OpenCode says it has been the target of an intrusion that may expose API keys stored in its OpenCode Console service. According to reporting, the incident occurs on the night of October 16, when an attacker gains access to a legacy system. OpenCode’s optional hosted Console keeps per-workspace credentials that allow Console to make calls to third-party AI providers on users’ behalf.
Multiple outlets report that if keys were accessed, they could potentially allow compromise of API accounts associated with OpenAI, Anthropic, and Google Gemini. The extent of exposure is not fully detailed in the available summaries, but the concern centers on credentials users saved to Console. One outlet also notes that the breach happens while OpenCode is in the process of shutting down or winding down the affected service, adding context to why a legacy component was reachable.
Overall, the coverage aligns on the same core incident: an OpenCode Console/legacy-system breach involving the possible exposure of third-party AI provider API keys. The differences are primarily in emphasis and depth, with some pieces outlining how Console uses stored keys and others describing the incident timeline and implications for users.
