OpenCode Console Breach Puts Saved AI Provider Keys at Risk

OpenCode says an intruder reached a legacy system on the night of October 16 and may have exposed third-party AI provider keys that users saved in OpenCode Console, its optional hosted service. About 1.4% of Console users are affected, all of whom had an outside provider linked. OpenCode emailed them on the morning of October 17 with the subject line "Action Required: Potential provider key breach", and said anyone who did not receive it was not affected.

Co-founder Dax Raad said the breach involves the Console, not OpenCode itself, and that keys added in the command-line and desktop apps "never come to us". A provider key works like a password that anyone holding a copy can use to run billable requests on the owner's account until the provider revokes it. Deleting the key from Console does not revoke it, and a Console budget cannot cap misuse, because Console only sees requests that pass through its own gateway. Affected users are told to revoke and replace keys with each provider.

Some users say they have already been charged for usage they did not run. One reported $281 on OpenAI and $168 on Anthropic, another put losses at $1,700, and Reddit users claimed about $400 on Anthropic and around €200 on Google. These are the users' own accounts. OpenCode says the keys "may have been exposed" and has not said any key was copied or used.