contact data", along with other Amplitude customers. Coinbase said it had found no sign of access to its own systems, that customer funds were untouched, and that it was notifying customers and regulators.

Coinbase did not say how many customers were affected or which fields were taken; CoinDesk ↗ and others reported email addresses and phone numbers. A researcher at the blockchain security firm SlowMist put the number above 70,000, a figure Coinbase has not confirmed. As of 28 October Amplitude had published no statement.

Contact details sound minor. For people who hold crypto, they are the first half of a familiar fraud: a call or message from someone posing as support. Coinbase knows the cost of that pattern. In May 2025, after bribed support contractors leaked far richer data, including ID images and account details, Coinbase estimated the cost ↗ at "approximately $180 million to $400 million" and said it was working to stop the data being "used in social-engineering attempts". This leak is much narrower, and reports say Coinbase has again told customers to watch for phishing.

Three cards comparing what each tool held. OpenCode Console, the hosted console of an AI coding tool, held customers' OpenAI, Anthropic and Google API keys, useful to an attacker as model access billed to someone else; 1.4% of console users, charges up to $1,700 overnight. A Warp vendor held AI agent trace and telemetry data, useful as a record of what users' agents did; up to about 1% of users, vendor not yet named. Amplitude, the analytics provider to Coinbase and others, held customer contact data, useful as a list of people to target with fake support messages; a small subset of Coinbase customers, 70,000-plus claimed and unconfirmed.
Sources: OpenCode, Warp's CEO and Coinbase Support on X; BleepingComputer; TechCrunch.

What the three have in common

Different companies, different data, one shape.

  • →Each tool held something usable on its own. Keys that run up someone else's AI bill, a record of developers' agent sessions, a list of people to contact while posing as support. Each was worth something the moment it left, with no further break-in needed.
  • →The data went to the tool on purpose. Customers stored keys in OpenCode's console so their teams could share them. Warp's agent records sat in infrastructure that included a vendor's component. Coinbase sent customer contact data to Amplitude to understand how its product is used. Each choice made sense, and each added a system that had to hold.
  • →Agents were on the attacking side, by the companies' own account. Warp's CEO describes an agent swarm; OpenCode's co-founder describes attackers working non-stop and the need to answer with agents of his own. Neither company has published technical evidence, so the attribution is theirs.
  • →The defenders' tools pushed back. OpenCode's investigation slowed when its models refused requests, a reminder that safeguards built to stop attackers can also slow the people cleaning up.
  • →The first disclosures were short. Each came within days, on X, with a percentage or a "small subset" and few other details.

The Record logged the same shape in April, when a third-party AI tool's access was the route into Vercel (the Vercel entry). OpenCode and Warp are now on the Record too.

What is still unknown

  • →Which vendor Warp means, and what the exposed agent traces contained.
  • →How the Amplitude incident happened, how many companies it touched, and which fields were taken.
  • →How attackers got into OpenCode's older system, and how the stored keys were protected.
  • →Whether any of the three incidents are connected. Nothing published so far links them.

We will update this piece as the companies publish more.

What to do this week

For a team that builds software, the list is short and unglamorous.

  • →List every tool that holds customer data, agent records or keys. Analytics, error tracking, support desks, AI coding tools, agent platforms and the vendors behind them. For each, write down what it holds and what someone could do with it, then put the questions below to its vendor.
  • →Send analytics only what it needs. Product analytics rarely needs a raw email address or phone number; a stable internal ID usually does the job.
  • →Treat agent traces and telemetry as secrets. Keep credentials out of agent sessions, set short retention, and ask each AI tool where its traces go and who can read them.
  • →Put limits on every AI key. One key per tool, spending caps and alerts at the provider, and a rotation you can run in minutes when a vendor sends a notice.
  • →Tell customers exactly how support will contact them. A clear, published rule makes a fake call easier to spot.
  • →Rehearse the vendor email. Decide in advance who reads a supplier's breach notice, what gets rotated, and who tells customers.

What to ask every vendor that holds your data

In all three cases the data sat with a supplier: OpenCode held its customers' keys, a vendor held Warp's agent records, and Amplitude held Coinbase's customer contacts. The most useful defence starts before anything goes wrong: knowing what each vendor holds and how it protects it. Most established vendors publish a security overview, often called a trust center or security whitepaper, that describes how they store, use and protect customer data. That overview is the vendor's own account; the questions below turn it into commitments you can check.

AskWhy it mattersA good answer includes
What exactly do you hold for us, and where?A team can only protect data it knows a vendor has.A data inventory: the fields, the regions they are stored in, and the systems that touch them.
What do you use our data for, and do you train AI models on it?Analytics and AI tools often reuse customer data to improve their own products.A purpose limit written into the contract, with model training off by default or a switch to turn it off.
Who else touches it?Warp's leak started at one of its own vendors.A current list of sub-processors, and notice before a new one is added.
How long do you keep it, and how do we delete it?Data kept for years can leak years later.A retention period for each kind of data, and deletion on request and at contract end, confirmed in writing.
How do you store secrets and keys, and who can reach them?OpenCode's console held its customers' AI provider keys.Keys encrypted in a managed key service, access limited to named roles, and every access logged.
What do your AI agents, traces and logs record about our work?Warp's leak was agent trace and telemetry data.The fields that traces and logs capture, how long they are kept, whether secrets are filtered out, and who can read them.
What independent evidence can we see?An outside audit shows whether the controls work in practice.A recent SOC 2 Type II report or ISO/IEC 27001 certificate, and a summary of the latest penetration test.
How fast will you tell us about an incident, and what will you tell us?Coinbase learned of the Amplitude incident from Amplitude, and every first notice in this story was short.A notification deadline in the contract, a named security contact, and a list of the details the first notice will contain.
What can we switch off or mask?Every field that never leaves your systems is one less to leak.Settings to stop collecting fields such as email addresses, and a way to send internal IDs or masked values.

Three documents carry the answers. The security overview describes the controls. The audit report (SOC 2 Type II or ISO/IEC 27001) is independent evidence that they work; vendors usually share it under a non-disclosure agreement. The data processing agreement is the contract that sets what the vendor may do with personal data: under the EU's General Data Protection Regulation ↗, Article 28 requires one whenever a vendor processes personal data for you, and Article 33 requires the vendor to report a breach to you without undue delay.

For a deeper review, security teams use standard questionnaires such as the Cloud Security Alliance's CAIQ and Shared Assessments' SIG. Ask again every year and whenever a vendor ships a new AI feature, because new features often change what a tool collects and where it sends it.

Rules that hold or break

Each leak maps to a rule a team can write down and test: customer contact details reach analytics only as an internal ID; an agent trace never contains a live credential; every AI provider key carries a spending cap. Written down, a rule like that can be re-proven on every release, holding or broken. That is the practice ExploitOps describes, and the rules page shows how rules are written.

Sources

The logos are each company's own published versions. They identify the companies named in their public statements; MATT has no affiliation with OpenCode, Warp or Coinbase.

Questions

Was Coinbase hacked?

Coinbase says it was not: it found no unauthorised access to its systems and customer funds were untouched. Contact data for a small subset of its customers leaked in a security incident at Amplitude, its analytics provider, which also affected other Amplitude clients.

What leaked in the Warp breach?

Agent trace and telemetry data for an upper bound of roughly 1% of Warp users, through an attack on one of its vendors that Warp detected on 23 October 2026. Warp has not named the vendor or said what the traces contained, and says affected users will receive instructions.

What happened at OpenCode?

Attackers reached the OpenAI, Anthropic and Google API keys that 1.4% of OpenCode Console users had stored there, from about 17 October 2026. Some users reported charges of up to $1,700 overnight; providers blocked exposed keys and refunds are under way.

Were AI agents used in these attacks?

Warp's CEO says the attack on its vendor appears to have come from an agent swarm, and OpenCode's co-founder describes attackers working non-stop with agents. Neither company has published technical evidence, and Coinbase and Amplitude have not described the attacker.

Are the three incidents connected?

Nothing published so far connects them. They share a shape: each leak came through a tool that held data or keys on a company's or its customers' behalf.

What should a company ask its vendors about security?

What data the vendor holds and where, what it uses the data for (including AI training), who else touches it, how long it is kept, how secrets are stored, what its AI agents and logs record, what independent evidence it has (such as a SOC 2 Type II report), and how fast it will report an incident. The answers belong in its security overview, audit report and data processing agreement.

What should a company do this week?

List every tool that holds customer data, agent records or keys; send analytics only internal IDs; keep credentials out of agent sessions; cap and rotate AI keys; tell customers how support will contact them; and rehearse the response to a vendor's breach notice.

Know where you stand.

Book a discovery call→