OpenCode Console Breach May Have Exposed OpenAI, Anthropic, and Google API Keys

An intruder accessed a legacy system at OpenCode on October 16, potentially exposing third-party AI provider keys stored in OpenCode Console. The affected keys belong to users who had saved them in the Console service, which uses these keys to call providers such as OpenAI, Anthropic, and Google. The Console is an optional hosted service offered by OpenCode, allowing teams to use AI models without having to share their keys. The breach may have compromised the security of these keys, which are used to access AI services from these major providers. OpenCode's Console service is designed to facilitate teamwork by enabling members to use AI models through the stored keys. The incident occurred in a legacy system, suggesting that the vulnerability may have been present in an outdated part of O