OpenCode co-founder says attacks continued after Console key exposure warning

Attackers were still trying to enter OpenCode's systems on October 18 after a breach that may have exposed users' saved AI provider keys, co-founder Dax Raad said. OpenCode said an intruder reached a legacy system on the night of October 16; it notified affected users on October 17. The company says 1.4% of Console users were affected and should revoke and replace their linked provider keys. Console stores keys for shared access to OpenAI, Anthropic or Google models. Keys stored locally by OpenCode's command-line and desktop apps were outside the breach's scope, the company said. Deleting a key from Console does not revoke it at the provider, and Console budgets cannot limit requests made outside its gateway.