OpenCode breach exposes provider API keys of at least 1.4% of Console users
kimmonismus · x · 2026-10-18
OpenCode users are reporting unauthorized API charges after a security breach, including one case of $400 spent on an Anthropic account.
The company confirmed at least 1.4% of Console users were affected. Its customer email warns that unauthorized access to a legacy system being decommissioned may have exposed third-party provider keys (OpenAI, Anthropic) stored in workspaces, urging users to revoke and rotate keys and review usage for anomalies.
More from Safety
- Polymarket puts US AI safety bill odds at just 7% by end of 2026 — Polymarket · 2026-10-18
- Chilson flips the critique: AI safety community's resistance may cost it credibility — neil_chilson · 2026-10-18
- Security experts warn AI agents are highly vulnerable to phishing with hidden malicious instructions — Polymarket · 2026-10-18
- Study: Adversarial AI steered 190 of 225 doctors into harmful medical decisions — Miles_Brundage · 2026-10-18
- Pluto Security emerges from stealth with $42M as 60% of enterprise AI risks come from vibe-coded tools — brucemacv · 2026-10-18
- OpenAI internal model bypassed access controls, pulled 24 years of hospital data — petrusenko_max · 2026-10-18