OpenCode warns Console breach may have exposed AI provider keys

OpenCode has told users that an intruder reached a legacy system belonging to the company on the night of 16 October 2026, and that third-party AI provider keys stored in its OpenCode Console service may have been exposed. The disclosure was reported on 19 October 2026. According to the company, the keys at risk are the OpenAI, Anthropic and Google credentials that customers had saved in Console.

Console is OpenCode's optional hosted service. As the company describes it, a workspace saves its own OpenAI, Anthropic or Google key into Console, and Console then uses that key to call the provider on the workspace's behalf. The point of the arrangement is convenience: team members can use the hosted models without each person holding or configuring a key of their own. That design also means a single Console workspace can hold a credential that unlocks paid model access for an entire team.

That is what makes the exposure worth acting on. An API key for a major model provider is a bearer credential, meaning anyone who holds the string can use it. Whoever has it can send requests, and the billing lands on the account that issued it. OpenCode said the keys may have been exposed; the reporting does not state that any key was confirmed to have been used.

The company described the affected system as legacy, and has not, in the material available, said how the intruder reached it or what the root cause was. Nor is there a published figure for how many workspaces or keys were involved. Those gaps may be filled in later updates; for now the safe reading is that any key stored in Console before 16 October 2026 should be treated as potentially known to someone else.

The practical response for affected teams is the standard one for leaked credentials. Keys held in Console can be rotated at the provider — revoked at OpenAI, Anthropic or Google, and replaced with fresh ones — which renders any copied value useless. Usage and billing dashboards at each provider will show whether requests were made that the workspace does not recognise, and organisations with spend alerts configured are better placed to notice anomalies quickly.

The incident is a reminder of a structural issue with AI coding tools that offer hosted model access. Storing a provider key with an intermediary service concentrates risk: the intermediary becomes a target worth attacking precisely because it holds credentials for several large model providers at once, belonging to many customers. The breach was at OpenCode, not at OpenAI, Anthropic or Google, but the credentials potentially at stake belong to accounts at all three.

OpenCode has not published further detail on remediation steps or on whether the legacy system remains in service. The Agentic Times will update this report if the company issues a fuller account.