Brief · Both
Your API key lived in someone else's legacy system.
OpenCode emailed some Console users on Oct 17: "We identified unauthorized access to a legacy system that we were in the process of decommissioning. Third party provider keys (eg OpenAI, Anthropic) saved in your workspace may have been exposed." Its one public post says 1.4% of Console users were hit. It doesn't give a total, and it says "The incident is ongoing so we cannot share more details." What the system was, how it was breached, and how the keys were stored: not disclosed.
The split that matters: OpenCode says keys saved in its hosted Console may have been exposed. Dax, who builds OpenCode, posted from his personal account that keys used in the local app "never come to us." Anthropic and Google staff posted, also from personal accounts, that they'd revoked or blocked affected keys.
The bills came fast. One user reported more than $400 across OpenAI and Anthropic keys overnight. Dax says refunds are "already underway." Who pays, and on what terms, is unknown.
My take: a key you paste into someone's hosted dashboard is now part of their infrastructure, legacy bits included.
What to do:
- One key per tool, so one leak is one rotation.
- Hard spend caps and billing alerts at every provider.
- Revoke and rotate at the provider, not just in the app. OpenCode's own email says to "revoke and replace those keys through the relevant provider's dashboard." Revoke the exposed key in that provider's console (Anthropic and OpenAI say to delete it right away), create a new one, update your tools, then check usage from 8:30 PM ET Oct 16 on.