OpenCode breach may have exposed stored AI provider keys

OpenCode disclosed a legacy console breach affecting approximately 1.4% of its users. The incident may have exposed stored API keys for OpenAI, Anthropic, and Google AI services.

Organizations that use OpenCode should immediately inventory agent credentials tied to the affected platform. Any secrets associated with the legacy console must be rotated without delay. IT and security teams should also monitor usage dashboards and billing statements across the linked AI provider accounts for unexpected activity or charges that could indicate unauthorized use.

The exposure is limited to credentials stored through the legacy console pathway. OpenCode has not reported broader system compromise or data loss beyond the potential key exposure. Affected customers are advised to review access logs and apply least-privilege principles when reissuing new keys.