PSA: OpenCode breach - my stored Anthropic key was used to drain ~$158 overnight. Revoke yours.

[u/New-Stop1494]

If you saved an Anthropic, OpenAI, or Google key in OpenCode Console, check it now. OpenCode emailed Oct 17 about unauthorized access to a legacy console system, with exposure starting Oct 17 00:30 UTC. My key was only ever saved there and had zero prior use. Overnight it was used for Opus calls and my balance went from $158 to $0 before I got any notice. Anthropic's first reply said used credits are generally non-refundable, and OpenCode says it is talking with providers about reimbursement. Has anyone gotten a refund or credit yet? What worked?

Steps: revoke the key at your provider, delete it from OpenCode, set a low monthly spend limit, and check usage since Oct 16.

[u/Nexion21]

Brutal, hope you get that resolved in your favor!

[u/SmileLonely5470]

OpenCode sent out an email saying that Anthropic confirmed they plan to issue refunds to affected users.

[u/Honkey85 → u/SmileLonely5470]

That puts all the blame on Anthropic later on.

[u/sylfy]

Honestly, I don’t know why anyone still uses OpenCode at this point. If you want a third party harness, Pi is much better. Realistically though, Claude Code is in itself a very good harness.

[u/Bloated_Plaid]

Why are you putting your keys into OpenCode, I am confused. This is besides the fact that OpenCode is clearly some vibecoded fucking garbage with zero respect for security, like why the fuck would user keys need to be stored in basically plaintext lol.

[u/Unique_Wolf4513]

Saw this happen to a company. Cost them about $90k

[u/SM373]

Of course Anthropic won't help the little guys out. It's not like they're a PBC or anything and are mandated to operating in the interest of the Public and not for profits.... oh wait

[u/Good_Skirt2459 → u/SM373]

Open code says Anthropic will issue refunds

[u/plutoXL → u/SM373]

So OpenCode leaks saved API keys (among other things, and for other AI companies, not just Anthropic), and somehow it’s Anthropic fault?

Anthropic recommendation is to not store API keys on third-party services directly anyway.

https://support.claude.com/en/articles/9767949-api-key-best-practices-keeping-your-keys-safe-and-secure

[u/swarmagent → u/plutoXL]

So don't save my API key on GCP/AWS? The reality is you need to eventually store them somewhere

[u/plutoXL → u/swarmagent]

Claude offers Workload Identity Federation - short-life tokens that act similarly to API keys, but with limited life (which can be configured). I don’t know if OpenCode supports them, but they sure sound like a perfect solution for the above problem.

https://platform.claude.com/docs/en/manage-claude/workload-identity-federation

[u/BiteyHorse]

I wondered who was stupid enough to use OpenCode, and here's an answer.

[u/turtle-toaster → u/BiteyHorse]

The fuck you got against opencode?

[u/TheVibeCurator → u/turtle-toaster]

Hey, (unrelated to the jerk above) I’ve not used OpenCode before. My current workflow is just using Claude Code within Orca ADE. I’m curious what sort of benefits OpenCode might provide, or how it’s part of your workflow. Sorry for the unrelated question but I appreciate any insight, thank you :)

[u/GuitarAgitated8107 → u/BiteyHorse]

I will continue to use OpenCode if it pisses you off.