Open Code Console Breach May Have Exposed OpenAI, Anthropic, and Google API Keys

Summary: An intruder reached a legacy system at OpenCode on the night of October 16 and may have exposed third-party AI provider keys that users had saved in OpenCode Console, affecting 1.4% of Console users who all have an outside provider linked. OpenCode emailed those users on the morning of October 17 under the subject line "Action Required: Potential provider key breach" and said anyone who did not receive one was not affected.
Bottom line: A provider key is a bearer credential, and deleting it from Console does not revoke it - users have reported unauthorized charges of $281 and $168 (Colin Parsons), $1,700 (Preston Zeller), $400 on an Anthropic account, and about €200 of Google usage, while OpenCode has not said any key was copied or used.

Read the original at The Hacker News ↗