OpenCode confirms breach, stolen customer API keys already incurring charges
jedisct1 · x · 2026-10-18
Coding tool OpenCode has confirmed a security breach: a notification to customers says unauthorized access hit a legacy system being decommissioned, potentially exposing third-party provider API keys (e.g. OpenAI, Anthropic) saved in workspaces. Some users report stolen keys already running up charges. OpenCode is telling customers to revoke and replace keys via provider dashboards, update any applications using them, and review recent usage for unexpected activity.
More from coding & agent
- Running 20 concurrent low-latency regional-language voice agents on a single L4 GPU — DistrictUnique5259 · 2026-10-18
- Claude Code mods: event hooks that preview risky shell commands before execution — EricBuess · 2026-10-18
- fchollet: agents now write ~100% of code, yet corporate bottom lines aren't budging — fchollet · 2026-10-18
- Browser MCP Defense rule blocks external Codex agent tool calls before execution — HankYeomans · 2026-10-18
- Lambda crowns winners of three-week Build-a-Claw hackathon series across Europe — TheZachMueller · 2026-10-18
- Frontend perf rules for 2026: static-first, cache shared content, never block navigation — cramforce · 2026-10-18