OpenCode Console breach may have exposed users' saved AI provider keys
OpenCode says an intruder reached a legacy system on the night of October 16 and may have exposed OpenAI, Anthropic and Google keys that 1.4% of OpenCode Console users had saved. Keys stored locally by the CLI and desktop apps were not affected. Some users report unexplained charges.
OpenCode, maker of an AI coding agent, told users on October 17 that an intruder reached a legacy system the night before and may have exposed third-party AI provider keys (OpenAI, Anthropic or Google) saved in OpenCode Console, its optional hosted service. It emailed the 1.4% of Console users with an outside provider linked; users who got no email were not affected, it said. Keys kept by the OpenCode command-line and desktop apps in a local SQLite database "never come to us," co-founder Dax Raad wrote. OpenCode has not said how the intruder got in, what the legacy system was, or whether any key was used. Users have publicly reported unexplained provider charges, one of $1,700, according to The Hacker News; OpenCode has not confirmed them.
Why it matters
A provider API key is a bearer credential with a billing account attached. Stolen AI keys are resold or burned for model access, the pattern called LLMjacking, and the bill is how most victims find out. Any hosted tool that stores your keys to call models on your behalf is holding a secret it can leak.
If you were notified, revoke the key in the provider's dashboard (deleting it in Console does not revoke it), issue a new one, and update every script that used it. Review provider usage back to October 16. Give each tool its own key with a spend cap or alert, so one breach has a known blast radius. Where a provider supports short-lived or scoped credentials, prefer them over a long-lived key pasted into a third-party service.
Source: OpenCode on X
Related on Start with Identity
- BlogNorthflank tells customers to assume every environment variable was decrypted after AI keys are abused
After a Wiz alert on October 30, cloud platform Northflank told customers to assume all environment variables were decrypted and rotate every key. Customers the
- BlogChainalysis now says password hashes and live tokens for all users were exposed
Chainalysis said on November 4 that names, usernames, password hashes and live tokens for all users were exposed, reversing its October 30 statement that no ses
- BlogDocker Sandboxes copy flaw let an AI agent reach host files such as cloud keys and SSH keys
A symlink flaw in the Docker Sandboxes copy command, CVE-2026-103916, let an AI coding agent inside the sandbox read or write host files outside its allowlist,
- CVEtj-actions/changed-files tags repointed to dump CI secrets into logs
An attacker repointed tj-actions/changed-files version tags to a commit that read the GitHub Actions runner's memory and printed its secrets into workflow logs.
- CVETrivy release and GitHub Action tags hijacked to steal CI secrets
With credentials left valid by a non-atomic rotation, an attacker shipped a malicious Trivy v0.69.4 and repointed 76 of 77 trivy-action tags to code that dumped
- RankingBest CIAM for High Scale: Top 5 Platforms for Millions of Users
The best CIAM platforms for high scale in 2026: Auth0, Ping Identity, MojoAuth, Stytch, and Transmit Security. Ranked for throughput, global reach, spike handli