Console is OpenCode's optional hosted service. Workspaces can save their own OpenAI, Anthropic, or Google API key there, and Console uses that key to call the provider on the workspace's behalf, allowing team members to use the models without handling credentials directly. Because those keys live in Console, any exposure of the underlying system puts the stored provider credentials at risk.

Key facts as disclosed:

• The intrusion involved a legacy system at OpenCode, reached on the night of October 16.
• Potentially affected data includes third-party AI provider keys saved in Console — specifically OpenAI, Anthropic, and Google keys.
• The company has not, in the disclosed information, confirmed which specific keys were actually accessed.

If your workspace stored provider keys in Console, treat them as potentially compromised until you hear otherwise. Rotating the affected keys with each provider is the safest course of action, and it is worth reviewing provider-side usage logs for any activity you don't recognize.

Source: The Hacker News

Did your team store provider keys in OpenCode Console, and have you rotated them yet?