OpenCode Console Breach May Have Exposed OpenAI, Anthropic, and Google API Keys
An intruder accessed a legacy system on October 16 and may have exposed the AI provider keys saved in Console, though OpenCode has not confirmed any key was copied. About 1.4% of Console users with linked outside providers were notified to revoke and replace those keys. Some users reported unauthorized usage leading to costs such as $281 for OpenAI or $1,700 for Anthropic.
Zero Day Brief #25 · 20 Oct 2026
Sources
Story so far
- Stolen AI API keys are paying for hackers’ autonomous scans – Help Net Security
first report - OpenCode Console Breach May Have Exposed OpenAI, Anthropic, and Google API Keys – The Hacker News
- OpenCode Breach Could Affect OpenAI, Anthropic and Google – Infosecurity Magazine
- OpenCode hack exposes API keys amid AI distillation attacks – BleepingComputer
- Researchers Warn OpenCode Quietly Patched Critical RCE Flaw, Leaving Users At Risk – Infosecurity Magazine
patch / fix released
Fact-checked against the sources above before publishing. AI-assisted script, synthetic voice, human-approved. Found an error? Tell us.
