OpenCode Console Breach Exposes Customer API Keys to Unauthorized AI Model Distillation Attacks.
OpenCode Console Data Breach Exposes Customer API Keys to Unauthorised AI Model Distillation Exploits OpenCode has publicly confirmed a major security incident involving its enterprise management service, OpenCode Console . The breach enabled unauthorized threat actors to exfiltrate third-party API keys stored within customer organization accounts, resulting in unauthorized cloud usage and unexpected billing spikes for affected enterprise clients. Breach Scope, Attack Vectors, and Industry-Wide Remediation Efforts Target Infrastructure and Attack Mechanics: Enterprise Console Vulnerability: While the vast majority of individual OpenCode users utilize standalone local configurations or individual personal accounts (OpenCode Go), OpenCode Console is specifically designed for enterprise teams to share, manage, and distribute central API credentials across software development environments. Compromised Key Volume: Threat actors managed to systematically access and extract third-party API k...