OpenCode Console breach puts linked model keys at risk
OpenCode said on October 17 that unauthorized access to a legacy Console system the previous night may have exposed third-party API keys tied to 1.4% of Console users with external providers linked. The company said OpenCode itself was not breached.
Teams connect OpenAI, Anthropic, or Google Gemini once in Console; it stores each workspace’s key and supplies it when members make model requests. That makes Console a credential broker: access to its stored keys could expose provider access without compromising the providers’ systems, potentially enabling requests and API spend.
For teams that reused those keys in other applications, the exposure can follow the credential beyond Console: the key may still authorize provider requests and costs even though the provider accounts themselves were not breached.
OpenCode hack exposes API keys amid AI distillation attacks
The open-source AI coding project OpenCode has notified a small number of users that API keys they used with external providers were exposed in a security breach.