OpenCode: Users' keys to AI services may have leaked

What readers should know first: The information here is relayed through third parties. The sources are a security bulletin, a blog post and a user-written guide, which quote and refer to OpenCode's emails and posts on X. OpenCode's own announcement has not been read directly.

OpenCode, which makes an AI coding tool, announced on October 17, 2026, that there had been unauthorized access to a legacy system the company was in the process of shutting down. According to the sources, the breach happened overnight between October 16 and 17. The system was an older OpenCode Console, the hosted model gateway where users connect their own provider accounts and store keys in workspaces.

The announcement states: "We identified unauthorized access to a legacy system that we were in the process of decommissioning."

What may have been exposed

According to Safeguard.sh, third-party keys stored in Console workspaces may have been exposed, for example for OpenAI and Anthropic. Google Gemini was later added to the list of affected providers. An API key is a kind of password that lets a program use an AI service and have the bill sent to the key's owner.

According to the Cypro bulletin, roughly 1.4 percent of Console users are affected, namely those who had connected external provider accounts. According to the same source, OpenCode notified affected users by email on the morning of October 17 and confirmed it on X the same day.

Reports of abuse

According to the bulletin, several users have reported unauthorized charges and unexpected activity on connected provider accounts. The bulletin assesses that this suggests keys were abused before they were revoked. It is unconfirmed, however, whether the keys were actually used.

According to Safeguard.sh, founder Dax Raad wrote that personal accounts are now being targeted as well.

What is unclear

The bulletin states that OpenCode has linked the incident to a large-scale distillation attack. The company has not explained the mechanism further. According to Safeguard.sh, OpenCode said the incident was still ongoing and that the company therefore could not share more details. No technical investigation report has been published.

According to the DEV Community guide, it is unconfirmed how the attackers got in, how long the access lasted, and whether the keys were encrypted. Commentators believe it is the hosted Console, not the CLI tool, that was hit.

What users are advised to do

The bulletin recommends revoking keys with the provider itself and not just in OpenCode. After that, you should create new keys and update them everywhere they are used. You should also review usage logs from October 16, set spending limits and monitor the account for about 48 hours.