CuraSec

tag: Api-Key-Exposure · 2 items

Plan OpenCode breach exposes user API keys for external AI providers
2026-10-20 · BleepingComputer · source ↗ #api-key-exposure#supply-chain#ai-tooling
  • Engineer — Plan: If your team uses OpenCode, audit which external-provider API keys were configured through it and rotate any that may have been exposed; scope is described as small, but key rotation is low-cost insurance.
  • SOC/IR — Learn: No IOCs or TTPs published; breach affects a niche open-source tool with limited enterprise footprint and no detection surface described in the report.
  • Leader — Skip
Act OpenCode Console Breach May Have Exposed AI Provider API Keys
2026-10-19 · The Hacker News · source ↗ #vendor-breach#api-key-exposure#ai-provider
  • Engineer — Act: If your team stored OpenAI, Anthropic, or Google API keys in OpenCode Console, treat them as compromised: revoke and reissue those keys immediately, then audit provider dashboards for unauthorized calls since October 16.
  • SOC/IR — Act: For any org using OpenCode Console, hunt for anomalous AI provider API usage (unexpected spikes in calls, unfamiliar IP origins, unexpected cost) in OpenAI/Anthropic/Google dashboards and SIEM from October 16 onward, assuming keys may be in adversary hands.
  • Leader — Act: Confirm whether your organization uses OpenCode Console; if so, request an incident report from OpenCode and have engineering rotate all affected AI provider keys this week — exposure of these keys can result in significant unauthorized spend or data access via AI APIs.