OpenCode breach may expose users' OpenAI, Anthropic and Google API keys

· Cybersecurity

OpenCode, the open-source AI coding project, has notified a small number of users that API keys they used with external providers were exposed in a security breach. The company said an intruder reached a legacy system on the night of October 16 and may have exposed third-party AI provider keys saved in OpenCode Console, its optional hosted workspace where users store their own OpenAI, Anthropic or Google keys. The keys are used to access paid AI services, so exposure could let others run up usage or reach the providers' models at the users' expense. The immediate effect is that affected users must rotate their credentials. Coverage also links the incident to activity described as AI distillation attacks. Only a small number of users were notified.

Why it matters：API keys stored in developer tooling are an expanding attack surface as AI coding agents become standard, and leaked provider keys carry both financial and model-access risk.

Key points

  • The intruder reached a legacy system on the night of October 16.
  • Console stores users' own OpenAI, Anthropic or Google keys for hosted workspaces.
  • The company notified only a small number of users.

Sources (original reporting)

More stories from this day