Rotate any AI key you saved in a hosted tool
OpenCode Console breach: saved AI provider keys may be exposed · Security incident · News · thehackernews · Oct 2026
OpenCode said an intruder reached a legacy Console system on the night of 16 Oct and that OpenAI, Anthropic and Google keys saved by 1.4% of Console users may have been exposed. Users told reporters their keys were then billed, with claims from $168 to $1,700.
Lesson
A key you paste into any third-party dashboard is only as safe as that company. Give each tool its own key, set a spend limit at the provider, and if a tool reports a breach, revoke the key at the provider. Deleting it from the tool does not stop it working. See our API key guide.
Fix prompt
Copy this into your own AI tool (Cursor, Lovable, Claude Code, Bolt…). It's general guidance written by us. Review what the AI suggests before applying it.
I build apps with AI tools and I've pasted AI provider keys (OpenAI, Anthropic, Google Gemini) into several hosted services. Help me limit the damage if one of those services is breached. 1) Make me a checklist of every place I might have saved a provider key: hosted coding tools, AI gateways, no-code builders, CI secrets, .env files and deployment dashboards. 2) Explain how to give each tool its own separate key, so I can revoke one without breaking the rest and see which tool a charge came from. 3) Walk me through setting a monthly spend limit and a usage alert in the OpenAI, Anthropic and Google AI Studio dashboards. 4) If a tool tells me my key may be exposed, give me the order to act: revoke at the provider, create a new key, update my apps, then check usage and billing back to the breach date. Don't change anything until I've approved your plan. Never ask me to paste API keys, passwords or .env contents; tell me where to check them myself.
Source: News ↗