OpenCode has disclosed a security incident in which an attacker gained access to a legacy system on the night of October 16, potentially exposing API keys from third-party providers that users had saved in the Console.
The company stated that the breach affected only 1.4 percent of Console users. The legacy system was already in the process of being decommissioned at the time of the incident. OpenCode did not provide details on how the access occurred, how long it lasted, or how many keys were stored in the system.
The exposure was described as possible rather than confirmed. The company has not stated that any keys were copied or used. Some users have reported unrecognized charges on their provider accounts following the incident.
According to cofounder Dax Raad, the incident was limited to the Console and did not affect the core OpenCode platform. Keys added through the command-line interface or desktop applications remain stored locally on users' machines.
On October 17, OpenCode sent emails to affected users and confirmed that anyone who did not receive a notification was not impacted. In the same statement posted on X, the company said it was working with Anthropic, OpenAI, and Google while the incident was ongoing.
The company linked the event to a large-scale distillation attack but did not explain the connection or name any responsible party. The article notes the lack of technical evidence linking the two events.
Users are advised to revoke and rotate keys directly in each provider's dashboard, as deleting a key from the Console does not revoke it. They should also update any applications that used the old keys and review provider usage and billing starting from October 16.
