OpenCode Says Breach May Have Exposed Provider Keys

OpenCode said unauthorized access to a legacy system may have exposed third-party AI provider keys saved by some users in its Console service, affecting 1.4% of Console users who had linked external providers. The company connected the incident to a large-scale distillation attack, but has not confirmed that any keys were copied or used. The company said the access occurred on the night of October 16. Its October 17 notification described possible exposure of keys stored in Console workspaces, including credentials for OpenAI, Anthropic and Google. OpenCode said the affected share applies to Console users with linked providers, not to its entire user base. OpenCode said it emailed identified affected users on the morning of October 17 and instructed them to revoke and replace their provider keys through the providers’ own dashboards. The company also advised users to update applications and scripts that rely on the old credentials and review provider usage for activity they did not authorize. Console is an optional hosted service that can use provider keys saved to a workspace so team members can access models without seeing the credentials. OpenCode cofounder Dax Raad said...