Content Quality: News piece, 568 words (range 400-1200). Clear structure (Overview, What We Know, User Reports, Guidance, What We Don't Know). Company claims are consistently attributed to OpenCode as relayed by the outlets and the hedge 'may have been exposed' is preserved in the body. Headline uses 'Says' attribution but states 'Exposed' flatly, which is somewhat stronger than OpenCode's own 'may have been exposed' (THN); BleepingComputer's lead states the keys 'were exposed', so the headline is defensible and not corrected.
Source Verification: Read both snapshots from disk (gunzip). source-0.html.gz (thehackernews.com, Swati Khandelwal, Oct 19 2026, HTTP 200, real article text, suspicious_patterns null): confirms every THN-attributed item: intruder reached a legacy system on the night of October 16; may have exposed third-party provider keys saved in Console; 1.4% of Console users, all with an outside provider linked; email on the morning of Oct 17 with subject 'Action Required: Potential provider key breach.'; non-recipients not affected per a later X post; Dax Raad quotes 'the OpenCode Console, not OpenCode itself' and keys 'never come to us' (CLI/desktop store keys locally in SQLite); 'may have been exposed' wording; incident called ongoing, working with Anthropic, OpenAI and Google; breach 'related to a large-scale distillation attack' (attributed to OpenCode's Oct 17 post, so the characterization is OpenCode's, not the outlet's or a researcher's); Oct 18 Raad quotes 'non stop trying to attack our systems for the past 48 hours' and 'a side effect is everything is getting hardened'; Dealroom-relayed Parsons $281 OpenAI / $168 Anthropic and Zeller $1,700, flagged as users' own accounts; deleting a key in Console does not revoke it; remediation steps incl. review usage back to Oct 16; and the list of things OpenCode has not said (start of access, how the two connect, legacy system, how reached, key count, user count, that any key was copied or used). source-1.html.gz (bleepingcomputer.com, Bill Toulas, Oct 19 2026): manifest shows archive_fallback true (Wayback capture 2026-10-21); the snapshot is real article text, not a Cloudflare challenge or blank. Live re-fetch with curl and a browser user-agent also returned HTTP 200 with the full article, with the same text as the snapshot (the earliest-exposure and reimbursement sentences below were checked in the live copy). It confirms: 1.4% of Console users affected; OpenCode working with Google, OpenAI and Anthropic; Raad said attackers targeted systems for at least 48 hours using AI agents; users report unauthorized charges from several hundred dollars to $1,700. Two BC-based statements need adjusting: (1) the article says OpenCode 'said it would explore reimbursement' but BC says only that the message to impacted users 'mentions the possibility of reimbursement'; (2) the article's 'What We Don't Know' states, per THN, that OpenCode has not said when unauthorized access began, but BC reports the email to users gives the earliest possible exposure as October 17, 2026, 00:30 UTC and says no data appears to have been exposed; the article omits this and reads as contradicting a cited source. Allowlist: thehackernews.com (line 768) and bleepingcomputer.com (line 767) both present by exact hostname. No orphan URLs: the only two body URLs are in article.sources. No person named beyond the sources (Raad, Parsons, Zeller are all named by the outlets); no individual blamed; no attacker identified.
Factual Accuracy: All dates, figures (1.4%, $281, $168, $1,700, 48 hours), quotes (verbatim from THN raw text) and attributions verified. Attack mechanics are not claimed beyond the sources. Two issues, both in subordinate body text: the reimbursement wording is stronger than BC and the 'when did access begin' unknown is partially answered by BC. Both are recoverable with a corrections note; neither touches the headline, summary or lead.
Overall Assessment: Substantively accurate, well attributed security-incident report with two minor recoverable imprecisions, published with a corrections record. Featured candidacy: 2 - notable security incident at a widely used open-source AI coding agent affecting third-party provider keys, but details are thin and unresolved