← archiveGet 5 AI picks like these every weekday at 7am MT. Free, plus 50 vibe-coding prompts when you confirm.
Short Stack #4Mon, Oct 19, 2026
01
OpenCode's Console breach may have exposed saved AI provider keys
OpenCode says an intruder reached a legacy system on the night of Oct 16, and OpenAI, Anthropic and Google keys saved in about 1.4% of Console users' workspaces may have been exposed. OpenCode says keys kept locally by its CLI and desktop apps aren't involved. Some users report surprise bills (self-reported). Deleting a key from Console does not revoke it.
⏱ 10-MIN TRYOpen your OpenAI, Anthropic and Google dashboards, revoke any key you've pasted into a hosted tool, issue one new key per tool, and set a spend alert on each.
Source: thehackernews.com
02
DeepSeek opens its Search & Fetch APIs and ships V4.1-Flash-1017
DeepSeek released V4.1-Flash-1017 on Oct 17 with MIT-licensed weights and a 1M-token context. Its own benchmarks show 77.0 on DeepSWE v1.1 (up from 74.2) and 42.3 on Terminal-Bench 4.0 (up from 31.2). It also opened Search and Fetch APIs at $0.75 per 1,000 calls each; calls via server-side tools in DeepSeek Harness, Claude Code and Codex are free until billing starts Oct 31.
⏱ 10-MIN TRYPoint one agent task's web search at DeepSeek's Search endpoint and compare quality and cost with what you use today.
Source: api-docs.deepseek.com
03
OpenDesign Motion is an open-source take on code-to-video
Open Design 0.25.0 (Apache 2.0) adds OpenDesign Motion, which its makers pitch as an open-source alternative to Claude Motion. Ask for a video and you get editable source files plus an MP4; interactive animations stay runnable HTML. It ships five starter examples and runs with a local coding CLI or your own API key. Released Oct 15; the launch post followed Oct 16.
⏱ 10-MIN TRYInstall Open Design, open the UI Morph example, ask it to restyle the animation in your brand colors and type, then export the MP4.
Source: github.com
04
Meta pulls "train" from its commercial terms after scraping backlash
Meta's new commercial terms said it could use content from a business account's domains to "train" its products; legal experts told Nieman Lab that could reach publishers' sites. On Oct 17 Meta removed that language, saying the terms only cover its ads and business products and don't change how it crawls. Experts told Nieman Lab broad crawl permissions remain.
⏱ 10-MIN TRYIf you run a Meta business account, list the domains linked to it, then check your robots.txt covers the crawlers you do and don't want, Meta's included.
Source: techcrunch.com
05
Replit makes OpenAI the default model behind Replit Agent
Replit CEO Amjad Masad said at TechCrunch Disrupt that OpenAI is now its preferred partner and default, citing cost and performance. Claude models remain selectable, and a person familiar with the partnership told TechCrunch it is still in place. Most users keep defaults, so your app's model may have changed without you picking it.
⏱ 10-MIN TRYIn a Replit project, check which model Agent uses, then run the same small feature request on the default and on Claude and compare the diffs.
Source: techcrunch.com
Get tomorrow's in your inbox.