When a breach becomes a timeline question: the OpenCode case

What happened

On 17 October 2026, OpenCode, a developer tools company, announced that a legacy authentication system had been breached ^[1]. Attackers gained access to API keys for OpenAI, Anthropic and Google AI services, affecting about 1.4% of users on OpenCode's Console platform. The stolen keys were used to run unauthorised AI operations, creating unexpected costs for users and potentially exposing prompts, completions and usage patterns.

OpenCode said it detected unusual activity, revoked the compromised keys and notified affected customers. Users were told to rotate their keys and review their API logs. The company has not said how long the attackers had access before detection, or exactly when the first detection note was written.

The timeline problem

Incidents like this one get scrutinised twice: once when they happen, and again months later when someone asks what took so long. The Cyber Resilience Act, which has applied since 11 September 2026, gives manufacturers 24 hours to send an early warning after becoming aware of an actively exploited vulnerability or a serious incident ^[2]. Sweden's Cybersecurity Act, in force since 15 January 2026, gives essential and important entities the same 24 hours for an early warning, then 72 hours for an incident notification and a month for a final report ^[3].

The clock starts when you became aware, not when the breach started. That sounds simple, but it turns into a hard question the day a supervisor asks: when did you know?

Think of it like a stolen credit card. The fraud might have been going on for days, but the question that matters is when you noticed the odd transactions and called the bank. If you noticed on Tuesday but didn't call until Thursday, you'll need to explain the gap. The breach timeline is one thing; the awareness timeline is another.

In OpenCode's case, online discussions have questioned whether the company's own incident log was edited after the fact. OpenCode has not commented on those claims. Whether they are true or not, the problem is a general one: the people keeping the log are the same people who could change it. When the timeline itself is disputed, how do you show that your detection notes haven't been rewritten?

What this means for you

If you build or operate systems that handle API keys, customer data or anything a regulator might ask about, here are three questions to ask now:

• If we detected an incident today, could we show a supervisor exactly when we knew, in a way nobody on our side could quietly alter?
• Do our incident response procedures say who records each step, and where?
• When we revoke access or rotate credentials, is there a record of when that happened that someone with administrator rights can't change?

The OpenCode incident is a reminder that the timeline of awareness is as important as the timeline of the breach itself. Rules like CRA and NIS2 turn that timeline into a compliance question with short deadlines. Getting it wrong can mean fines, but proving you got it right requires records you can stand behind.

How a sealed timeline works

Here, the thing to seal is each step of the incident response as it happens: the first detection note, the decision to escalate, each report as it is sent, and each action like revoking keys or notifying users. Sealing takes a fingerprint of the note, not the content, so sensitive details stay with you.

When a step is recorded, your system sends a fingerprint of it to WitniumChain through the REST API, the SDK or the MCP server, and gets a witness ID back. To check, a supervisor or an auditor calculates the fingerprint again from your log and compares it with the sealed one. If they match, the log is exactly what was recorded at the time it was sealed. Change a single character—even the timestamp—and it won't match.

Anyone you share the record with can check it. That includes your own board, your auditor, a supervisor or an insurer. The witness doesn't take sides; it just shows whether something has changed.

What it shows: that each step in your incident timeline was recorded when you say it was, unchanged since. What it doesn't show: that the response was adequate, that the report was complete, or that you complied with the rules. It gives you a timeline you can stand behind, not a defence.

The first 2,000 witnesses a month are free. Read the full documentation at witniumchain.com/docs.

What to watch

The Cyber Resilience Act's detailed technical standards on vulnerability handling and incident reporting are expected during 2027. Those will clarify exactly what manufacturers must report and when. Sweden's Cybersecurity Act is already in force, with MSB as the supervisory authority.

For anyone handling API keys or third-party services, the lesson is simpler: the day something goes wrong, the timeline of what you knew and when you knew it becomes as important as the breach itself. Decide now who keeps that record, and how you would prove it if someone questioned it.