OpenCode warns users to rotate provider keys after legacy-system intrusion

OpenCode told some customers to revoke and replace third-party API keys after unauthorized access to a legacy system may have exposed credentials saved in their workspaces, according to a customer notice reproduced in an X thread by security professional Matt Johansen (@mattjay) on October 17th. The notice names OpenAI and Anthropic keys as examples and asks recipients to check provider usage for unexpected activity. The warning puts cloud-held provider credentials at the center of the incident, since AI coding agents can sit between a developer's projects and paid model APIs.

OpenCode warns users to rotate provider keys after legacy-system intrusion A customer notice says keys saved in OpenCode workspaces may have been exposed; the warning puts cloud-held credentials at the center of the incident. By Ryan Merket https://runtimewire.com/author/ryan-merket · Published · Updated Primary source: X https://x.com/mattjay/status/2111480005435719885 Why it matters AI coding agents can sit between a developer's projects and paid model APIs. When a service stores provider keys for workspace convenience, a compromise can turn into both a security incident and an unexpected bill; the circulated 1.4% figure does not by itself measure either exposure or loss. OpenCode told some customers to revoke and replace third-party API keys after unauthorized access to a legacy system may have exposed credentials saved in their workspaces. Security professional Matt Johansen @mattjay https://x.com/mattjay?ref=runtimewire amplified the warning on October 17th, saying OpenCode users were being told to rotate keys. The notice, reproduced in the X thread https://x.com/mattjay/status/2111480005435719885?ref=runtimewire , names OpenAI and Anthropic keys as examples and asks recipients to check provider usage for unexpected activity.…