OpenCode Console Breach Exposes Third-Party AI Provider API Keys

# OpenCode Console Breach Exposes Third-Party AI Provider API Keys

https://gcdradar.vercel.app/incidents/opencode-console-breach-exposes-third-party-ai-provider-api · AIR-2026-1406 · closed 2026-11-02

- Lane: Breaches & attacks
- Severity: 3 (Confirmed exploitation)
- Fix status: No fix needed
- First reported: 2026-10-19 (happened 2026-10-16)
- AI role: Attack on AI
- Products: OpenCode Console

## Summary

An unauthorized intrusion into a legacy system at OpenCode may have exposed user-stored API keys for major AI providers. The incident compromises third-party keys managed within the hosted workspace service.

## What to do

No action recorded; read the sources below and the vendor's advisory.

## Latest updates

- 2026-10-19: OpenCode Console Breach May Have Exposed OpenAI, Anthropic, and Google API Keys (https://thehackernews.com/2026/10/opencode-console-breach-may-have.html)

## Sources

- 2026-10-19 The Hacker News: OpenCode Console Breach May Have Exposed OpenAI, Anthropic, and Google API Keys https://thehackernews.com/2026/10/opencode-console-breach-may-have.html

Verify against the vendor's advisory before changing production. Data CC BY-SA 4.0, https://gcdradar.vercel.app.