OpenCode Discloses Breach That May Have Exposed Users' OpenAI, Anthropic, and Google API Keys
OpenCode, the open-source AI coding assistant, woke up Saturday to the email no developer wants. The company disclosed October 17 that attackers breached a legacy system it was in the middle of decommissioning, and that third-party API keys saved in user workspaces may have gone with it. About 1.4% of OpenCode Console users are affected. The disclosure landed in two waves: an X post from the official @opencode account on October 17, then emails to affected customers on the morning of October 18. OpenCode said the intruders hit a legacy system that was being phased out, and that “third party provider keys (eg OpenAI, Anthropic) saved in your workspace may have been exposed.” Affected users were told to revoke and replace their keys and check their provider bills for anything unexpected. ...