OpenCode breach: provider API keys stored in OpenCode Console may have been exposed. What happened and what to do

On October 17, 2026, OpenCode, the open-source coding agent made by Anomaly, disclosed a security breach affecting about 1.4% of users of OpenCode Console, its hosted model gateway. According to OpenCode's post on X and the email it sent affected users, attackers reached "a legacy system" and third-party API keys that users had saved in their Console workspaces, such as OpenAI and Anthropic keys, "may have been exposed." OpenCode linked the OpenCode breach to "a large scale distillation attack," and users reported drained provider balances within hours. Anthropic says it has revoked Claude API keys it believes were affected. If you got an email from OpenCode, revoke and replace those keys now.

This story is based on OpenCode's post on X; its email to affected users, as shown in a screenshot security researcher Matt Johansen posted on X; a post by Anthropic's Lydia Hallie; reporting by Notebookcheck, Cyera and OfficeChai; OpenCode's Console documentation; and Anthropic's and OpenAI's API key guidance, all checked October 18, 2026.

The short version

• What happened: unauthorized access to "a legacy system that we were in the process of decommissioning," per OpenCode's email to affected users.
• Who is affected: 1.4% of OpenCode Console users, "a subset of users who had external providers linked," per OpenCode's post on X. OpenCode says it emailed all of them, and users who didn't get an email weren't affected.
• What was exposed: provider keys (the email names OpenAI and Anthropic as examples) saved in Console workspaces. OpenCode hasn't said whether all of them were taken.
• What to do: revoke and replace those keys through each provider's dashboard, update anything that uses them, and review recent usage. Anthropic says it has already revoked Claude API keys it believes were affected.
• Still unknown: how attackers got in, how the keys were stored and how long access lasted. OpenCode says the incident is ongoing.

What happened in the OpenCode breach?

OpenCode's post on X at 18:08 UTC on October 17 said: "We had a security breach last night related to a large scale distillation attack that impacted 1.4% of OpenCode Console users." It said OpenCode had notified all of them by email that morning, that users who didn't get an email weren't affected, and that "it was a subset of users who had external providers linked." It added: "The incident is ongoing so we cannot share more details at this point but we are working with Anthropic, OpenAI, and Google to remediate."

The email itself, titled "Action Required: Potential provider key breach," was public before that post: security researcher Matt Johansen posted a screenshot of it, as shared on Reddit, at 15:30 UTC. It reads: "We identified unauthorized access to a legacy system that we were in the process of decommissioning. Third party provider keys (eg OpenAI, Anthropic) saved in your workspace may have been exposed." It asks users to revoke and replace those keys "through the relevant provider's dashboard," update any applications using them and review recent usage, and says OpenCode "will follow up with any updates."

Anthropic has acted on its side. Lydia Hallie, who works on Claude Code at Anthropic, posted on X at 21:04 UTC on October 17 that Anthropic has been working with OpenCode "and have revoked Claude API keys we believe were affected," and suggested that anyone who saved a key in OpenCode create a new one.

OpenCode's changelog had no entry about the incident as of October 18; the newest release listed was v2.0.32 from October 16. OpenCode's Console documentation carried no incident notice.

What is OpenCode Console, and who is affected?

OpenCode Console is separate from the open-source OpenCode CLI. Its documentation calls it "an AI gateway" with pay-as-you-go access to a set of models, and says it's "completely optional." Team owners can also connect their own providers. The Console providers page says Console "stores the credential and serves each provider through its gateway," so team members can use a provider's models without seeing its key.

That stored credential is what was exposed. Per OpenCode's post and email:

• Affected: 1.4% of Console users, a subset of those whose workspace had an external provider key linked. OpenCode hasn't published an absolute number.
• Not named as affected: users of the CLI who keep provider keys locally, and Console users who only bought credits. OpenCode hasn't addressed locally stored keys either way.

Notebookcheck also reported user complaints that their OpenCode API keys had expired and that Google or GitHub sign-in failed with "Unable to start social login." OpenCode hasn't said whether it rotated Console API keys as part of its response, so treat that as a user report.

What does "distillation attack" mean here?

OpenCode didn't explain. A distillation attack, as AI labs use the term, means harvesting a model's outputs at scale to train another model. Anthropic has described campaigns that run through networks of fraudulent accounts and proxies, and it tightened its defenses in October (our explainer on Anthropic's distillation defenses). Stolen API keys would let an attacker run such a campaign on someone else's bill without creating accounts the labs could ban. That reading fits OpenCode's wording, but OpenCode hasn't confirmed it, and it hasn't said whether the keys were the target or a by-product.

Stolen AI keys have a market. Bitsight reported on October 15 that criminals sell an autonomous hacking tool that runs on stolen OpenAI, Anthropic and Google keys; see our story on stolen keys and the Archon CVE.

What should affected users do?

OpenCode's email tells affected users to "revoke and replace those keys through the relevant provider's dashboard, update any applications using them, and review recent usage for unexpected activity." Anthropic's revocation doesn't change that: it covers only the Claude keys Anthropic believes were affected, and a revoked key still has to be replaced wherever you use it. The providers' own guidance spells out how:

1. Revoke the key at each provider, then create a new one. Anthropic's API key guidance says to revoke a compromised key "immediately" from the Claude Console's API keys page. OpenAI's API key safety guidance says to "rotate your key immediately from the API Keys page" and update production applications. For Google keys, use the Google console where the key was created.
2. Replace the key in OpenCode Console if you still use it. The Console docs say: "To rotate a key, click the credential on the provider page and enter the new one." You can also remove the provider from its ⋯ menu.
3. Check usage and spending. Anthropic recommends reviewing logs and usage in its Console. OpenAI recommends checking the Usage page and setting monthly spend limits with hard enforcement, noting that "spend alerts alone don't stop API traffic."
4. Contact the provider about unauthorized charges. OpenAI's guidance says to contact it through help.openai.com for an investigation. Neither OpenAI nor Anthropic has said publicly whether it will refund charges from this incident.
5. Use one key per tool. Anthropic suggests separate keys for each use case, so a leak can be shut off without breaking everything else.

If you didn't receive an email, OpenCode says you weren't affected. Anthropic's Hallie still suggested creating a new key if you saved one in OpenCode, and rotating a key you've shared with any third-party service is low-cost.

Did OpenCode 2.0 cause this?

There's no evidence it did. OpenCode says the breach hit a legacy system, and it hasn't connected it to the OpenCode 2.0 release. Our OpenCode 2.0 story covered separate security complaints about the new shared background service and its permissions model, which concern the local agent, not the hosted Console.

OpenCode is also one of the open-source tools that can use a ChatGPT plan's usage through Sign in with ChatGPT. That path uses OpenAI sign-in, not a stored API key, and OpenCode hasn't said it was involved.

Why it matters

Hosted gateways that hold your provider keys concentrate risk: one breach exposes keys from many accounts at once, and the bill lands on the key's owner. For developers who also run AI review and agents in CI (see how the Claude Code team handles review), the lesson is the same: scope keys to one tool, cap their spend, and know where each one is stored.

What's confirmed, reported and uncertain

• OpenCode's own statements (its X post and its email to affected users):
  • the breach and the 1.4% figure
  • "unauthorized access to a legacy system"
  • provider keys saved in workspaces "may have been exposed"
  • the affected users were a subset of those with external providers linked, and they were emailed
  • revoke and replace keys through each provider's dashboard, update applications and review usage
  • the incident is ongoing; OpenCode is working with Anthropic, OpenAI and Google
• Anthropic (Lydia Hallie on X): Anthropic revoked Claude API keys it believes were affected.
• Confirmed from documentation: how Console stores provider credentials and how to rotate or remove them; Anthropic's and OpenAI's key revocation steps.
• User reports: drained OpenAI and Anthropic balances, charges of $400 or more overnight, about €200 in Google usage, expired OpenCode API keys and failed social logins.
• Uncertain:
  • how attackers got in, and when access started and ended
  • whether keys were encrypted at rest
  • the absolute number of affected users
  • what "distillation attack" refers to
  • whether providers will refund fraudulent usage