All issues · Issue #4
The AI Till #4: An AI coding tool breach ran up users' bills
Tuesday 20 October 2026
Four notes: a breach that ran up AI bills, hidden chatbot orders at WhatsApp, a free assistant and Mistral's forecasting models.
1. OpenCode breach ran up charges on users' AI accounts
What it is: Attackers broke into an older OpenCode system and reached 1.4% of users of OpenCode Console, where some people store API keys (the passwords apps use to reach AI services). Developers reported unauthorised charges in the hundreds of dollars, a few above $1,000. Anthropic and Google blocked keys they believed were exposed; OpenAI is refunding its API customers, and OpenCode says refunds are underway. The open-source app was not affected. Affected users were emailed and told to replace their keys with each provider. (TechCrunch)
Who it helps: anyone who has pasted an AI API key into a third-party tool or dashboard.
Price: not stated.
2. WhatsApp's help pages hid orders for its support chatbot
What it is: Redact, a data-deletion company, found 102 blocks of hidden text written for an AI on 80 WhatsApp help pages. One told the AI not to recommend a data protection regulator to people who could not delete their account; another said not to mention GDPR once a user brought up a lawyer. (Redact) WhatsApp told WIRED they were instructions for its support chatbot, exposed by a bug now fixed. (WIRED)
Who it helps: anyone running a support chatbot: text hidden in a web page can still be read in the page code.
Price: free to read.
Link: https://redact.dev/blog/whatsapp-help-pages-hidden-ai-instructions
3. Wabi: a free personal assistant built around chat threads
What it is: Replika founder Eugenia Kuyda has launched Wabi for all users. It works like a messaging app, with a thread for each job and small apps, such as trackers or lists, built inside them. Connect your email and it sets these up for you; threads can be shared like group chats. Wabi says it is SOC 2 compliant (its security controls are independently audited) and stores most user data in the US. (TechCrunch)
Who it helps: owners juggling work and home tasks who are comfortable with US data storage.
Price: free for now; the company has not settled on a business model.
4. Timestral: Mistral's forecasting models
What it is: Mistral has released Timestral, four models that forecast figures over time, such as demand or energy use. They run on an ordinary processor without a graphics card, give a range of likely outcomes rather than one number, and can use things known in advance, such as holidays or weather forecasts. Code to run them on your own data is on GitHub, under a modified MIT licence. (Mistral)
Who it helps: businesses with someone technical who want better stock or demand forecasts from their own history.
Price: not stated.
Link: https://mistral.ai/news/timestral/
Try this today
If you pay for AI by usage, put a cap on it. On OpenAI's API platform, set a monthly spend limit and turn on "Enforce a hard limit" so requests stop at your cap. (OpenAI) In the Claude Console, open the Billing page and set your own spend limit below your tier's cap. (Anthropic) Then delete any API key you no longer use.
Affiliate slot
None today: nothing fitted honestly.
See you tomorrow,
The AI Till
Spotted a tool worth a look? Just reply.
Get one useful AI tool in your inbox each weekday
Free, plain English, five minutes to read. Unsubscribe any time.
See our privacy notice.