OpenCode Console Breach: Your AI API Keys Might Be Exposed

Emily Davis · 2026-10-19

Picture this. You wake up, grab your coffee, and find out a stranger may have had a shot at the API keys you trusted a hosting service to protect. That's the uncomfortable reality some OpenCode Console users are facing right now. On the night of October 16, an intruder got into a legacy system at OpenCode. According to the company, that break-in may have exposed the third-party AI provider keys users had stored in OpenCode Console. If you've got an OpenAI, Anthropic, or Google key saved there, this one's worth your attention. ### What Console Actually Does Console is OpenCode's optional hosted service. Here's the simple version: your workspace saves its own OpenAI, Anthropic, or Google key there, and Console uses that key to call the provider. That way, your team can use the models without passing credentials around by hand. Convenient? Absolutely. But it also means a single storage point holds something pretty valuable. Your API key is basically a credit card for AI usage. Anyone who gets hold of it can rack up charges in your name, and you might not notice until the bill lands. ### Why This Matters More Than It Sounds The phrase "legacy system" is doing a lot of quiet work in that statement. Legacy systems are the older parts of an infrastructure that often get less attention than the shiny new stuff. They're the back rooms nobody redecorates. When an attacker reaches one, it's a reminder that forgotten corners can still open big doors. Here's what's at stake if a key slips out: - Unauthorized charges on your provider account - Access to whatever data or workflows that key can reach - Reputational headaches if the usage traces back to your organization - Time lost rotating keys and chasing down what happened ### What You Should Do Right Now Don't wait for a formal all-clear. Treat this as a nudge to act. 1. **Rotate your keys.** Head into the OpenAI, Anthropic, or Google consoles and generate fresh API keys. Revoke the old ones. 2. **Audit your usage.** Check recent billing and activity logs for anything you don't recognize. 3. **Review your storage habits.** Ask yourself whether every key really needs to live in a hosted workspace. 4. **Set spending limits.** Most providers let you cap usage. Use that. > A key you haven't rotated is a key you're still trusting someone else to protect. ### The Bigger Lesson for Antidetect Browser Users If you work with antidetect browsers and multiple accounts, you already know how much your setup depends on clean, private credentials. The same discipline applies here. The best antidetect browser in the world won't save you if the keys behind your workflow are sitting in a spot that just got compromised. Think of API keys like spare house keys. You wouldn't hand a copy to a neighbor and forget about it. You'd know exactly who has one, and you'd change the locks the moment something felt off. OpenCode hasn't said how many users were affected or whether the keys were actually accessed. But "may have been exposed" is plenty of reason to move. Rotate first, ask questions later. Your future self, and your billing statement, will thank you.