OpenCode Security Breach Exposes Third-Party API Keys of its Console Users
OpenCode says unauthorized access may have exposed third-party API keys for 1.4% of Console users.
OpenCode disclosed unauthorized access to a legacy system, saying third-party API keys saved by 1.4% of Console users may have been exposed. The affected group was limited to some Console users who had linked external providers, including OpenAI and Anthropic; users who were not emailed were not impacted. OpenCode said the October 17 incident was tied to a large-scale distillation attack and that it was working with Anthropic, OpenAI, and Google, but it did not explain entry, dwell time, key count, or whether exposed credentials were used. Notified users were told to revoke and replace keys, update dependent applications, and review recent usage and billing.