● Covered by 1 source · 1 reportMedium impact1 negative
OpenCode Console Breach Exposed OpenAI, Anthropic, and Google API Keys
Key points
- OpenCode Console experienced a breach on October 16.
- Third-party AI provider keys for 1.4% of Console users were potentially exposed.
- Affected users must revoke and replace their OpenAI, Anthropic, and Google keys.
- Some users reported unauthorized usage and billing charges.
Breach Details
On the night of October 16, an intruder accessed a legacy system within OpenCode's Console service. This breach may have exposed third-party AI provider keys that users had stored in the Console, an optional hosted service where workspaces save their OpenAI, Anthropic, or Google keys for model access.
Affected Users and Notification
The breach impacted 1.4% of OpenCode Console users who had linked an external provider key. OpenCode notified these users via email on October 17, instructing them to revoke and replace their compromised keys with each respective provider. Users who did not receive this email were not affected.
Key Security and Scope
The exposed keys were specifically those pasted into the OpenCode Console. Keys stored locally in the OpenCode command-line and desktop applications were not affected, as they are kept in a local SQLite database and do not transmit to OpenCode's servers. A provider key is a bearer credential, meaning anyone holding a copy can make billable requests against the owner's account until the key is revoked by the provider.
Deleting a key from Console does not revoke it, and Console budget limits do not apply to usage outside its gateway.
Required Actions for Users
Affected users must revoke the old key in the provider's dashboard and generate a new one, following instructions from OpenAI, Anthropic, or Google. They also need to update all applications and scripts using the old key. It is recommended to review usage and billing with the provider for any unauthorized requests dating back to October 16.
OpenCode advises setting spend limits or alerts at the provider level and using unique keys for each tool to minimize potential damage and improve traceability.
Reported Unauthorized Usage
Several users have reported unauthorized charges following the breach. Examples include Colin Parsons, who reported $281 in OpenAI usage and $168 in Anthropic usage, and Preston Zeller, who cited losses of $1,700. Other reports include a Reddit user claiming $400 of unauthorized Anthropic usage and another reporting approximately €200 of Google usage, leading to project suspension.
✨ This summary was generated by AI from the outlets' reporting listed below. It is not independently verified and may contain errors — check the original sources. How BrevFeed works →
The daily brief
One email each morning: the day's tech stories, clustered across outlets and summarized. No account needed.
One email a day. Unsubscribe in one click, any time.
Today's brief
Spend a few minutes, get the whole day. Every topic's top stories in one hands-free rundown — listen, watch, or read the transcript.
▶ Play today's brief
New every morning, and the back catalogue is archived by date.
Reporting from
OpenCode reported a breach of its Console service on October 16, potentially exposing third-party AI provider keys for 1.4% of its Console users. Affected users have been advised to revoke and replace their OpenAI, Anthropic, and Google API keys, as some users have already reported unauthorized usage and associated costs.