OpenCode breach exposes stored OpenAI, Anthropic and Google keys for 1.4% of Console users

The company behind OpenCode, formerly known as SST, said the incident was tied to a large scale distillation attack. It emailed affected users on October 17 and says it is working with OpenAI, Anthropic and Google on remediation. The exposed keys were stored through a legacy console system that is being shut down. Developer forums quickly shared advice on revoking exposed keys after the notices went out. The company described the exposure as limited to a subset of workspaces, which makes a key audit the fastest way for teams to check their own exposure. For founders, the lesson is that API keys held by third-party coding tools form part of your attack surface. Rotate keys for every provider you linked, scope keys to the minimum needed, and set spend alerts so a leaked key cannot run up costs unnoticed.