A customer notice says keys saved in OpenCode workspaces may have been exposed; the warning puts cloud-held credentials at the center of the incident.
By [Ryan Merket](https://runtimewire.com/author/ryan-merket)
· Published
· Updated
Primary source: [X](https://x.com/mattjay/status/2111480005435719885)
Why it matters #
AI coding agents can sit between a developer's projects and paid model APIs. When a service stores provider keys for workspace convenience, a compromise can turn into both a security incident and an unexpected bill; the circulated 1.4% figure does not by itself measure either exposure or loss.
OpenCode told some customers to revoke and replace third-party API keys after unauthorized access to a legacy system may have exposed credentials saved in their workspaces. Security professional Matt Johansen (@mattjay) amplified the warning on October 17th, saying OpenCode users were being told to rotate keys. The notice, reproduced in the X thread, names OpenAI and Anthropic keys as examples and asks recipients to check provider usage for unexpected activity.…