OpenCode Console Breach May Have Exposed OpenAI, Anthropic, and Google API Keys

On the night of October 16, an intruder accessed a legacy system at OpenCode, potentially exposing third-party AI provider API keys stored by users in OpenCode Console. OpenCode Console is an optional hosted service that allows workspaces to store their OpenAI, Anthropic, or Google API keys, enabling team members to access AI models through a shared interface. The breach may have compromised sensitive credentials that users had saved within the platform. The incident raises concerns about the security of API key storage in third-party hosted services. Affected users may face risks of unauthorized usage of their AI provider accounts, potential cost exposure, and data privacy implications if the keys are misused.