Breaches · 3h ago
OpenCode said on October 17 that unauthorized access to a legacy Console system the previous night may have exposed third-party API keys tied to 1.4% of Console users with external providers linked. The company said OpenCode itself was not breached.
Teams connect OpenAI, Anthropic, or Google Gemini once in Console; it stores each workspace’s key and supplies it when members make model requests. That makes Console a credential broker: access to its stored keys could expose provider access without compromising the providers’ systems, potentially enabling requests and API spend.
For teams that reused those keys in other applications, the exposure can follow the credential beyond Console: the key may still authorize provider requests and costs even though the provider accounts themselves were not breached.
2 sources covering this story
OpenCode hack exposes API keys amid AI distillation attacks
The open-source AI coding project OpenCode has notified a small number of users that API keys they used with external providers were exposed in a security breach.
OpenCode Breach Could Affect OpenAI, Anthropic and Google
A breach affecting the OpenCode Console may lead to the exposure of API keys for Anthropic, OpenAI and Google Gemini users
Part of the PlainSec briefing for 2026-10-19