On October 23, 2026, TypeSafe AI CEO Diogo Almeida announced a "massive unauthorized leak of ALL customer noul outputs" and linked a GitHub gist. The gist was a joke: one file, outputs.json, containing 101 numbers from 0.00 to 1.00. The reply thread (a revised gist "removing my output", a European-only GDPR joke, "I am the hecker") shows nobody took it as a real incident. It still got a lot of attention, partly because the real incident feed is so crowded this month that "yet another AI leak" sounded plausible. This post explains the joke, then does the useful part: how to tell a joke or an unverified claim from a real breach, and what to do about the real ones.
| Question | Short answer |
|---|---|
| Was the TypeSafe AI leak real? | No. The gist holds 101 numbers, 0.00 through 1.00 |
| Is anything in the gist sensitive? | No. It is the whole output range of a bounded score |
| Are real AI attacks happening this month? | Yes, many. See the October 2026 attacks timeline |
| What is the practical takeaway? | Verify the claim, then rotate and cap keys on real incidents |
| Does Beam stop these attacks? | No. Beam watches and flags; it is not a firewall or a sandbox |
We read the gist and thread from the posts as shared; we did not clone or contact anyone involved. TypeSafe AI is the maker of the Jev model covered in Jev and agent hooks.
Why the joke works: a bounded output cannot leak much
The gag is a small piece of real security thinking. If a model returns a calibrated score between 0 and 1, its output space is tiny. Publish every value to two decimals and you have published 101 numbers, which reveals nothing about any customer. The joke is that "all customer outputs" for such a model fits in a gist and holds no secrets.
Free-text systems are the opposite. A chat model or a coding agent can output anything, including a key it read from an environment variable, a customer's name from a log, or a command that does damage. That is why leaks from LLM features are real: the output space is unbounded, so something sensitive can end up in it. We covered the same problem on the input side in protecting an LLM feature from prompt injection and key theft.
The real attacks this month
The joke landed in a month where the attack feed is genuinely heavy. The October 2026 attacks timeline holds 50 entries as of its October 23 update, covering supply chain compromises, breaches, exploited and critical vulnerabilities, AI-run attacks and agent incidents. A few that matter most if you build with AI:
- Platform breach: Railway told users to rotate secrets after a breach. See Railway breach: environment variables and AI keys.
- Compromised package: LiteLLM 1.107.0 on PyPI and Docker was compromised and targeted AI credentials.
- Agents hunting exposed endpoints: Symantec described an agent that scans for model servers and keys in Skynet mode LLMjacking.
- Claims still being checked: the OpenRouter breach claim and the OpenCode console breach claim, each laid out as claimed versus verified.
- Broader view: AI-led attacks in October 2026 pulls the pattern together.
The common thread is stolen or exposed AI provider keys and credentials, because they are cheap to monetize and often sit in environment variables and logs.
How to tell a joke or false claim from a real breach
Run any "leak" through five questions before you react. The TypeSafe gist fails the first and the last.
| Check | A real disclosure | This gist |
|---|---|---|
| Does the artifact match the claim? | Samples or a schema consistent with the described data | 101 numbers, not customer outputs |
| Is there a named, accountable source? | Vendor statement, status page or a named research team | The CEO posting a gag |
| Does it say what was taken? | Data types, date range, number affected | "ALL outputs", with no scope |
| Does it say what to do? | Rotate X, update to Y, watch for Z | No actions |
| Do independent parties confirm it? | Second source or reproducible evidence | Replies treat it as a joke |
This is the same structure as Beam's claimed-versus-verified posts, such as OpenCode console. Say plainly what is confirmed, what is claimed and what you have not inspected.
What to do while claims are noisy
Joke or not, a busy month is a good time to reduce what a stolen key can do. None of this needs a confirmed breach.
- Rotate and scope. Replace provider keys you have shared with any platform in the news, and give each key the narrowest permissions it needs. The first 24 hours after a vendor breach runbook has the order.
- Set spend caps and alerts. A stolen AI key's first sign is usually a bill or a spike in tokens.
- Keep keys out of logs. See API keys in logs and env vars.
- Watch the running app.
beam monitorreads app logs and HTTP access logs for injection, traversal and credentials written to logs, and sends redacted findings only. It never blocks traffic, and detection is heuristic, so expect some false positives and some misses. - Know the limits of monitoring. Read what app monitoring can and cannot catch before you rely on it after a platform-level breach.
How Beam handles this
Beam is local-first. For the coding agents on your machine, it flags credential exposure and risky commands, scans skills and MCP configs, and keeps data on-device by default. For a running app, beam monitor and the monitor SDK add log and LLM-feature checks, described in the app monitoring solution page. None of that confirms or refutes a breach claim for you, and Beam does not replace key rotation or a vendor's own disclosure.
FAQ
Was the TypeSafe AI customer output leak real?
No. The gist contains outputs.json, an array of 101 numbers from 0.00 to 1.00 in steps of 0.01. That is the full range of a bounded score, not customer data, and the replies treat it as a joke.
What did the gist actually contain?
Only those 101 numbers. One commenter pointed out that you could shave a few bytes by writing 0 instead of 0.00.
Are there real attacks on AI companies and keys this month?
Yes. Railway, LiteLLM, Symantec's LLMjacking report and the OpenRouter and OpenCode claims are all covered in Beam posts linked above and tracked in the October 2026 attacks timeline.
How do I tell a real breach from a joke or false claim?
Check that the artifact matches the claim, that the source is named and accountable, that the scope is stated, that there are actions to take, and that someone independent confirms it.
What should I do if my AI provider key might be exposed?
Rotate it, cap spend, scope it narrowly and review usage for traffic you did not send. Do it on a credible claim without waiting for confirmation.
Related reading
- October 2026 attacks timeline
- AI-led attacks in October 2026
- Jev and agent hooks: what a judgment model in your pipeline means for security
- Railway breach: environment variables and AI keys
- LiteLLM 1.107.0 compromise
- Your first 24 hours after a vendor breach
- Protect an LLM feature from prompt injection and key theft
- Monitor a running app for attacks with beam monitor
- App monitoring solution page
Accurate as of October 24, 2026, based on the post and gist as shared that day. TypeSafe AI could correct or expand on the joke; Beam is a local prototype and features are described as documented at the time of writing.