{"slug": "opencode-warns-users-to-rotate-provider-keys-after-legacy-system-intrusion", "title": "OpenCode warns users to rotate provider keys after legacy-system intrusion", "summary": "OpenCode told some customers to revoke and replace third-party API keys after unauthorized access to a legacy system may have exposed credentials saved in their workspaces, according to a customer notice reproduced in an X thread by security professional Matt Johansen (@mattjay) on October 17th. The notice names OpenAI and Anthropic keys as examples and asks recipients to check provider usage for unexpected activity. The warning puts cloud-held provider credentials at the center of the incident, since AI coding agents can sit between a developer's projects and paid model APIs.", "body_md": "# OpenCode warns users to rotate provider keys after legacy-system intrusion\n\n**A customer notice says keys saved in OpenCode workspaces may have been exposed; the warning puts cloud-held credentials at the center of the incident.**\n\n        By [Ryan Merket](https://runtimewire.com/author/ryan-merket)\n        · Published \n        · Updated \n\nPrimary source: [X](https://x.com/mattjay/status/2111480005435719885)\n\n## Why it matters\n\nAI coding agents can sit between a developer's projects and paid model APIs. When a service stores provider keys for workspace convenience, a compromise can turn into both a security incident and an unexpected bill; the circulated 1.4% figure does not by itself measure either exposure or loss.\n\nOpenCode told some customers to revoke and replace third-party API keys after unauthorized access to a legacy system may have exposed credentials saved in their workspaces. Security professional [Matt Johansen (@mattjay)](https://x.com/mattjay?ref=runtimewire) amplified the warning on October 17th, saying OpenCode users were being told to rotate keys. The notice, reproduced in the [X thread](https://x.com/mattjay/status/2111480005435719885?ref=runtimewire), names OpenAI and Anthropic keys as examples and asks recipients to check provider usage for unexpected activity.…", "url": "https://wpnews.pro/news/opencode-warns-users-to-rotate-provider-keys-after-legacy-system-intrusion", "canonical_source": "https://runtimewire.com/article/opencode-provider-key-exposure-legacy-system", "published_at": "2026-10-17 19:16:43+00:00", "updated_at": "2026-10-17 22:38:49.092765+00:00", "lang": "en", "topics": ["ai-safety", "ai-tools", "ai-agents", "developer-tools"], "entities": ["OpenCode", "Matt Johansen", "OpenAI", "Anthropic", "X"], "also_reported_by": [], "alternates": {"html": "https://wpnews.pro/news/opencode-warns-users-to-rotate-provider-keys-after-legacy-system-intrusion", "markdown": "https://wpnews.pro/news/opencode-warns-users-to-rotate-provider-keys-after-legacy-system-intrusion.md", "text": "https://wpnews.pro/news/opencode-warns-users-to-rotate-provider-keys-after-legacy-system-intrusion.txt", "jsonld": "https://wpnews.pro/news/opencode-warns-users-to-rotate-provider-keys-after-legacy-system-intrusion.jsonld"}}