OpenCode has disclosed a security incident that may have exposed third-party AI provider API keys stored by customers in its hosted Console product. According to the company, an intruder accessed a legacy system on October 16, and the potentially exposed credentials include keys for OpenAI, Anthropic and Google that customers had saved in OpenCode Console.

For businesses using hosted AI workspaces, the incident is a reminder that saved API keys can become a high-value target. If compromised, those credentials could potentially be used to access paid model services, generate unexpected costs, or interact with business workflows connected to external AI platforms.

What happened

OpenCode said an attacker reached a legacy system and that users' third-party AI provider keys may have been exposed. Based on the company's description, the affected service is OpenCode Console, an optional hosted environment where a workspace stores its own provider keys so team members can use AI models without handling credentials individually.

The available information indicates a possible exposure of customer-supplied credentials rather than a direct compromise of OpenAI, Anthropic or Google themselves. At the time of the report, the key point for customers is that credentials saved inside the hosted platform may no longer be trustworthy.

Why it matters for European businesses

Many SMEs and digital teams now connect AI tools to everyday operations such as content generation, coding assistance, customer support, internal search and workflow automation. In these setups, API keys often act as the gatekeeper for usage, billing and access to connected services.

If a third-party platform storing those keys is breached, the impact can go beyond model access alone. A compromised key may lead to:

• Unexpected spend from unauthorised API usage
• Operational disruption if keys need to be rotated across multiple tools and automations
• Security review obligations where AI services are integrated into internal systems or customer-facing applications
• Third-party risk concerns for companies relying on hosted AI orchestration tools

For European companies, the incident also highlights a governance issue: storing external provider credentials inside SaaS products can simplify collaboration, but it creates a concentration of risk. This is particularly relevant for businesses building AI-enabled services for clients, e-commerce operations using AI in production, and teams subject to internal security or compliance requirements.

Who may be affected

The most directly affected organisations are OpenCode Console users that stored API keys for OpenAI, Anthropic or Google in the hosted workspace.

The issue may be especially relevant for:

• SMEs using shared AI platforms instead of individual local credentials
• Digital agencies managing AI workflows for multiple clients
• E-commerce and marketing teams using AI tools tied to production processes
• IT and security teams responsible for SaaS access, key management and incident response
• Businesses with automated workflows that depend on those provider keys remaining valid

What companies should consider

Companies using OpenCode Console should review the vendor's guidance and assess whether any credentials stored in the service need to be treated as potentially compromised. Practical steps may include:

• Rotate exposed or potentially exposed API keys for OpenAI, Anthropic and Google where they were stored in the affected service
• Review usage logs and billing activity for unusual spikes, unfamiliar requests or unexpected projects
• Map dependencies to identify applications, scripts and automations that rely on the affected keys
• Update secrets management practices by limiting where third-party credentials are stored and who can access them
• Assess vendor risk for hosted AI tooling, especially where platforms store customer credentials on behalf of teams
• Prepare fallback procedures so AI-enabled workflows can continue during emergency credential rotation

More broadly, the incident is a useful prompt for businesses to review how AI credentials are managed across collaboration tools. As AI adoption expands, API key security is becoming a practical business continuity issue, not only a technical one.