{
  "Event": {
    "uuid": "7a31e197-0102-459e-8b33-e4097b33e735",
    "info": "OpenCode Console Breach: Your Provider Keys, Their Custody — Optimus Labs · Civilizations",
    "date": "2026-10-17",
    "threat_level_id": "1",
    "analysis": "2",
    "published": true,
    "Orgc": {
      "name": "Optimus Labs · Civilizations"
    },
    "Tag": [
      {
        "name": "optimus:briefing=\"opencode-console-breach-provider-key-exposure\""
      },
      {
        "name": "optimus:severity=\"high\""
      },
      {
        "name": "optimus:type=\"vendor-breach\""
      },
      {
        "name": "optimus:category=\"AI\""
      },
      {
        "name": "optimus:category=\"CH\""
      },
      {
        "name": "type:OSINT"
      }
    ],
    "Attribute": [
      {
        "type": "link",
        "category": "External analysis",
        "to_ids": false,
        "value": "https://optimuslabs.io/research/briefings/opencode-console-breach-provider-key-exposure",
        "comment": "Optimus Labs briefing"
      },
      {
        "type": "link",
        "category": "External analysis",
        "to_ids": false,
        "value": "https://x.com/opencode/status/2111519637049319818",
        "comment": "OpenCode statement on X, Oct 17"
      },
      {
        "type": "link",
        "category": "External analysis",
        "to_ids": false,
        "value": "https://x.com/thdxr/status/2111572618340188393",
        "comment": "Dax Raad: Console, not the app"
      },
      {
        "type": "link",
        "category": "External analysis",
        "to_ids": false,
        "value": "https://x.com/thdxr/status/2111608620441817449",
        "comment": "Dax Raad: refunds"
      },
      {
        "type": "link",
        "category": "External analysis",
        "to_ids": false,
        "value": "https://x.com/thdxr/status/2111790511409258796",
        "comment": "Dax Raad: 48 hours of attacks"
      },
      {
        "type": "link",
        "category": "External analysis",
        "to_ids": false,
        "value": "https://x.com/thdxr/status/2105448734272401788",
        "comment": "Dax Raad: 26T token days"
      },
      {
        "type": "link",
        "category": "External analysis",
        "to_ids": false,
        "value": "https://x.com/lydiahallie/status/2111563956666110287",
        "comment": "Lydia Hallie, Anthropic"
      },
      {
        "type": "link",
        "category": "External analysis",
        "to_ids": false,
        "value": "https://x.com/EvanOtero/status/2111591525876474100",
        "comment": "Evan Otero, Google"
      },
      {
        "type": "link",
        "category": "External analysis",
        "to_ids": false,
        "value": "https://x.com/thsottiaux/status/2112034063934742720",
        "comment": "Tibo Sottiaux, OpenAI"
      },
      {
        "type": "link",
        "category": "External analysis",
        "to_ids": false,
        "value": "https://techcrunch.com/2026/10/19/hackers-hit-ai-coding-tool-opencode-running-up-charges-on-users-ai-accounts/",
        "comment": "TechCrunch, Oct 19"
      },
      {
        "type": "link",
        "category": "External analysis",
        "to_ids": false,
        "value": "https://www.bleepingcomputer.com/news/security/opencode-hack-exposes-api-keys-amid-ai-distillation-attacks/",
        "comment": "BleepingComputer, Oct 19"
      },
      {
        "type": "link",
        "category": "External analysis",
        "to_ids": false,
        "value": "https://thehackernews.com/2026/10/opencode-console-breach-may-have.html",
        "comment": "The Hacker News, Oct 19"
      },
      {
        "type": "link",
        "category": "External analysis",
        "to_ids": false,
        "value": "https://thelatent.co/models/opencode-says-breach-tied-to-distillation-attack-exposed-users-ai-provider-keys",
        "comment": "The Latent, Oct 17"
      },
      {
        "type": "link",
        "category": "External analysis",
        "to_ids": false,
        "value": "https://www.ycrootaccess.com/p/how-opencode-became-the-worlds-most",
        "comment": "YC Root Access: Jay V interview"
      },
      {
        "type": "link",
        "category": "External analysis",
        "to_ids": false,
        "value": "https://www.anthropic.com/threat-intelligence-report-september-2026",
        "comment": "Anthropic threat report, Sep 2026"
      },
      {
        "type": "link",
        "category": "External analysis",
        "to_ids": false,
        "value": "https://www.anthropic.com/research/distillation-defenses",
        "comment": "Anthropic: distillation defences, Oct 12"
      },
      {
        "type": "link",
        "category": "External analysis",
        "to_ids": false,
        "value": "https://genai.owasp.org/resource/owasp-top-10-for-agentic-applications-for-2026/",
        "comment": "OWASP Top 10 for Agentic Applications 2026"
      },
      {
        "type": "link",
        "category": "External analysis",
        "to_ids": false,
        "value": "https://genai.owasp.org/resource/owasp-genai-llm-top-10-2026/",
        "comment": "OWASP Top 10 for LLM Applications 2026"
      },
      {
        "type": "link",
        "category": "External analysis",
        "to_ids": false,
        "value": "https://opencode.ai/docs/zen/",
        "comment": "OpenCode Zen docs"
      },
      {
        "type": "link",
        "category": "External analysis",
        "to_ids": false,
        "value": "https://github.com/anomalyco/opencode/security/advisories/GHSA-vxw4-wv6m-9hhh",
        "comment": "GHSA-vxw4-wv6m-9hhh"
      },
      {
        "type": "link",
        "category": "External analysis",
        "to_ids": false,
        "value": "https://github.com/advisories/GHSA-c83v-7274-4vgp",
        "comment": "GHSA-c83v-7274-4vgp"
      },
      {
        "type": "link",
        "category": "External analysis",
        "to_ids": false,
        "value": "https://github.com/anomalyco/opencode/security",
        "comment": "OpenCode advisories"
      },
      {
        "type": "link",
        "category": "External analysis",
        "to_ids": false,
        "value": "https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html",
        "comment": "OWASP Secrets Management Cheat Sheet"
      },
      {
        "type": "link",
        "category": "External analysis",
        "to_ids": false,
        "value": "https://cheatsheetseries.owasp.org/cheatsheets/Key_Management_Cheat_Sheet.html",
        "comment": "OWASP Key Management Cheat Sheet"
      },
      {
        "type": "link",
        "category": "External analysis",
        "to_ids": false,
        "value": "https://cheatsheetseries.owasp.org/cheatsheets/Cryptographic_Storage_Cheat_Sheet.html",
        "comment": "OWASP Cryptographic Storage Cheat Sheet"
      },
      {
        "type": "link",
        "category": "External analysis",
        "to_ids": false,
        "value": "https://csrc.nist.gov/pubs/sp/800/57/pt1/r5/final",
        "comment": "NIST SP 800-57 Part 1 Rev. 5, Recommendation for Key Management"
      },
      {
        "type": "link",
        "category": "External analysis",
        "to_ids": false,
        "value": "https://labs.cloudsecurityalliance.org/research/csa-research-note-opencode-console-provider-key-breach-20261/",
        "comment": "Cloud Security Alliance research note, Oct 20"
      }
    ]
  }
}