OpenCode AI Gateway Breach Exposes Keys

This incident shows how model flexibility becomes credential concentration when a hosted control plane stores customers’ bearer tokens. The “distillation attack” framing matters, but the practical lesson is simpler: treat every provider key pasted into an AI gateway as potentially compromised.

• –The breach was limited to optional hosted Console, not OpenCode’s local applications.
• –Deleting a key from Console is insufficient; revoke it at the provider, replace it, and audit usage.
• –Per-tool keys, provider-side spend limits, and least-privilege credentials can sharply reduce blast radius.
• –AI safety filters blocking defensive incident response expose a second operational weakness for security teams.