2026 OpenCode — Console breach exposed linked AI provider API keys (~1.4% of users)
Data compromised
External AI-provider API keys (OpenAI and Anthropic confirmed; Google named in most but not all secondary reports) stored by OpenCode Console users who had linked those provider accounts. About 1.4% of Console users affected, per OpenCode — no absolute headcount published. No evidence cited of prompt/chat content, source code, or non-Console (local CLI) users being affected.
Technical writeup
Verified via OpenCode's own X disclosure (Oct 17, 2026): unauthorized access to a legacy backend system exposed external provider API keys for linked Console accounts, scoped by OpenCode at ~1.4% of Console users. No top-tier security outlet coverage found; secondary tech-press pickup repeats OpenCode's framing without independent forensic detail. "Distillation attack" label and exact scope beyond the percentage remain unexplained by the company. companyConfirmed true; recordsAffected 0 pending an absolute count.
Root cause
OpenCode said it found unauthorized access to "a legacy system that we were in the process of decommissioning." The company separately described the incident as a "large scale distillation attack" without a technical explanation of that term.
References
- https://x.com/opencode/status/2111519637049319818
- https://dev.to/akaranjkar08/opencode-console-breach-rotate-your-ai-api-keys-now-2026-5736
- https://officechai.com/ai/opencode-discloses-security-breach-says-attackers-may-have-accessed-users-openai-anthropic-and-google-api-keys/
- https://www.notebookcheck.net/OpenCode-hacked-users-urged-to-revoke-their-API-keys.1426957.0.html