OpenCode Console Security Incident Exposes Third-Party AI Provider API Keys

A security incident at OpenCode's legacy system potentially exposed API keys for OpenAI, Anthropic, and Google stored in the OpenCode Console. The hosted service allows users to save third-party AI provider keys for team access to models.

An intruder reached a legacy system at OpenCode on the night of October 16 and may have exposed the third-party AI provider keys that users had saved in OpenCode Console, the company said.

Console is OpenCode's optional hosted service: a workspace saves its own OpenAI, Anthropic, or Google key there, and Console uses that key to call the provider so team members can use the models without

Read original article