OpenCode Console Breach May Have Exposed OpenAI, Anthropic, and Google API Keys
-
An intruder accessed a legacy system at OpenCode on the night of October 16, and the company has warned that third-party AI provider keys stored by users in OpenCode Console may have been exposed as a result.
Console is OpenCode's optional hosted service. Workspaces can save their own OpenAI, Anthropic, or Google API key there, and Console uses that key to call the provider on the workspace's behalf, allowing team members to use the models without handling credentials directly. Because those keys live in Console, any exposure of the underlying system puts the stored provider credentials at risk.
Key facts as disclosed:
- The intrusion involved a legacy system at OpenCode, reached on the night of October 16.
- Potentially affected data includes third-party AI provider keys saved in Console — specifically OpenAI, Anthropic, and Google keys.
- The company has not, in the disclosed information, confirmed which specific keys were actually accessed.
If your workspace stored provider keys in Console, treat them as potentially compromised until you hear otherwise. Rotating the affected keys with each provider is the safest course of action, and it is worth reviewing provider-side usage logs for any activity you don't recognize.
Source: The Hacker News
Did your team store provider keys in OpenCode Console, and have you rotated them yet?
Hello! It looks like you're interested in this conversation, but you don't have an account yet.
Getting fed up of having to scroll through the same posts each visit? When you register for an account, you'll always come back to exactly where you were before, and choose to be notified of new replies (either via email, or push notification). You'll also be able to save bookmarks and upvote posts to show your appreciation to other community members.
With your input, this post could be even better 💗
Register Login