OpenCode confirmed on October 17, 2026 that attackers breached its Console service, potentially exposing API keys that users stored for OpenAI, Anthropic and Google AI models.

 

What happened

The breach hit OpenCode Console the night before, on October 16. Console lets teams share access to AI models through centrally managed API credentials. Instead of giving individual team members the OpenAI, Anthropic or Google keys, Console stores each workspace’s credentials and uses them to authenticate requests to those providers.

OpenCode said the incident involved a large-scale distillation attack that affected 1.4% of Console users. The company said the attackers gained unauthorized access to a legacy system it was decommissioning. OpenCode emailed the affected users, a subset who had external providers linked. It also notified Anthropic, OpenAI and Google so they could remediate the issue.

 

Going deeper

Software supply chain security firm Safeguard published an incident response report with steps for OpenCode users:

  • Check whether you’re affected: Search your inbox for the subject line “Action Required: Potential provider key breach.” If you received it, follow its guidance. If not, review your keys anyway.
  • Identify exposed keys: List every OpenAI, Anthropic and Google Gemini API key ever stored in an OpenCode Console workspace, including keys other workspace admins added.
  • Review usage: Check each provider’s usage and billing reports from October 16 onward, and further back if possible. Look for usage spikes, unfamiliar models or unexplained charges.
  • Create replacement keys: Generate new keys before revoking old ones, and use project- or workspace-specific keys with restrictions and spending limits.
  • Revoke old keys: Disable or delete them in each provider’s dashboard, even if they show no suspicious usage.
  • Update every system: Replace old keys in CI/CD secrets, environment files, local agent configurations, production applications and team members’ machines.
  • Verify revocation: Test the old keys and confirm they return an authentication error.
  • Add controls: Restrict keys to required projects and APIs, set spending limits and budget alerts, and review workspace access and permissions.
  • Secure your Console setup: If you keep using Console with your own credentials, add a dedicated, restricted API key instead of reusing a production key.

 

What was said

OpenCode said on social media that the incident was “related to a large-scale distillation attack that impacted 1.4% of OpenCode Console users.” The company added, “We have notified them all this morning via email. If you did not get an email you were not impacted, it was a subset of users who had external providers linked.”

Dax Raad, a main contributor to OpenCode and co-founder of Anomaly, said on X that the breach involved only “the OpenCode Console, not OpenCode itself.”

 

In the know

An API key is a unique string of characters that works like a password for software. When an app or developer tool sends a request to an AI provider such as OpenAI, Anthropic or Google, the key proves who is making the request and tells the provider which account to bill. Anyone who holds a valid key can use the account’s AI services and run up charges, so providers expect users to keep keys secret and rotate them if they leak.

Console is OpenCode’s service for teams that want to share access to AI models without handing out raw provider keys. An admin stores the workspace’s credentials in Console, and Console uses them to authenticate each team member’s requests. This keeps keys away from individual users, but it also means one system holds many credentials in a single place.

 

Why it matters

Console’s design is what makes this breach serious since it stores provider keys centrally, one compromised system could expose credentials for OpenAI, Anthropic and Google at once, including keys that other workspace admins added. Affected teams may need to rotate keys at several providers, not just one.

Since an API key grants direct access to a paid account, a leaked key can let someone else use AI services at the owner’s expense.

The attackers also got in through a legacy system OpenCode was decommissioning, a reminder that systems being decommissioned can still hold sensitive credentials, and while only 1.4% of Console users were affected, OpenCode reports millions of active users, so the group at risk could still be large.

Read also: When legacy systems become a vulnerability

 

The bottom line

If you use OpenCode Console, search your inbox for the “Action Required: Potential provider key breach” email. Whether or not you received it, review your stored keys, check provider usage from October 16 onward, and replace and revoke any key that might be exposed. Going forward, store only a dedicated, restricted key in Console, never a production key.

Related: HIPAA Compliant Email: The Definitive Guide

 

FAQs

Why are systems being decommissioned a security risk?

Systems being retired often receive fewer updates and less monitoring, which can leave them as easy targets while still holding sensitive data.

 

What does it mean to rotate an API key?

Rotating a key means creating a new one, switching your systems over to it, and disabling the old one so a leaked copy stops working.

 

What is a secrets manager?

A secrets manager is a tool that stores credentials such as API keys in encrypted form and controls which people and systems can access them.