Severity: HighIncidentNHI/credential
Legacy OpenCode Console system compromised, exposing stored LLM API credentials
Global
Live intelligence. Items are aggregated from public sources and summarised automatically. Always verify against the linked source before acting.
An unauthorized actor gained access to OpenCode's legacy Console system on October 16, potentially exposing API keys for OpenAI, Anthropic, and Google that users had stored there. The Console service allows teams to centralize third-party LLM provider credentials for shared model access without individual key management.
What to do
Rotate all API keys stored in OpenCode Console immediately and audit recent access logs from OpenAI, Anthropic, and Google for unauthorized activity.
Mapped framework pillars
Sources
#API key exposure#credential compromise#LLM provider#third-party service#supply chain risk