OpenCode reports breach affecting 1.4% of Console users
OpenCode says a breach affected 1.4% of Console users. Its founder separated hosted Console provider keys from local OpenCode credentials; affected owners should check their provider accounts.
The big change
What changed: OpenCode disclosed a breach involving a subset of its hosted Console users. Console can hold credentials for external AI providers and send requests through its gateway, so a Console connection creates a different custody path from a provider account saved in the local OpenCode CLI.
Why it matters: A provider key can authorize requests billed by the provider. An owner who connected one through Console has to check the issuing provider's usage and replace a key they determine was exposed; changing a Console setting alone does not revoke a provider-issued credential.
What to watch: OpenCode's email notice is the most specific scope signal it has publicly described. The accessible statement does not identify individual affected providers or keys. The founder's October 18 security update gives no account of the incident's state on October 19.




