OpenCode says Console breach may expose API keys

OpenCode said an intruder reached a legacy system on the night of 16 October and may have exposed third-party provider keys saved in OpenCode Console. Console is the company’s hosted service for storing a workspace’s own OpenAI, Anthropic or Google key so team members can use those models.

OpenCode said 1.4% of Console users were affected, all of them with an external provider linked. It emailed those users on the morning of 17 October and later said on X that anyone who did not receive the email was not affected.

Raad said the incident concerned Console, not OpenCode itself, and that the keys in question were the ones pasted into Console. He also said the company never received those keys, while OpenCode said deleting a key from Console would not revoke it at the provider.

OpenCode said the incident was still ongoing and that it was working with Anthropic, OpenAI and Google. It has not said how the system was reached, how many keys were involved, or how many users the 1.4% figure represented.

Some users have said they were billed for activity they did not carry out. Dealroom reported claims from Colin Parsons and Preston Zeller, while OpenCode said only that the keys may have been exposed and did not say any key was copied or used.