OpenCode Says Breach May Have Exposed Third-Party API Keys for 1.4% of Console Users
Summary
OpenCode says unauthorized access to a legacy system may have exposed third-party provider keys belonging to 1.4% of Console users. The investigation continues, and affected users were advised to replace keys and review API activity.
Key points
- OpenCode said the incident affected 1.4% of Console users who had connected external model providers.
- The company attributed the intrusion to unauthorized access to a legacy system it was retiring.
- Saved third-party access keys may have reached outsiders; OpenCode has not said what data was taken.
- OpenCode linked the incident to an AI distillation attack but has not explained the connection or how intruders gained access.
- OpenCode said it notified users it considers affected; Anthropic, OpenAI, and Google are helping with cleanup.
- Notified users were advised to revoke and replace their keys and check API usage and spending for unfamiliar activity.
Article Details
- Victim Organization
- OpenCode
- Incident Type
- Unauthorized access to a legacy system during a reported AI distillation attack; saved third-party model access keys may have been exposed.
- Disclosure Date
- 2026-10-17
- Data Types Exposed
- Third-party model provider access keys (potentially exposed)
- Affected Records
- 1.4% of OpenCode Console users; exact number not disclosed.
- Operational Impact
- OpenCode said it notified users it considered affected. Those users were advised to revoke and replace keys and review API usage and spending. The source reports no service disruption.
- Ransom Or Extortion
- None reported.
- Claim Status
- confirmed