On October 16, an intruder accessed a legacy system at OpenCode, potentially exposing the API keys of third-party AI providers, including OpenAI, Anthropic, and Google, for 1.4% of Console users.
The vulnerability or weakness
The breach involved unauthorized access to a legacy system, exposing API keys that users had saved in OpenCode Console.
Earlier attacks and coverage
No earlier related attack in our archive yet.
Business impact
Organizations using these keys may face financial losses and operational disruptions, as users have reported unauthorized charges ranging from $281 to $1,700.
Industries affected
Tech and AI development firms are primarily affected, as they rely on third-party providers for model integration.
Users affected
1.4% of Console users, whose keys were saved in the legacy system, are affected, and are advised to revoke and replace their keys to prevent further unauthorized usage.
Build these skills
Watch the daily brief
Sources
- OpenCode Console Breach May Have Exposed OpenAI, Anthropic, and Google API Keys (The Hacker News)
- OpenCode hack exposes API keys amid AI distillation attacks (BleepingComputer)
- OpenCode Breach Could Affect OpenAI, Anthropic and Google (Infosecurity Magazine)
