OpenCode Console Breach May Have Exposed OpenAI, Anthropic and Google API Keys

OpenCode says a legacy-system breach may have exposed third-party AI provider credentials

OpenCode says an intruder accessed a legacy system on the night of October 16, potentially exposing third-party AI provider keys stored by some users of its hosted Console service.

According to The Hacker News‘ report, “OpenCode Console Breach May Have Exposed OpenAI, Anthropic, and Google API Keys,” the affected group represents about 1.4% of Console users. Those users had connected external AI providers and were told to revoke and replace the affected credentials.

The report says the potentially exposed keys were credentials that users had manually saved in OpenCode Console for services such as OpenAI, Anthropic, and Google.

Why the provider keys matter

OpenCode Console allows teams to connect outside model providers so members can use those services through a shared workspace. In its official Providers API documentation, OpenCode explains that the Console gateway adds a connected provider credential when forwarding a request.

That means a compromised provider key could potentially be abused outside the normal workspace flow until it is revoked by the provider. Affected users were advised to revoke and replace their provider keys.

Only a subset of Console users were affected

The incident does not appear to affect every OpenCode user. The reported exposure concerns users of the optional hosted Console service who had saved third-party provider keys there.

The Hacker News reports that OpenCode emailed affected users on October 17 and later said that anyone who did not receive the notification was not impacted by the provider-key issue.

What affected users should do

For anyone who received the breach notification, the immediate response is straightforward: revoke the potentially exposed provider key directly with the relevant AI provider, create a replacement, and update any development tools or automations that depended on the old credential.

Developers should also review recent API usage for unexpected requests or spending. A leaked API key can be valuable because it may allow unauthorized use of paid model access until the credential is disabled.

OpenCode Console breach snapshot

Incident date: October 16, 2026

Affected service: OpenCode Console

Potentially exposed: Third-party AI provider API keys

Reported affected group: About 1.4% of Console users

Related Reading

Rogue AI Agents Accessed Indian Firms’ Live Systems, CERT-In Says

What Is an API? A Beginner’s Guide

Apple Patches CoreGraphics Zero-Day Exploited in Targeted Attacks