How do I know if my OpenCode keys were exposed?

OpenCode says it emailed every affected OpenCode Console user, and users who did not receive an email were not impacted. The company puts the affected share at about 1.4% of Console users. Rotating keys anyway is cheap, so anyone who stored provider keys in an OpenCode Console workspace may still choose to revoke and replace them.

Are local OpenCode CLI users affected by the breach?

OpenCode's notice talks about provider keys saved in OpenCode Console workspaces, the hosted service, and does not say the open-source CLI was compromised. Commenters on Hacker News read it the same way. The company has not yet published a full report, so the exact scope of the OpenCode incident may still change as details come out.

What should affected OpenCode users do now?

OpenCode asks affected users to revoke and replace the exposed keys through each provider's dashboard, such as OpenAI, Anthropic and Google. They should then update any applications that use those keys and review recent usage on each provider account for unexpected activity, since a leaked key can run paid model calls on the owner's bill.

What caused the OpenCode Console breach?

OpenCode says it found unauthorized access to a legacy system it was decommissioning and calls the incident a large-scale distillation attack. The company says the incident is ongoing and it cannot share more details yet. Co-founder Dax Raad said his personal accounts were also being attacked. No root-cause report has been published so far.

OpenCode · 2026-10-17 · major

OpenCode Console breach — users told to rotate OpenAI and Anthropic keys

OpenCode found unauthorized access to a legacy system it was shutting down. Provider API keys saved in OpenCode Console workspaces may have been exposed. Affected users got an email and should revoke and replace their keys.

Runtime Wire headline card about OpenCode warning users to rotate provider keys

Provider keys stored in OpenCode's hosted Console may have leaked; affected users must rotate them now.

Quick facts

Disclosed	October 17, 2026
System hit	A legacy system being decommissioned
Data at risk	Provider API keys saved in Console workspaces
Share affected	About 1.4% of Console users (OpenCode's figure)
Status	Ongoing; no technical details yet
What to do	Revoke and replace keys, review usage

What is it?

OpenCode disclosed on October 17, 2026 that attackers reached a legacy system the company was in the process of decommissioning. Third-party provider keys that users saved in their OpenCode Console workspaces, such as OpenAI and Anthropic keys, may have been exposed.

How does it work?

The exposure is in the hosted OpenCode Console, where users can store their own provider keys (bring-your-own-key) for the service to call models on their behalf. OpenCode describes the incident as a large-scale distillation attack, says it is still ongoing, and has not shared technical details on how the keys were reached. It says it is working with Anthropic, OpenAI and Google on remediation.

Why does it matter?

A leaked provider key lets anyone run paid model calls on the owner's bill, and on Hacker News some users reported unexplained usage. Teams that stored keys in OpenCode Console should treat them as compromised. The case is also a reminder that keys parked in any hosted agent service widen the blast radius beyond the local tool.

Who is it for?

OpenCode Console users and teams that store provider keys in hosted AI tools

Frequently asked questions

How do I know if my OpenCode keys were exposed?: OpenCode says it emailed every affected OpenCode Console user, and users who did not receive an email were not impacted. The company puts the affected share at about 1.4% of Console users. Rotating keys anyway is cheap, so anyone who stored provider keys in an OpenCode Console workspace may still choose to revoke and replace them.
Are local OpenCode CLI users affected by the breach?: OpenCode's notice talks about provider keys saved in OpenCode Console workspaces, the hosted service, and does not say the open-source CLI was compromised. Commenters on Hacker News read it the same way. The company has not yet published a full report, so the exact scope of the OpenCode incident may still change as details come out.
What should affected OpenCode users do now?: OpenCode asks affected users to revoke and replace the exposed keys through each provider's dashboard, such as OpenAI, Anthropic and Google. They should then update any applications that use those keys and review recent usage on each provider account for unexpected activity, since a leaked key can run paid model calls on the owner's bill.
What caused the OpenCode Console breach?: OpenCode says it found unauthorized access to a legacy system it was decommissioning and calls the incident a large-scale distillation attack. The company says the incident is ongoing and it cannot share more details yet. Co-founder Dax Raad said his personal accounts were also being attacked. No root-cause report has been published so far.

Try it

Revoke and recreate your OpenAI, Anthropic and Google keys in each provider's dashboard, then check recent usage.