OpenCode Says Breach May Have Exposed Users’ AI Provider Keys

OpenCode disclosed that an unauthorized party accessed an older system connected to its Console cloud service, potentially exposing API keys for OpenAI, Anthropic and Google used by developers.

OpenCode said 1.4% of Console users were affected and that it emailed everyone in that group. The company said users who received no notice were not affected. It linked the breach to a large-scale distillation attack.

Console is an optional cloud gateway that lets teams store their own AI provider keys in a workspace so members can use those services without seeing the credentials.

Max Weinbach posted that his OpenAI account recorded about 35 million tokens across 8,966 requests during the prior day, leaving his prepaid balance at negative $2.15. He also said Google warned that one of his projects might be compromised and temporarily reduced its usage limit or rejected API calls.

OpenCode said it could not confirm whether exposed keys had been used. It urged affected users to revoke and replace keys through each provider’s account controls. Removing a key from OpenCode alone does not invalidate copies already taken.