OpenCode breach exposes user API keys for external AI providers

Tue, 20 Oct 2026 15:39:31 +0000

Engineer — Plan: If your team uses OpenCode, audit which external-provider API keys were configured through it and rotate any that may have been exposed; scope is described as small, but key rotation is low-cost insurance.
SOC/IR — Learn: No IOCs or TTPs published; breach affects a niche open-source tool with limited enterprise footprint and no detection surface described in the report.
Leader — Skip

OpenCode Console Breach May Have Exposed AI Provider API Keys

Mon, 19 Oct 2026 17:27:24 +0000

Engineer — Act: If your team stored OpenAI, Anthropic, or Google API keys in OpenCode Console, treat them as compromised: revoke and reissue those keys immediately, then audit provider dashboards for unauthorized calls since October 16.
SOC/IR — Act: For any org using OpenCode Console, hunt for anomalous AI provider API usage (unexpected spikes in calls, unfamiliar IP origins, unexpected cost) in OpenAI/Anthropic/Google dashboards and SIEM from October 16 onward, assuming keys may be in adversary hands.
Leader — Act: Confirm whether your organization uses OpenCode Console; if so, request an incident report from OpenCode and have engineering rotate all affected AI provider keys this week — exposure of these keys can result in significant unauthorized spend or data access via AI APIs.