OpenCode Console Breach May Have Leaked Users' AI API Keys
A breach inside a coding agent's Console layer turns every stored provider key into a liability, and the defensive burden now falls on both users and the model providers.
Reporting from 1 source: GIGAZINE.
Anomaly Innovations, which runs the open-source AI coding tool OpenCode, confirmed unauthorized access to an old system on October 17, 2026. API keys for OpenAI, Anthropic and others stored in OpenCode Console workspaces may have leaked, and the company says 1.4% of Console users were affected. Some users report drained balances and unrecognized charges. Anthropic says it has invalidated affected Claude API keys.
The access hit an old system that Anomaly Innovations was already retiring. OpenCode Console is separate from the regular OpenCode app, and people who only use the app itself are not affected. Keys stored in Console workspaces, used to reach OpenAI, Anthropic and other services, are the exposure. Anthropic's Lydia Hallie said the company has invalidated Claude API keys believed to be affected and is working with OpenCode. OpenCode developer Dax said attackers have kept attempting to hit the system for 48 hours and are running AI agents around the clock.
Synthesized by Yomimono from the 1 cited source below, including Japanese-language reporting where cited, then editorially reviewed before publishing.