OpenCode says a Console breach may have exposed AI provider keys belonging to 1.4% of users, prompting revocation notices.
AI⏱ 1 min read · Source: The Hacker News (security)
⚡ Key Takeaways
- The affected group is 1.4% of Console users, all of whom have an outside provider linked, and OpenCode has told them via email to revoke those keys with each provider and replace…
- The email went out on the morning of October 17 under the subject line "Action Required: Potential provider key breach."
- The breach involves "the OpenCode Console, not OpenCode itself," co-founder Dax Raad wrote in a reply on X, and those keys "never come to us."
The Hacker News (security) reports: An intruder reached a legacy system at OpenCode on the night of October 16 and may have exposed the third-party AI provider keys that users had saved in OpenCode Console, the company said. Console is OpenCode's optional hosted service: a workspace saves its own OpenAI, Anthropic, or Google key there, and Console uses that key to call the provider so team members can use the models without ever seeing the key.
Key Points
- The affected group is 1.4% of Console users, all of whom have an outside provider linked, and OpenCode has told them via email to revoke those keys with each provider and replace…
- The email went out on the morning of October 17 under the subject line "Action Required: Potential provider key breach."
- The breach involves "the OpenCode Console, not OpenCode itself," co-founder Dax Raad wrote in a reply on X, and those keys "never come to us."
The Details
OpenCode's own wording is that the keys "may have been exposed," and it has not said that any key was copied or used. OpenCode's October 17 post also called the incident ongoing, said the company was working with Anthropic, OpenAI and Google to fix it, and described the breach as "related to a large-scale distillation attack."
Read the Full Story
This is a short news brief prepared by our desk. For the complete report, including all quotes and context, read the original article at The Hacker News (security).
Source: This article is based on reporting by The Hacker News (security) (The Hacker News). Read the original article.
This story was compiled automatically by BSDC Cortex 7.0 from the cited source, then checked by automated fact, style and quality gates. No external AI service was used.
📰 Related on this site
About bsdc news
bsdc news is a digital news engine providing structured coverage on software architecture, web technologies, and tech updates.