OpenCode Console breach, ai-memory 3.1, and a late catch: Ultramarine 1 Flash

OpenCode says someone got into a legacy Console system it was in the middle of shutting down on the night of October 17. About 1.4% of Console users, those who had linked external providers such as OpenAI, Anthropic or Google to a workspace, were affected and have been notified by email. The company ties the incident to a large-scale distillation attack (harvesting another model's outputs in bulk to train on) and says it is still ongoing.

When provider keys handed to a coding agent leak in bulk, surprise bills and key abuse follow fast. OpenCode says users who got no email were not affected, but if you stored keys in Console, it's safer to issue new ones in each provider's dashboard and check recent usage. If your team hands keys to agent tools, you should recheck key scopes and spending limits.

ai-memory is an MIT-licensed tool that lets more than 20 coding agents, including Claude Code, Codex, Cursor, Gemini CLI and OpenCode, share a single memory. It keeps work history as a plain Markdown wiki and hands off what you were doing, and what already failed, when you switch agents. In 3.1 the Windows install.ps1 and setup service step became production-ready, and switching agents with ai-memory run passes along part of the previous agent's conversation history, locally only.

curl -fsSL https://github.com/akitaonrails/ai-memory/releases/download/v3.1.1/install.sh | AI_MEMORY_VERSION=3.1.1 sh
ai-memory setup

If your team re-explains the whole project every time Claude Code hits its usage limit and someone switches to Codex, this is worth a try. The default path makes no LLM calls, and with one shared server teammates can pool project memory. 3.1.1 also adds security fixes that stop OIDC logins and LLM requests from going to non-TLS endpoints or being redirected to another origin.

Ultramarine 1 Flash is a model from US startup Paper Instruments, built by applying reinforcement learning to Z.ai's open GLM-5.3 Flash for finance, legal and consulting document work. It trains on tasks that have no automatically checkable answer, graded against per-task rubrics by an LLM judge. It's available now through the company's API, and the weights are promised soon on GitHub and Hugging Face.

The company reports 59.3Vendor claim on its own knowledge-work suite at $0.13 per taskVendor claim, far below Claude Fable 5's $8.19Vendor claim. Pricing is $0.15 per million input tokens and $0.50 per million output tokens. Teams that want to run long document work such as diligence memos or litigation chronologies cheaply may want to compare it.