OpenCode disclosed a breach in its legacy Console system this week, impacting 1.4 percent of its users. The incident may have exposed third-party AI provider keys stored in the system. Affected engineers have been advised to revoke credentials and review their usage patterns immediately.

OpenCode announced the discovery of unauthorized access to a legacy Console system on Saturday, October 17. The company stated that the breach affected 1.4 percent of Console users and may have exposed stored third-party AI provider keys. Internal logs indicated that the intrusion occurred through an older authentication pathway that had not been fully decommissioned after a prior migration to newer infrastructure.

Details of the Legacy System Exposure

The Console platform served as an early interface for managing AI-assisted development workflows. It allowed teams to store provider credentials for services such as model inference endpoints so that engineers could switch between different large-language-model backends without re-entering tokens each time. Because the system was designed before modern secret-management standards became widespread, keys were retained in plaintext within certain database tables that the legacy code path still referenced.

Engineers who created accounts before the migration retained the option to keep keys inside Console. The company has not released the exact number of affected accounts, but the 1.4 percent figure suggests a limited but non-trivial population of long-term users who never fully transitioned to external vaults or per-project environment variables.

Recommended Actions for Impacted Users

OpenCode immediately directed affected users to revoke the exposed keys at each provider dashboard. The notice also asked teams to inspect recent usage logs for anomalous calls that might indicate unauthorized consumption. A further recommendation was to adopt separate keys for each development stage rather than reusing a single credential across local machines, staging environments, and production pipelines.

Separating keys reduces blast radius if one environment is later compromised. Many organizations already follow this pattern by generating distinct tokens labeled for continuous-integration runners, notebook instances, and deployed services. The breach underscores why that separation matters even when the storage surface appears small.

Risks Associated with Stored AI Provider Keys

AI provider keys grant access to paid inference capacity and, in some cases, to fine-tuning datasets or private model endpoints. Unauthorized use can generate unexpected billing, expose prompt histories that contain proprietary code, or allow an attacker to extract embedded knowledge from a custom model. Because usage is metered per token, even modest abuse over several days can produce charges in the thousands of dollars.

Unlike traditional API keys that often carry narrow scopes, many current AI keys provide broad read and write privileges by default. Revocation is therefore the only reliable containment step once exposure is suspected. Usage inspection after revocation helps confirm whether any calls originated from unexpected IP ranges or user agents during the window of exposure.

Industry Context for Developer Tool Security

Platforms that integrate multiple AI backends face a recurring tension between convenience and isolation. Early versions of such tools frequently offered built-in credential storage to reduce onboarding friction. Over time, the industry has shifted toward recommending external secret stores such as environment-specific vaults or cloud key-management services that support fine-grained access policies and automatic rotation.

The OpenCode incident illustrates the lingering surface created when legacy code paths remain active for backward compatibility. Even a small percentage of users can represent high-value targets when those users maintain credentials for expensive model providers or for models fine-tuned on internal data.

Next Steps and Ongoing Monitoring

OpenCode has stated it is accelerating the final deprecation of the legacy Console storage layer. Users still relying on the old interface are being migrated to a new configuration that references external secrets only. The company has also begun publishing weekly transparency reports on credential-handling changes so that the community can track progress.

Developers who were not directly notified should still audit any Console accounts created before the most recent platform update. Checking whether any provider keys remain listed in account settings provides an additional layer of assurance even if the 1.4 percent figure does not apply to them.

The episode serves as a reminder that credentials stored inside any development platform carry ongoing operational risk. Regular rotation, scoped tokens, and external secret management remain the most effective defenses against both targeted breaches and accidental exposure through legacy systems.