Welcome back to another edition of Content Clout AI
Here is exactly what we are covering in today's edition:
The Keys Were Never Yours to Lose: A breach at a popular AI coding tool exposed stored OpenAI, Anthropic, and Google API keys, and some users are already seeing surprise bills.
Why Storing Keys Anywhere Is the Real Risk: The lesson for anyone connecting AI tools to paid accounts.
The Work Lab: A 15-minute audit to find every place your API keys currently live.
The Key Rotation Prompt: A copy-and-paste checklist to lock things down today.
Read time: 5 minutes.
The Big Story: A Coding Agent Got Breached, and the Keys Exposed Weren’t Even OpenCode’s
AI Generated Image
On October 17, OpenCode, an open-source coding agent that connects to AI models from more than 75 providers, told its users that attackers had reached a legacy system the company was in the process of shutting down. Stored inside it: third-party API keys, including ones for OpenAI, Anthropic, and Google, that users had saved to run the tool.
OpenCode says the breach affected 1.4% of its paid Console users, all of whom had linked an outside provider. That sounds small, but for those affected, it wasn’t abstract. Some reported usage spikes they never authorized, with single-provider charges over $400 and total bills topping $1,700. OpenCode’s co-founder described the attack as continuous for 48 hours before it was caught.
Here’s the detail worth sitting with: these weren’t OpenCode’s own API keys. They were keys you or your developer created on OpenAI, Anthropic, or Google’s own dashboards, then pasted into a third-party tool to make that tool work. The breach happened one step removed from the provider you trust, in a place you may not have thought much about.
