OpenCode Console breach may have exposed users' OpenAI, Anthropic and Google keys Other

OpenCode says an attacker broke into one of its systems and may have exposed the OpenAI, Anthropic and Google API keys that some users saved in OpenCode Console. The breach hit 1.4% of Console users, all of whom had an outside provider linked. OpenCode announced it on X on October 17, 2026, and emailed affected users that morning.

What happened

• The breach took place on the night of October 16.
• In its email to users, OpenCode said someone gained "unauthorized access to a legacy system that we were in the process of decommissioning."
• On X, OpenCode said the breach was "related to a large scale distillation attack". It did not explain how.
• If you did not get the email, you were not affected, OpenCode says.
• The incident was still ongoing, so OpenCode did not share more details. It said it is working with Anthropic, OpenAI and Google to fix it.
• Dealroom reports that Anthropic revoked the affected Claude API keys.

What was not affected

Co-founder Dax Raad said the breach concerns "the OpenCode Console, not OpenCode itself". Keys used with the open-source CLI and desktop app are stored locally and "never come to us," he wrote.

On October 18, Raad said attackers had been "non stop trying to attack our systems for the past 48 hours" and that "everything is getting hardened."

What to do

OpenCode told affected users to revoke their keys in each provider's dashboard and watch for unexpected usage. In practice:

• Revoke the key with the provider and create a new one. Deleting it from Console does not revoke it.
• Update every app and script that used the old key.
• Check provider billing and usage from October 16 onward.
• Set spend limits or alerts, and use a separate key for each tool.

Sources

• OpenCode on X: breach announcement
• Dax Raad on X: Console, not OpenCode
• Dax Raad on X: ongoing attacks
• The Hacker News: OpenCode Console breach
• Dealroom: OpenCode breach drains users' AI keys
• Anthropic: what to do if your API key is compromised
• OpenAI: keeping your account secure