# OpenCode warns users to rotate provider keys after legacy-system intrusion

> Source: <https://runtimewire.com/article/opencode-provider-key-exposure-legacy-system>
> Published: 2026-10-17 19:16:43+00:00

# OpenCode warns users to rotate provider keys after legacy-system intrusion

**A customer notice says keys saved in OpenCode workspaces may have been exposed; the warning puts cloud-held credentials at the center of the incident.**

        By [Ryan Merket](https://runtimewire.com/author/ryan-merket)
        · Published 
        · Updated 

Primary source: [X](https://x.com/mattjay/status/2111480005435719885)

## Why it matters

AI coding agents can sit between a developer's projects and paid model APIs. When a service stores provider keys for workspace convenience, a compromise can turn into both a security incident and an unexpected bill; the circulated 1.4% figure does not by itself measure either exposure or loss.

OpenCode told some customers to revoke and replace third-party API keys after unauthorized access to a legacy system may have exposed credentials saved in their workspaces. Security professional [Matt Johansen (@mattjay)](https://x.com/mattjay?ref=runtimewire) amplified the warning on October 17th, saying OpenCode users were being told to rotate keys. The notice, reproduced in the [X thread](https://x.com/mattjay/status/2111480005435719885?ref=runtimewire), names OpenAI and Anthropic keys as examples and asks recipients to check provider usage for unexpected activity.…