OpenCode Console breach may have exposed users' OpenAI, Anthropic and Google API keys
OpenCode says an intruder reached a legacy system on the night of Oct. 16 and may have exposed the third-party AI provider keys saved in OpenCode Console, its hosted gateway. The company says 1.4% of Console users, all with outside providers linked, were affected; it emailed them Oct. 17 to revoke and replace those keys and tied the breach to a "large-scale distillation attack." Anthropic says it has revoked Claude keys it believes were affected and Google says it has blocked exposed Gemini keys, while some users report hundreds of dollars in unauthorized charges. Keys used locally with the OpenCode CLI and desktop app were not involved, co-founder Dax Raad said.
Source: The Hacker News