An intruder reached a legacy OpenCode system on October 16. The breach may have exposed third-party AI provider keys saved in OpenCode Console. Affected users are 1.4% of Console users with linked provider keys. OpenCode emailed them on October 17 to revoke and replace those keys. The keys at risk are only those pasted into Console. OpenCode’s CLI and desktop apps store keys locally and are unaffected. A provider key lets anyone run billable requests until revoked. OpenCode has not confirmed any key was copied or used. The incident is ongoing and linked to a large-scale distillation attack. Attackers continued trying to breach OpenCode systems on October 18.
What changed
Provider keys in Console were assumed secure and not at risk of exposure.
What it unlocks
Revoking and replacing exposed provider keys to prevent unauthorized usage.
- 1.4% of Console users affected
- $281 OpenAI usage reported
- $1,700 losses reported
- $168 Anthropic usage reported
What you need to act on it
- a Console workspace with a linked third-party AI provider key
Sources