The affected group was limited to Console customers that had linked external providers, and third-party API keys stored in their workspaces may have been exposed.
According to iSec News, OpenCode emailed the users it identified as affected and said users who did not receive an email were not impacted. The potentially exposed credentials included keys for providers such as OpenAI and Anthropic; OpenCode was also working with Google on remediation. The report says the access involved a legacy system being prepared for decommissioning.
Affected users were advised to revoke and replace relevant provider keys, update applications that use them, and review recent usage. OpenCode has not disclosed the number of keys or accounts involved, whether any exposed keys were used, or further technical details of the incident. Its investigation remains ongoing.