OpenCode Console Legacy System Breach May Expose Third-Party AI API Keys

On October 19, 2026, OpenCode (formerly Sourcegraph Codemod) announced a data breach affecting its OpenCode Console legacy system. According to the company, an intruder reached the legacy system on the night of October 16 and may have exposed the third-party AI provider keys that users had saved in OpenCode Console.

OpenCode Console is an optional hosted service that allows workspaces to store their own OpenAI, Anthropic, or Google API keys. Console uses these stored keys to call the respective provider models, enabling team members to use the models without re-entering credentials each time.

The company stated that the breach potentially exposed saved OpenAI, Anthropic, and Google API keys for affected workspaces. There is a risk of unauthorized API usage and credential misuse if the exposed keys are obtained by threat actors. OpenCode has indicated that it is rotating compromised keys and revoking exposed tokens. Users are being urged to rotate their API provider keys as a precaution. No software patch has been mentioned, as the incident involves a legacy system breach rather than a vulnerability in currently supported software.