OpenCode Console Breach Exposes OpenAI, Anthropic, and Google Gemini API Keys — Detection, Key Rotation, and Incident Response Guide

If your developers use OpenCode Console — the web-based management interface for the OpenCode AI coding assistant ecosystem — treat every API key ever stored or passed through that platform as compromised. Reporting this week confirms that a breach of the OpenCode Console may have exposed API keys belonging to Anthropic, OpenAI, and Google Gemini users. That means keys for three of the most expensive, most abused LLM providers on the market are potentially in attacker hands.

This is not a theoretical exposure. Stolen LLM API keys are among the fastest-monetized credentials in the underground economy. Within hours of a leak, keys are typically harvested, validated, and either resold on credential markets or used directly for unauthorized inference, spam generation, phishing content production, and crypto-adjacent abuse — all billed to the victim's account. I've led IR engagements where a single leaked OpenAI key ran up six figures in usage charges over a weekend and where an Anthropic key was used to generate phishing lures that bypassed the victim's own email security stack. If your organization touched OpenCode Console, you are now in a race against that timeline.

The urgency is compounded by the fact that many organizations have no inventory of where their LLM API keys live. Keys get hardcoded into developer laptops, CI/CD variables, .env files, Docker images, Jupyter notebooks, and — critically — third-party SaaS consoles like OpenCode's. When the third party is breached, your blast radius is defined by every place that key can reach.

Technical Analysis

What Was Compromised

Based on the reporting, the breach targeted the OpenCode Console platform — the management layer users authenticate to in order to configure and operate OpenCode's AI-assisted development tooling. Critically, users commonly configure the console with their own provider API keys (BYOK — bring your own key) so the tooling can route requests to Anthropic's Claude, OpenAI's GPT models, or Google's Gemini. That design pattern means the platform held live, billable, high-privilege credentials in a centralized location — a textbook aggregation point for attackers.

Affected parties:

• Any individual developer or organization that registered an OpenCode Console account and configured provider API keys within it
• OpenAI API customers — keys typically begin with sk- / sk-proj-
• Anthropic API customers — keys typically begin with sk-ant-
• Google AI / Gemini customers — API keys generated via Google AI Studio or GCP service credentials

Why This Breach Pattern Is So Damaging

From a defender's perspective, this is a supply-chain credential exposure, not a software vulnerability. There is no CVE, no patch, and no version number to upgrade to. The attack chain is simple and devastatingly effective:

1. Compromise of the third-party console — attacker gains access to stored user configuration, including provider API keys.
2. Key harvesting and validation — keys are tested programmatically against provider endpoints (api.openai.com, api.anthropic.com, generativelanguage.googleapis.com) to confirm they're live.
3. Monetization — valid keys are either sold in bulk or used directly for unauthorized API consumption: LLM-powered spam/phishing generation, resale via proxy "AI access" services, or model abuse that can also get your account suspended for policy violations.
4. Secondary pivoting — if the console stored OAuth tokens, session data, or linked account metadata, attackers may attempt account takeover against the providers themselves or against developer accounts sharing credentials.

Exploitation Status

The breach is confirmed as reported; exploitation of harvested keys should be assumed to be active and ongoing. There is no patch window here — the only meaningful control is key invalidation. Every hour a key remains unrotated is an hour of attacker-usable compute billed to you, plus reputational and data-handling exposure if prompts or context data were processed through the compromised console.

Detection & Response

Your detection strategy has two prongs: (1) find every place these keys exist in your environment so you can rotate them, and (2) hunt for signs the keys have already been abused — anomalous API consumption and unexpected egress to provider endpoints.

Sigma Rules

The following rules target the two most actionable endpoint behaviors in this scenario: processes reading credential-bearing files (.env, OpenCode config directories) and tooling making network connections to LLM provider endpoints from unexpected processes.

---
title: Suspicious Process Reading API Key or Environment Files
id: 3f8b2c41-9d6e-4a7b-b1c5-2e8f4a9d0c7e
status: experimental
description: Detects non-development processes accessing .env files or OpenCode configuration directories that may contain OpenAI, Anthropic, or Gemini API keys. Relevant in the wake of the OpenCode Console breach, where harvested keys may be validated from attacker or commodity tooling.
references:
  - https://www.infosecurity-magazine.com/news/opencode-breach-openai-anthropic/
  - https://attack.mitre.org/techniques/T1552/001/
author: Security Arsenal
date: 2026/04/09
tags:
  - attack.credential_access
  - attack.t1552.001
logsource:
  category: file_event
  product: windows
detection:
  selection_target:
    TargetFilename|contains:
      - '\.env'
      - '\opencode\'
      - '\.opencode\'
  selection_target_name:
    TargetFilename|endswith:
      - 'credentials.json'
      - 'config.json'
      - 'api_keys.json'
  filter_legit:
    Image|endswith:
      - '\code.exe'
      - '\node.exe'
      - '\opencode.exe'
      - '\git.exe'
  condition: (selection_target or selection_target_name) and not filter_legit
falsepositives:
  - Legitimate developer tooling and editors accessing project environment files
  - Build agents reading .env during CI pipelines
level: medium
---
title: Unexpected Process Connecting to LLM Provider API Endpoints
id: 8c1e5d72-4b3a-4f09-9e2d-7a6c1b8f3d55
status: experimental
description: Detects network connections to OpenAI, Anthropic, or Google Gemini API endpoints from processes not on an expected allowlist. After the OpenCode Console breach, stolen keys may be abused from attacker-controlled or commodity proxy tooling, producing egress to provider endpoints from unexpected binaries on managed hosts.
references:
  - https://www.infosecurity-magazine.com/news/opencode-breach-openai-anthropic/
  - https://attack.mitre.org/techniques/T1071/001/
author: Security Arsenal
date: 2026/04/09
tags:
  - attack.command_and_control
  - attack.exfiltration
  - attack.t1071.001
logsource:
  category: network_connection
  product: windows
detection:
  selection:
    DestinationHostname|contains:
      - 'api.openai.com'
      - 'api.anthropic.com'
      - 'generativelanguage.googleapis.com'
  filter_expected:
    Image|endswith:
      - '\node.exe'
      - '\python.exe'
      - '\opencode.exe'
      - '\code.exe'
      - '\msedge.exe'
      - '\chrome.exe'
  condition: selection and not filter_expected
falsepositives:
  - Custom internal applications calling LLM APIs; build a per-environment allowlist before enabling at high level
level: high

KQL Hunt — Microsoft Sentinel / Defender

This query hunts for outbound connections to LLM provider endpoints from processes or devices that have not historically made them — the classic signature of a stolen key being validated or abused from new infrastructure. It assumes network data via Defender (DeviceNetworkEvents) and/or Syslog/CEF ingestion from firewalls and proxies.

let llm_endpoints = dynamic(["api.openai.com", "api.anthropic.com", "generativelanguage.googleapis.com", "console.anthropic.com", "platform.openai.com"]);
let baseline = DeviceNetworkEvents
    | where TimeGenerated between (ago(30d) .. ago(1d))
    | where RemoteUrl has_any (llm_endpoints)
    | summarize by DeviceName, InitiatingProcessFileName;
DeviceNetworkEvents
| where TimeGenerated > ago(24h)
| where RemoteUrl has_any (llm_endpoints)
| where not(DeviceName has_any (baseline.DeviceName) and InitiatingProcessFileName has_any (baseline.InitiatingProcessFileName))
| summarize Connections = count(), FirstSeen = min(TimeGenerated), LastSeen = max(TimeGenerated),
    Processes = make_set(InitiatingProcessCommandLine, 5), RemoteIPs = make_set(RemoteIP, 5)
    by DeviceName, InitiatingProcessFileName, RemoteUrl
| order by Connections desc;
// Companion: hunt proxy/firewall logs ingested via CEF for egress to provider endpoints from servers (not workstations)
CommonSecurityLog
| where TimeGenerated > ago(24h)
| where DestinationHostName has_any (llm_endpoints) or RequestURL has_any (llm_endpoints)
| summarize Hits = count(), Sources = make_set(SourceIP, 10) by DestinationHostName, DeviceVendor
| order by Hits desc;

Tune the baseline window to your environment. The companion query is especially important for spotting server-side key abuse — your production hosts should rarely, if ever, talk to these endpoints unless you're running LLM-backed services.

Velociraptor VQL — Endpoint Key Discovery

Before you rotate, you need to know where keys actually live. This artifact sweeps endpoints for API key material in common locations — .env files, OpenCode config directories, shell histories, and user profile folders — matching the known prefixes for OpenAI (sk-), Anthropic (sk-ant-), and typical Gemini/AI Studio key formats.

-- Hunt for exposed LLM API keys on endpoints following the OpenCode Console breach
LET key_paths = SELECT FullPath FROM glob(
    globs=[
      'C:/Users/*/.env',
      'C:/Users/*/**/.env',
      'C:/Users/*/.opencode/**',
      'C:/Users/*/AppData/Roaming/opencode/**',
      'C:/Users/*/.config/opencode/**',
      '/home/*/.env',
      '/home/*/**/.env',
      '/home/*/.config/opencode/**',
      '/home/*/.bash_history',
      '/home/*/.zsh_history'
    ])
SELECT FullPath, Data.LineNumber AS LineNumber, Data.Line AS MatchedLine
FROM foreach(row=key_paths,
query={
    SELECT FullPath, LineNumber, Line
    FROM parse_lines(filename=FullPath)
    WHERE Line =~ 'sk-ant-[a-zA-Z0-9_-]{20,}'
       OR Line =~ 'sk-proj-[a-zA-Z0-9_-]{20,}'
       OR Line =~ 'sk-[a-zA-Z0-9]{32,}'
       OR Line =~ 'AIza[0-9A-Za-z_-]{35}'
       OR Line =~ '(OPENAI_API_KEY|ANTHROPIC_API_KEY|GEMINI_API_KEY|GOOGLE_API_KEY)'
})

Operational caution: this artifact will surface live secrets into your hunt results. Restrict access to the resulting collections, and treat the hunt output itself as sensitive credential material.

Remediation Script — Rotate and Verify

This PowerShell script inventories key material on Windows endpoints and verifies whether your provider keys have been rotated (by validating that old keys are now rejected and new keys accepted). Run the inventory portion first, then rotate at each provider console, then verify.

# OpenCode Breach Response: LLM API Key Inventory and Rotation Verification
# Run as the affected user (and as SYSTEM for full profile sweep where permitted)

$ErrorActionPreference = 'SilentlyContinue'
$patterns = @('sk-ant-[a-zA-Z0-9_-]{20,}', 'sk-proj-[a-zA-Z0-9_-]{20,}', 'sk-[a-zA-Z0-9]{32,}', 'AIza[0-9A-Za-z_-]{35}')
$searchPaths = @("$env:USERPROFILE", "$env:APPDATA\opencode", "$env:USERPROFILE\.opencode", "$env:USERPROFILE\.config\opencode")

# --- Phase 1: Inventory files containing potential key material ---
$hits = foreach ($path in $searchPaths) {
    if (Test-Path $path) {
        Get-ChildItem -Path $path -Recurse -File -Include '.env','*.json','*.yaml','*.yml','*.toml','*.ps1','*.py' |
            Select-String -Pattern $patterns |
            Select-Object Path, LineNumber, @{N='KeyPrefix';E={($_.Line -match 'sk-ant-|sk-proj-|sk-|AIza') | Out-Null; $Matches[0]}}
    }
}
$hits | Export-Csv -Path "$env:TEMP\llm_key_inventory.csv" -NoTypeInformation
Write-Output "[+] Inventory complete: $($hits.Count) potential key locations found. Review $env:TEMP\llm_key_inventory.csv"

# --- Phase 2: Verify old keys are revoked after rotation at provider consoles ---
function Test-KeyRevoked {
    param([string]$Provider, [string]$Key)
    try {
        switch ($Provider) {
            'openai'    { $r = Invoke-WebRequest -Uri 'https://api.openai.com/v1/models' -Headers @{Authorization="Bearer $Key"} -UseBasicParsing }
            'anthropic' { $r = Invoke-WebRequest -Uri 'https://api.anthropic.com/v1/models' -Headers @{'x-api-key'=$Key;'anthropic-version'='2023-06-01'} -UseBasicParsing }
            'gemini'    { $r = Invoke-WebRequest -Uri "https://generativelanguage.googleapis.com/v1/models?key=$Key" -UseBasicParsing }
        }
        return "STILL ACTIVE - rotate immediately"
    } catch {
        if ($_.Exception.Response.StatusCode.value__ -in 401,403) { return "REVOKED/INVALID - good" }
        return "Unknown ($($_.Exception.Message))"
    }
}
# Example: Test-KeyRevoked -Provider 'anthropic' -Key 'sk-ant-OLDKEY'

# --- Phase 3: Scrub stale keys from shell history and common config stores ---
$historyPaths = @("$env:APPDATA\Microsoft\Windows\PowerShell\PSReadLine\ConsoleHost_history.txt")
foreach ($h in $historyPaths) {
    if (Test-Path $h) {
        $content = Get-Content $h -Raw
        if ($content -match ($patterns -join '|')) { Write-Warning "Key material found in $h - sanitize after rotation" }
    }
}

Remediation — Prioritized Action Plan

Within the first 4 hours:

1. Revoke and rotate every provider API key that was ever configured in OpenCode Console. Do this at the source: the OpenAI platform console (API keys page), the Anthropic Console (API Keys settings), and Google AI Studio / GCP console for Gemini keys. Rotating elsewhere does nothing — the key must be invalidated at the provider.
2. Audit provider usage logs immediately. OpenAI, Anthropic, and GCP all expose per-key usage and request logs. Look for: requests from ASNs/regions you don't operate in, model usage you never purchased (e.g., premium model calls), burst patterns consistent with automated abuse, and any requests after the breach window opened.
3. Change your OpenCode Console account password and revoke active sessions/tokens. If you reused that password anywhere — and developers do — rotate those too.

Within 24 hours:

4. Sweep your environment for key sprawl using the VQL artifact and PowerShell inventory above. Keys pulled from the console are only the beginning — if those same keys were pasted into repos, CI variables, or documentation, rotate once and clean everywhere.
5. Check source control history. Run a secrets scan (e.g., trufflehog, gitleaks) across your repos for the key prefixes above. A key committed and later "removed" is still in git history.
6. Enforce billing and rate guardrails. Set hard spending caps and rate limits on all provider accounts. On OpenAI and Anthropic, configure project-level budgets and alerts; on GCP, apply quota ceilings to the Generative Language API. This converts a key-theft event from uncapped financial exposure into a bounded incident.

Strategic (this quarter):

7. Eliminate long-lived static keys where possible. Move to short-lived credentials, workload identity federation, or proxy architectures where provider keys live only in a secrets manager (HashiCorp Vault, AWS Secrets Manager, Azure Key Vault) and are never distributed to developer tooling or third-party consoles.
8. Re-evaluate BYOK third-party tooling. Any SaaS console that asks for your raw provider keys inherits your entire risk. Require vendor security review (SOC 2, breach history, key storage architecture) before keys are entered, and prefer tooling that supports per-user OAuth or proxy-based key custody.
9. Add LLM egress to your detections permanently. The KQL above shouldn't be a one-time hunt — provider endpoints from unexpected processes are a durable high-fidelity signal for both key theft and shadow-AI usage.

There is no vendor patch to wait for and no CISA KEV entry to track — the remediation clock started the moment the breach occurred. If you have not rotated keys yet, do it before you finish reading this sentence.

Related Resources

Security Arsenal Penetration Testing Services AlertMonitor Platform Book a SOC Assessment vulnerability-management Intel Hub