OpenCode Console Security Breach: User API Credentials Leaked

Incident Overview

OpenCode recently reported a security breach affecting its 'OpenCode Console' platform. The company stated that unauthorized access to a legacy system—which was in the process of being decommissioned—led to the potential exposure of third-party API keys (such as those from OpenAI, Anthropic, and Google) stored within user workspaces. The incident impacted approximately 1.4% of OpenCode Console users, all of whom have been notified via email.

Scope and Impact

Clarification regarding the affected software is critical, as community members noted significant confusion between the various OpenCode products. The breach is isolated to 'OpenCode Console,' a hosted service similar to OpenRouter that allows users to input their own API keys. Users of the standard OpenCode CLI coding agent or the desktop application are reportedly not affected by this incident.

Despite the limited scope, the impact on affected users is severe. Many users have reported unauthorized usage of their API keys, leading to drained balances at various AI providers. The OpenCode team has advised all impacted users to immediately revoke and replace their API keys through their respective provider dashboards, update any applications utilizing those keys, and monitor their accounts for further suspicious activity.

Community Response and Security Concerns

Technical observers and users have raised significant concerns regarding the security architecture of the OpenCode Console. A primary point of contention is the practice of storing sensitive API credentials on backend servers, which critics argue is inherently risky.

Community members highlighted several recurring themes in the discussion:

• Lack of Transparency: Users pointed out a lack of clear documentation, Terms of Service, or Privacy Policies regarding how API keys are handled and stored within the Console.
• Communication Failures: The initial announcement was criticized for failing to clearly distinguish between the Console service and the broader OpenCode ecosystem, causing unnecessary alarm among users of the CLI tool.
• Pre-existing Warnings: Some users noted that the platform had previously been flagged by security tools like VirusTotal, suggesting that the breach may be part of a larger pattern of questionable security practices.

Recommendations for Affected Users

If you are an OpenCode Console user, you should treat your stored API keys as compromised. The recommended remediation steps include:

1. Revoke Keys: Immediately invalidate any API keys that were stored within the OpenCode Console via the respective provider's dashboard (e.g., OpenAI, Anthropic, Google).
2. Generate New Keys: Create new credentials for your services.
3. Audit Usage: Review your provider billing statements for any unauthorized activity that may have occurred during the window of the breach.
4. Update Integrations: Ensure all local applications or services that relied on the old keys are updated with the new credentials.