Skip to content
OpenCode Security Breach Exposes User API Keys

OpenCode Security Breach Exposes User API Keys

First seen 18 Oct 2026, 00:09 UTC • •
API

Article Content

Browse articles
ThreatCluster AI
ThreatCluster •October 18, 2026 at 00:38 UTC
  • •1.4% of OpenCode Console users affected by a security breach.
  • •Unauthorized access linked to a large-scale distillation attack.
  • •Users advised to revoke API keys and monitor account activity.

OpenCode reported a security breach on October 17, 2026, affecting 1.4% of its Console users. The breach was linked to a large-scale distillation attack, which compromised third-party API keys stored in user workspaces. Users have reported unauthorized charges on their accounts, with one user noting $400 in charges linked to Anthropic. OpenCode has notified all affected users via email and is working with Anthropic, OpenAI, and Google to address the incident. Users are advised to revoke and replace their API keys and review their account activity for any unauthorized usage. Access issues have also been reported by some users trying to log in. The situation remains ongoing as OpenCode investigates the breach further.

Start a free Starter trial for enhanced analysis

Ask AI about this cluster

Updated just now How this analysis works

Timeline

2026-10-17
OpenCode confirms security breach
OpenCode reported a breach affecting 1.4% of its Console users due to a distillation attack, notifying all affected users via email.
Notebookcheck
2026-10-17
OpenCode tweets about the incident
OpenCode tweeted about the security breach and confirmed ongoing remediation efforts with Anthropic, OpenAI, and Google.
News.Ycombinator

More articles in this cluster (2)

Extracted Entities (3)

1 / 3

Common questions

How many users are affected?
1.4% of OpenCode Console users have been affected by the breach.
What should I do if I am affected?
Affected users should revoke and replace their API keys and review their account activity for unauthorized charges.
What is a distillation attack?
A distillation attack involves collecting responses from an AI model to train another model, potentially leading to unauthorized access to sensitive information.