OpenCode Console breach may have exposed provider API keys
Original title: OpenCode Breach Could Affect OpenAI, Anthropic and Google
OpenCode says 1.4% of Console users with linked external providers were affected; the OpenCode product itself was not.
On October 17, OpenCode said unauthorized access the night before to a legacy system being decommissioned may have exposed third-party keys stored in OpenCode Console, including OpenAI, Anthropic and Google credentials. It described a distillation attack affecting 1.4% of Console users who had external providers linked and said it emailed them and notified the providers. Contributor Dax Raad said OpenCode itself was not affected. Safeguard published steps to find, rotate and revoke potentially exposed keys.
Unconfirmed: OpenCode attributes the access to a distillation attack; what was read or used with the keys is not confirmed.
- Console stores workspace credentials and uses them to call model providers.
- Users who did not receive the action-required email were told they were not impacted.
- Safeguard advises checking provider usage and billing from October 16 onward.
- Create replacement keys before revoking old ones, then confirm the old keys fail.
Impact: Third-party AI provider API keys in Console workspaces may have been exposed
| Product | Affected |
|---|---|
| OpenCode Console | — |
- 1.Search for the email subject “Action Required: Potential provider key breach.”
- 2.Rotate OpenAI, Anthropic and Google Gemini keys stored in Console, then revoke the old ones.
- 3.Review provider usage and billing from October 16 for unfamiliar models or charges.
- Products
- OpenCode Console
- AI models
- Gemini
From the original article
3 min read at infosecurity-magazine.com
A breach affecting the OpenCode Console may lead to the exposure of API keys for Anthropic, OpenAI and Google Gemini users
By Kevin Poireault · infosecurity-magazine.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.