OpenCode Console Breach May Have Exposed OpenAI, Anthropic, and Google API Keys
thehackernews.com Oct 19, 2026

OpenCode Console Breach May Have Exposed OpenAI, Anthropic, and Google API Keys

AI-summarised brief · reviewed before publication

On October 16 an intruder accessed a legacy OpenCode system and may have exposed API keys for OpenAI, Anthropic and Google that users stored in the OpenCode Console, the company’s hosted workspace service. The breach affects about 1.4 % of Console users who had linked an external provider; they were emailed on October 17 to revoke and replace the keys. OpenCode stresses the breach involves only the Console, not its core platform, and that the keys are bearer credentials that could be used to generate billable requests until revoked. Users reported unauthorized charges ranging from $168 to $1,700, while OpenCode has not confirmed any key was actually copied. The firm is working with the three AI providers to remediate the incident, which it links to a large‑scale distillation attack.

💡 Why It Matters

  • · Exposed provider keys let attackers run costly AI queries on victims’ accounts, turning stolen credentials into immediate financial loss and highlighting the vulnerability of shared‑key SaaS workspaces.