OpenCode breach exposes stored OpenAI, Anthropic and Google keys for 1.4% of Console users

Anomaly Innovations, which builds the OpenCode coding agent, emailed affected users on October 17 warning that stored provider keys may have leaked through a legacy console system it was shutting down. The earliest exposure it could identify was about 22 hours before the first notice went out, and one user reported unauthorized Claude usage that evening. It has found no evidence of other data leaks but cannot confirm misuse of the stolen keys. Its guidance follows standard incident response: revoke and reissue keys directly in the OpenAI, Anthropic and Google dashboards instead of clicking links in the email, review usage logs back to October 17, and set spending limits. Coding agents run with a developer's own credentials to read files and call APIs, so one leaked key can reach far beyond the billing account. For anyone building on coding agents or model APIs, provider keys are production secrets. Scope them per project, rotate them on a schedule, and cap spend per key, because this breach happened at a vendor that users had trusted with their credentials.