The common thread in three recent breach disclosures is not the attackers but the credentials: plaintext secrets sitting in platforms and exposed API keys sitting in projects. Each story shows the same structural failure at a different layer, and one story shows how that failure is beginning to be priced. Taken together, they argue that the most consequential question in a breach is no longer how the intruder got in, but how long the exposure went unreported and who bears the cost of the delay.
The same weakness, three sizes
The Zeabur incident, as BleepingComputer reported, involved an attacker using leaked internal credentials stored in plaintext to compromise infrastructure and steal more than 3.2 million environment variable records and information for 321,810 accounts. That is a platform failure at scale: a development platform holding secrets for its customers became a single point of exposure for millions of records. The company is shutting down after a second security breach in two months, per BleepingComputer. The plaintext detail matters because it converts an ordinary credential leak into a systemic one; anyone with access to the storage layer had access to everything.
The OpenCode story, also from BleepingComputer, is smaller in volume but identical in kind. The open-source AI coding project notified a small number of users that API keys they used with external providers were exposed in a security breach, with reporting tying the incident to AI distillation attacks. A coding project is a distribution point for credentials to third-party services; when those keys leak, the exposure travels outward to providers the project does not control. The count of affected users is small, but the blast radius is set by where the keys work, not by how many were taken.
The third story is not a breach at all. Ars Technica reported that the FTC is probing Anthropic and OpenAI, with the possibility of fines on par with companies that delay data breach reports. That is a regulatory signal aimed at the reporting side of the same problem. It matters here because it connects the two technical stories to a commercial one: the cost of a breach is increasingly set by the disclosure timeline, not only by the data lost.
Why plaintext keeps winning
The Zeabur disclosure describes plaintext storage, which is less a sophisticated attack technique than an architectural shortcut. Secrets have to be readable by the systems that use them, so teams store them in forms that are convenient to retrieve and rotate. Convenience and safety pull in opposite directions, and the platform that chooses convenience for its customers inherits the risk for all of them. Environment variable records are especially sensitive because they typically contain the keys to databases, cloud accounts and third-party APIs; a single trove can be replayed against many targets.
The same logic explains OpenCode. API keys used with external providers are bearer credentials: whoever holds them can act as the holder. An open-source project that handles such keys on behalf of users is effectively a trust intermediary, and the breach notification to a small number of users does not shrink the risk to the providers whose keys were exposed. Distillation attacks, as described in the BleepingComputer reporting, add a motive that did not exist in earlier generations of credential theft: the keys are worth stealing for what they unlock in model access, not just for resale.
What it means for US companies
For US technology companies, the practical lesson is that credential hygiene is now a market-facing issue. A platform that stores customer secrets in plaintext is one incident away from a shutdown, as Zeabur demonstrates. Buyers evaluating development platforms and AI tooling have reason to ask where secrets live and how they are rotated, because the vendor's architecture becomes the customer's exposure. The 321,810 affected accounts at Zeabur are a reminder that the customer list and the victim list are the same document.