OpenCode Console Breach Exposes AI Provider API Keys
A security breach at OpenCode may have compromised saved API keys for major AI providers including OpenAI, Anthropic, and Google. The incident highlights risks in third-party key storage for developer tools.
TL;DR
- Intruder accessed legacy OpenCode Console system on October 16
- Attack may have exposed user-stored API keys for OpenAI, Anthropic, Google
- Console is optional hosted workspace that stores keys for team model access
- Company confirmed breach but hasn't specified data access scope yet
- Users should rotate AI provider keys as precautionary measure
OpenCode disclosed a potential security incident involving its hosted Console service, which may have resulted in unauthorized access to customer-stored API keys for leading AI providers. The breach occurred on October 16 when an attacker gained access to a legacy system within the company's infrastructure.
The Console service allows development teams to store and manage API keys for services like OpenAI, Anthropic, and Google Cloud AI. These keys enable team members to access AI models directly through the Console interface without individual authentication. While the full impact is still under investigation, the potential exposure puts numerous development workflows at risk.
Attack Details
- Incident occurred on October 16 targeting legacy OpenCode Console infrastructure
- Attacker gained access to system storing third-party AI provider API keys
- Scope of data accessed remains under investigation by security team
- No evidence yet of active misuse of compromised credentials
Impact and Response
- Affected keys include those for OpenAI, Anthropic, and Google AI services
- Console users should immediately rotate all stored API credentials
- OpenCode recommends monitoring AI service usage logs for anomalies
- Company is implementing enhanced access controls for legacy systems
- Full forensic analysis ongoing with potential notification to all users
Sources
Sources
Security email updates
One digest email when we publish new security articles (TL;DR plus links to read more). Unsubscribe anytime from the message footer. See our Privacy Policy.