OpenCode Breach Exposes the Risk of Stored AI API Keys
A breach affecting 1.4% of OpenCode Console users may have exposed third-party AI provider keys and led to unauthorised charges.
OpenCode disclosed a security breach that may have exposed third-party AI provider keys belonging to 1.4% of its Console users.
What happened
An attacker reached a legacy system containing credentials saved by users who had connected external AI providers. Some affected users reported unauthorised usage and charges on their linked accounts. OpenCode notified the impacted group and advised them to revoke and rotate exposed keys.
Why it matters
AI developer tools often connect to several model providers through powerful API credentials. A compromise at one intermediary can therefore spread costs and access risks across multiple external accounts.
The bigger picture
As coding agents become more capable, their credential stores become higher-value targets. Secure secret storage, narrow permissions, rapid key rotation and clear incident response are becoming essential parts of the AI tooling stack.