OpenCode Console Breach Leaks User API Keys
The OpenCode team has disclosed a breach of Console, its cloud service. Attackers reached an outdated internal system and compromised OpenAI, Anthropic and Google API keys stored in user workspaces, affecting 1.4% of users who had connected external tokens.
The leaked credentials have already been revoked by the OpenCode team together with engineers at the model providers. Contributor Dax Raad said the breach touched only auxiliary Console infrastructure, and that the code of the framework itself was not compromised.