Fortified Central Command
Security Incident

Threat Bulletin

Rotate Now: OpenCode Console Breach May Have Exposed OpenAI, Anthropic and Google API Keys

ALERT ESSENTIALS

OpenCode disclosed on October 17 that an intruder reached a legacy Console system on the night of October 16, and that provider API keys saved in Console workspaces may have been exposed for about 1.4% of Console users. There is no CVE and no patch; the fix is revoking and replacing every provider key ever saved in Console, at the provider. Deleting a key from Console does not invalidate it. Some users report unauthorized charges, though those reports are unverified.

THREAT DESCRIPTION

OpenCode is a widely used open-source AI coding agent. Its optional hosted Console lets a team save its own OpenAI, Anthropic or Google key in a workspace, and Console uses that key to call the provider so members never see it. Attackers reached a legacy Console system that OpenCode was decommissioning. An API key is a bearer credential: whoever holds a copy can run billable requests on the owner’s account until the provider revokes it. A Console budget cannot cap that use, because Console only sees requests that pass through its own gateway.

OpenCode says the incident is ongoing and calls it “related to a large scale distillation attack” (mass harvesting of a model’s outputs to train a rival). It has not named an actor, explained the link to the key exposure, or disclosed the entry point, number of keys, or start of unauthorized access. Affected users were emailed under the subject “Action Required: Potential provider key breach”; OpenCode says anyone without that email was not affected. Users have posted charges of roughly $170 to $1,700 on their own accounts (unverified), and OpenCode’s co-founder reported attackers still probing its systems on October 18. The incident follows Fireworks AI’s October 6 to 10 disclosure that customer-held keys were captured from evaluation-job environment variables, a separate event that shows attackers targeting platforms that hold customers’ keys to other services.

HEALTHCARE IMPACT

Health systems, digital health vendors and revenue-cycle and analytics teams increasingly run AI coding agents and shared provider keys inside development pipelines. A copied key lets an attacker run requests as your organization, and if that key backs workloads near protected health information (PHI), the exposure becomes a HIPAA breach risk assessment rather than just a billing problem. Provider-side suspensions triggered by abusive use, which one affected user reported, can also knock out AI-assisted tooling that clinical and operations teams depend on. No healthcare victims or PHI exposure have been reported to date.

INCIDENT DETAILS

  • Affected service
    • OpenCode Console (hosted service from Anomaly); legacy system being decommissioned
  • Exposed data
    • OpenAI, Anthropic and Google provider API keys saved in Console workspaces (“may have been exposed”)
  • Scope
    • About 1.4% of Console users, all with an external provider linked; notified by email Oct 17
  • Not affected (per OpenCode)
    • Open-source CLI and desktop apps, which keep locally added keys on the user’s machine
  • Patch / CVE / CISA KEV / Tenable
    • None. No CVE assigned, not KEV-listed, no Tenable plugin. Remediation is credential rotation
  • Status
    • Ongoing No root cause, post-mortem, or indicators of compromise (IOCs) published as of Oct 20, 2026
  • EOL/EOS
    • Not applicable to a hosted service; platform of the legacy system is undisclosed (Unknown)

RECOMMENDATIONS

Patching & Remediation

  • Revoke and replace every provider key ever saved in OpenCode Console, today. Create the new key first, update consumers, then revoke the old one at the provider:
    • OpenAI: https://help.openai.com/en/articles/8304786-keeping-your-openai-account-secure
    • Anthropic: https://support.claude.com/en/articles/8384961-what-should-i-do-if-i-suspect-my-api-key-has-been-compromised
    • Google: https://docs.cloud.google.com/docs/authentication/api-keys-best-practices
  • Check whether you were notified, but rotate regardless. Search mailboxes for “Action Required: Potential provider key breach.” OpenCode says no email means not affected; rotating anyway costs little.
  • Review usage and billing at each provider from October 16 onward (earlier if possible), looking for spikes, unfamiliar models, or unexplained charges, and dispute fraudulent spend with the provider.
  • Update every system that used the old keys: CI/CD secrets, .env files, agent configurations, production applications and developer machines.
  • Limit blast radius going forward. Issue one restricted key per tool and project, set provider spend limits and alerts, and never reuse a production key in a third-party gateway.
  • Inventory AI coding agents and gateways that hold provider keys, including unsanctioned use, and move keys to an approved secrets manager.
  • Watch for OpenCode’s post-mortem. No IOCs are published yet; re-check provider logs once they are.

Admin / Executive Recommendations

  • Treat vendors that store your credentials as third-party risk: confirm breach-notification terms and ask OpenCode (or any similar provider) for its post-mortem.
  • If any exposed key supported PHI-adjacent workloads, direct Privacy and Compliance to document a HIPAA breach risk assessment now.
  • Set policy on bring-your-own-key AI tools, and have Finance alert on abnormal AI spend.

Sources

From Fortified Health Security

Fortified Health Security is committed to maturing your healthcare organization’s cybersecurity posture. We will monitor and update this bulletin as the situation progresses.

Fortified recommends applying patches and updates where possible and only after adequate testing in a development environment to ensure stability and compliance with organizational change management policies.

Should you have any questions about this threat or any other issue you are facing, please reach out to us. We’re here to help you on your cybersecurity journey.

Email: connect@fortifiedhealthsecurity.com    Phone: 615-600-4002

Share

Back To All
Contact Us
Fortified Central Command
Security Incident