{
 "public_id": "AIR-2026-0281",
 "incident_id": "2026-10-opencode-console-provider-key-breach",
 "date_disclosed": "2026-10-17",
 "date_occurred": "2026-10-16",
 "title": "OpenCode Console legacy-system breach potentially exposed hosted AI-provider API keys",
 "class": "in_the_wild",
 "attack_surface": "coding_agent",
 "initial_vector": "unknown",
 "agent_capability_abused": [
  "hosted_provider_key_storage",
  "delegated_model_api_access"
 ],
 "target_product": "OpenCode Console optional hosted provider-key gateway",
 "target_vendor": "OpenCode",
 "autonomy_level": "assistant",
 "impact_realized": true,
 "impact_type": [
  "unauthorized_access",
  "potential_credential_exposure"
 ],
 "blast_radius": "1.4% of Console users with an outside provider linked; absolute user and key counts unknown; locally stored CLI and desktop keys were not implicated",
 "cve": [],
 "taxonomy": {
  "mitre_atlas": [],
  "labels": [
   "ai_as_target",
   "hosted_provider_keys",
   "legacy_system_intrusion",
   "potential_exposure",
   "secondary_reporting",
   "local_keys_unaffected"
  ],
  "owasp_asi": [
   "ASI03"
  ]
 },
 "defense_present": null,
 "defense_bypassed": null,
 "fix_shipped": null,
 "primary_sources": [
  "https://thehackernews.com/2026/10/opencode-console-breach-may-have.html"
 ],
 "verified_quote": "An intruder reached a legacy system at **OpenCode** on the night of October 16 and may have exposed the third-party AI provider keys that users had saved in OpenCode Console, the company said.",
 "confidence": "medium",
 "notes": "The Hacker News article was published on October 19 but quotes the affected-user email sent on October 17 and describes access on the night of October 16. The exposed integration is the optional hosted Console, not the local CLI or desktop key store. Realized harm is the reported unauthorized access to OpenCode's legacy system; it does not depend on proving that every stored key was copied or used. User accounts of unexpected charges remain unverified, and neither an AI attacker nor a loss total is established. The 1.4% figure has Console users as its denominator. Initial access and the earliest access time are unknown. OpenCode's suggested distillation link is a company attribution without an established actor or causal explanation. The linked company social statements were not fetched; sourcing is secondary only. Key rotation was advised, but continuing attacks on October 18 do not establish a completed fix. The September local /global/upgrade RCE disclosure is a different mechanism and event.",
 "risk_category": "security_fraud",
 "risk_secondary": [],
 "risk_subcategory": "Credential & Secret Theft",
 "risk_sub_secondary": [
  "Unauthorized Access & Account Takeover"
 ],
 "ai_entity": "generative",
 "agency": "ai_as_target",
 "agency_debatable": false,
 "agency_reason": "The reported intruder accessed OpenCode's hosted coding-agent integration. This establishes a system compromise, but neither an AI attacker nor model actions using copied keys are established",
 "vector_family": "other",
 "vector_detail": "unknown",
 "guardrail_kind": [
  "unknown"
 ],
 "guardrail_outcome": "silent",
 "xrefs": {
  "aiid": [],
  "atlas": [],
  "cve": [],
  "ghsa": []
 },
 "primary_asi": "ASI03",
 "agent_framework": "unknown",
 "model_provider": "unknown",
 "model_name": "",
 "detection_mechanism": "vendor_disclosure",
 "tool_access": "unknown",
 "financial_loss_band": "unknown",
 "eai_category": "credential_theft",
 "eai_domain": "access_control_and_permissions",
 "eai_secondary": [
  "privilege_escalation"
 ],
 "eai_reason": "subcategory: Credential & Secret Theft",
 "asi_curated": [],
 "asi_scope": "in_scope",
 "asi_provenance": "rule",
 "asi_reason": "ASI03 (eai_category=credential_theft)",
 "submitted_by": "EAI Internal"
}