OpenCode Console Breach Exposes Third-Party AI Provider API Keys

An intruder accessed a legacy system at OpenCode on the night of October 16, potentially exposing third-party AI provider keys that users had stored in OpenCode Console. Console is OpenCode's optional hosted service where workspaces save their own OpenAI, Anthropic, or Google keys, which Console then uses to call the respective providers so team members can use the models. The breach may have compromised these stored API keys from the three major AI providers.