OpenCode Console Breach May Have Exposed OpenAI, Anthropic, and Google API Keys

Summary

An intruder reached a legacy system at OpenCode on the night of October 16 and may have exposed third-party AI provider keys saved in OpenCode Console, affecting 1.4% of Console users with a linked outside provider. OpenCode says it has not confirmed that any key was copied or used, though some users report unauthorized charges on their OpenAI, Anthropic and Google accounts.

Mitigation

Revoke the affected provider keys in each provider's dashboard and create new ones, update every application and script that used the old key, review provider usage and billing back to at least October 16, set spend limits or alerts, and give each tool its own key.

Related items

• InfoAI firm Anthropic to commit 5% of shares to fund for ‘public good’Same vendor · The Guardian Technology
• MediumFake Web3 Accelerator Uses npm Packages to Spread Malware and Hijack AI Agent TrafficSame vendor · The Hacker News
• InfoAI researchers stranded Claude on a virtual desert island. It started to “play.”Same vendor · MIT Technology Review
• InfoAnthropic Acquires Confidential AI Startup Opaque SystemsSame vendor · SecurityWeek
• InfoAnthropic says it will commit 5% of its shares to 'public benefit fund'Same vendor · BBC Technology