OpenCode AI Coding Project Confirms API Key Exposure in Security Breach

How the Debug Log Flaw Led to Key Exposure

The open-source AI coding assistant OpenCode has informed a subset of its users that their stored API keys for external services were compromised in a recent security incident. The breach, disclosed by project maintainers, occurred due to a vulnerability in how credentials were handled during AI model distillation processes. Users began reporting unexpected charges and service disruptions shortly after the exposure was detected.

The incident specifically affected users who had integrated OpenCode with cloud platforms like Google Cloud, where exposed keys led to unauthorized API usage. According to the project’s lead maintainer, approximately 1.4% of OpenCode Console users were impacted, though the exact number of compromised keys was not disclosed. The breach arose during an internal update involving AI distillation techniques, which inadvertently logged sensitive authentication data in debug outputs. OpenCode has since revoked the exposed keys and urged users to rotate any credentials used with the platform.

What Steps Are Users Advised to Take Now?

Investigators traced the breach to a misconfigured logging feature enabled during testing of a new model compression feature. When developers ran distillation workflows to optimize AI models, system logs captured full API request headers, including authorization tokens. These logs were temporarily stored in a poorly access-controlled environment, allowing unintended access. The flaw remained undetected for several days until anomalous billing alerts triggered user complaints. OpenCode confirmed that no core code repositories or user code were altered, but the credential leak posed immediate financial and operational risks.

OpenCode has published a step-by-step guide for affected users, emphasizing immediate key rotation for services like Google Cloud, AWS, and OpenAI. The project also recommends auditing cloud usage logs for unfamiliar activity and enabling IP restrictions where possible. Maintainers have disabled the problematic logging function and are implementing stricter secrets detection in their CI/CD pipeline. A post-mortem report is expected within two weeks, detailing improvements to prevent recurrence. Users are encouraged to enable two-factor authentication and monitor their cloud dashboards closely.

How did OpenCode discover the breach? The project learned of the issue after multiple users reported unexplained spikes in cloud billing and service suspensions, prompting an internal audit that traced the source to exposed debug logs.

Frequently Asked Questions

Was any user code or project data stolen? No, OpenCode confirmed that the breach only involved API keys used for external service authentication; no user repositories, code, or personal data were accessed or exfiltrated.

Is OpenCode still safe to use for development? The maintainers state that the vulnerability has been patched and all known exposed keys revoked, but users should rotate credentials and follow the provided security guidance before resuming use.