OpenCode Console breach: who’s affected, and what to do with your API keys

What happened

On Saturday, October 17, 2026, OpenCode wrote on X: “We had a security breach last night related to a large scale distillation attack that impacted 1.4% of OpenCode Console users.” It had emailed those users that morning, and added: “If you did not get an email you were not impacted, it was a subset of users who had external providers linked.”

OpenCode Console is an optional hosted service on top of the open-source agent. Among other things, a workspace can connect its own provider account there, and Console’s gateway calls the provider for everyone in the workspace. According to TechCrunch, attackers broke into an older system overnight, and the keys at risk were the ones saved in Console workspaces.

Users reported the keys being used. Developers posted spending alerts and unauthorized charges from OpenAI, Anthropic and Google, and TechCrunch reports charges “in the hundreds of dollars on individual accounts; a few described totals above $1,000.” The attacks didn’t stop at once: “they’ve been non stop trying to attack our systems for the past 48 hours,” OpenCode’s Dax Raad wrote on October 18. On October 19 he added that “other products like ours got hit too in the last few days,” without naming them. Axios reported on October 21 that the AI models OpenCode used to investigate began refusing partway through, and that OpenCode then got access to Daybreak Blue, OpenAI’s program for vetted defenders.

Who was affected, and who wasn’t

How you use OpenCode	Keys exposed?
The open-source app or CLI, with keys added on your computer	No, according to OpenCode
A local model, such as through Ollama or LM Studio	No key to expose
A Console workspace with your own provider account linked, such as OpenAI, Anthropic or Google	Possibly. 1.4% of Console users were emailed
OpenCode Zen or Go, with no outside provider linked	No, by OpenCode’s description of who was affected

“Note this is the OpenCode Console, not OpenCode itself, those keys never come to us,” Raad wrote. Keys you add in the app with /connect or opencode auth login are stored on your computer: in ~/.local/share/opencode/auth.json in OpenCode 1, according to its docs, and in a local database in OpenCode 2.

One catch: OpenCode can also be connected to a Console workspace, by running /connect and choosing the workspace, and then it calls your providers through Console. If you did that with a provider key saved in Console, that key was in Console, whichever app you used it from.

What to do now

1. Look for OpenCode’s email of October 17. The Hacker News reports its subject as “Action Required: Potential provider key breach.” No email means you weren’t in the affected group, OpenCode says.
2. If you got one, revoke the keys at each provider. Deleting a key from Console doesn’t stop a copy from working; revoking it at the provider does. Anthropic’s guide, for example, says to delete the key on the Claude Console’s API keys page and create a new one. Then update every app and script that used the old key.
3. If you saved a key in Console and got no email, consider replacing it anyway. Anthropic’s Lydia Hallie, who works on Claude Code, wrote: “If you saved a key in OpenCode and want to be extra careful, please create a new one!”
4. Check your usage and billing back to October 16, the night of the breach, for requests you didn’t make.
5. Give each tool its own key, with a spending limit or alert at the provider, so a copied key costs less and is easier to trace.

Getting money back

Who	What they’ve said
OpenAI	It worked with OpenCode to get affected API customers “back in business and any credits refunded which would have been drawn in the attack,” said OpenAI’s Thibault Sottiaux
Anthropic	It revoked the Claude API keys it believes were affected. Its post didn’t mention charges; its help center says to contact support about suspicious API activity
Google	It blocked exposed keys. If you see charges you didn’t make, contact Google Cloud Billing support from your account
OpenCode	Raad wrote on October 17 that OpenCode had “already contacted everyone” and that “refunds are already underway”

One developer reported that Google suspended their project for suspicious activity, so check whether any Google Cloud project you used is still running.

What OpenCode hasn’t said

OpenCode called the incident ongoing on October 17, and we haven’t found a post-mortem from it as of October 23. It hasn’t said how the attackers got in or what the older system was, whether the keys were stored encrypted, or how many people 1.4% of Console users is.

Nor has it explained the “distillation attack.” Distillation is collecting a model’s answers in bulk to train another model, and TechCrunch notes that leaked keys can supply the volume of requests it takes. Some researchers, among them Nathan Lambert, questioned whether the term fits what looked like a theft of keys.

Using OpenCode with less at risk

A key you never hand to a hosted service can’t leak from one. Keep provider keys on your own computer, give each tool its own, and for routine work consider a local model, which needs no key at all and keeps your code on your machine.

Enjoy runs the OpenCode app on your computer with the providers already set up in it. It doesn’t ask for or keep their keys: OpenCode does, in the file described above. Its model picker lists every model OpenCode has, local ones included, so a conversation can carry on with one when a plan runs low; Flint is a coding model that runs on a laptop. If you connected OpenCode to a Console workspace, the steps above apply in Enjoy too.