OpenCode says a breach may have exposed provider API keys saved in OpenCode Console
OpenCode disclosed a security breach affecting 1.4% of OpenCode Console users, all of whom had linked outside AI provider keys, and emailed them to revoke and replace those keys; the company says the OpenCode app's locally stored keys were not involved.
What happened
- On October 17, 2026, OpenCode posted on X that it had a security breach the night before, which it described as related to a large-scale distillation attack, affecting 1.4% of OpenCode Console users.
- OpenCode said it emailed every affected user that morning, that the affected group was a subset of users who had external providers linked, and that anyone who did not get an email was not affected.
- OpenCode called the incident ongoing and said it was working with Anthropic, OpenAI and Google to remediate it.
- Per The Hacker News, OpenCode's email told affected users to revoke the provider keys saved in Console and replace them, and co-founder Dax Raad said keys added to the OpenCode app on your own computer never reach the company.
Why it matters: If you saved an OpenAI, Anthropic or Google key in OpenCode Console, revoke it at the provider and check your usage and billing. It's also a reminder to give each AI tool its own key with a spend limit.
Sources
- OpenCode on X: breach disclosure x.com
- The Hacker News: OpenCode Console breach may have exposed provider API keys thehackernews.com
Checked October 19, 2026 against the sources above. Claims about performance or benchmarks are the company's own unless stated otherwise.