Observed incident

OpenCode Console breach puts linked AI provider keys at risk

Reported

Published here

What happened

OpenCode reported a breach affecting 1.4% of Console users. Cyera reported possible exposure of linked model-provider keys through a legacy system being retired, creating a risk of unauthorized usage and charges.

Parties and reporting

AI tools and systems: OpenCode Console, Linked OpenAI, Anthropic and Google provider credentials

Outcome

OpenCode notified affected users and said remediation was ongoing. Anthropic reported revoking Claude keys believed affected; the entry route, verified misuse and final losses remain undisclosed.

Operating lesson

Revoke exposed keys at their issuing provider, review usage and spending, and remove credential access from retiring systems.

Evidence and limits

Date is the public notice, following an overnight breach. The 1.4% scope and distillation characterization are OpenCode claims. Unauthorized-charge reports are unverified; no actor, attack model or total loss is established. This is distinct from the local OpenCode MCP flaw.

Sources