Skip to content
OpenCode Console Breach Exposes AI Provider API Keys

OpenCode Console Breach Exposes AI Provider API Keys

First seen 21 Oct 2026, 17:08 UTC • •
API

Article Content

Browse articles
ThreatCluster AI
ThreatCluster •October 21, 2026 at 17:41 UTC
  • •1.4% of OpenCode Console users affected by a breach exposing third-party API keys.
  • •Unauthorized charges reported by users exceeded $2,000 across multiple accounts.
  • •OpenCode described the incident as a 'large scale distillation attack'.

On October 17, 2026, OpenCode disclosed a breach affecting 1.4% of its Console users, where unauthorized access to a legacy system potentially exposed API keys for third-party AI providers, including OpenAI and Anthropic. The breach, described as a 'large scale distillation attack', impacted users who had linked external providers. Following the breach, affected users reported unauthorized charges totaling over $2,000 on their accounts. OpenCode confirmed that they had notified all impacted users via email. The incident raises concerns about the security of linked third-party services and the financial implications for affected users.

Start a free Starter trial for enhanced analysis

Ask AI about this cluster

Updated just now How this analysis works

Timeline

2026-02-09
CVE-2026-1868 published
Vulnerability assigned a CVE identifier and published in the National Vulnerability Database.
MITRE
2026-10-02
CVE-2026-90970 published
Vulnerability assigned a CVE identifier and published in the National Vulnerability Database.
MITRE
2026-10-17
OpenCode Console breach disclosed
OpenCode announced a breach affecting 1.4% of users, exposing API keys for external AI providers.
Orcarouter.Ai
2026-10-19
Affected users report unauthorized charges
Users reported over $2,000 in unauthorized charges linked to exposed API keys from OpenAI and Anthropic.
Orcarouter.Ai

More articles in this cluster (2)

Following this threat?

Track CVE-2026-1868 in your own feed — you're alerted when they show up in new reporting, leak sites or exploitation.

Free account · no card needed

Extracted Entities (8)

1 / 3

Common questions

How many users were affected?
Approximately 1.4% of OpenCode Console users were impacted by the breach.
What actions should affected users take?
Affected users should monitor their accounts for unauthorized charges and consider changing their API keys.
What is a 'large scale distillation attack'?
This term refers to a method of extracting sensitive information from a system, though specific technical details were not provided.