OpenCode Console breach puts saved provider keys at risk

The OpenCode Console breach disclosed on October 17 affected 1.4% of Console users, according to the company. It said those affected were a subset who had linked external providers. OpenCode emailed affected users to warn that third-party provider API keys saved in their workspaces may have been exposed, naming OpenAI and Anthropic as examples. A recipient shared that email on Reddit.

Users on Reddit and X reported unexpected provider charges after the breach. Anthropic says it has revoked keys it believes were affected, and Dax Raad from OpenCode says refunds are underway.

Which keys does the notice cover?

The warning concerns credentials saved in the hosted OpenCode Console. Raad clarified that keys used in the OpenCode agent itself never come to the team. OpenCode's provider documentation separately describes local credentials added through /connect, which it says are stored in ~/.local/share/opencode/auth.json.

Questions in the Hacker News discussion focused on whether local credentials were affected. The disclosed affected group consists of Console users with linked providers. Installing the coding agent alone does not place someone in that group, and OpenCode has not said every Console user with a linked provider was affected.

The company says it emailed everyone affected and that users who received no email were not impacted. It has not given an absolute user or key count behind the 1.4% figure.

If you got the email

The email describes unauthorized access to a legacy system OpenCode was decommissioning. It asks affected users to revoke and replace provider keys, update applications using them and review usage. Deleting a key's entry from OpenCode Console does not perform the provider-side revocation it requests.

The providers' instructions differ on the order:

• Anthropic recommends immediate key revocation. In Claude Console, open API keys, select the key's three-dot menu and choose "Delete API Key." Then use "Create Key" for a replacement. Contact Support if suspicious activity continues.
• OpenAI says to rotate suspected leaked keys immediately from the API Keys page and contact support about misuse. Its regular-rotation instructions say to create a replacement, update applications, verify it works, then revoke the old key.
• Google's Gemini leak-response checklist says to create a replacement in AI Studio or Cloud console, update applications, verify the new key, then disable the old key in Cloud console and audit usage. Google explicitly retains the old key until the replacement is active to avoid downtime.

Complete the replacement by confirming that the old key is revoked or disabled.

For replacement OpenAI keys, set a monthly project spend limit under project settings, Limits, Spend, and enable "Enforce a hard limit." Alerts alone do not stop traffic. Hard enforcement can interrupt legitimate requests and slightly overshoot the configured amount. For an unrestricted Gemini standard key, AI Studio offers "Restrict to Gemini API only"; newly created auth keys already have that restriction.

Anthropic's Lydia Hallie said the company had revoked Claude API keys it believed were affected. If a saved key stops authenticating, check for revocation before treating it as an application bug. Replace the key wherever else you reused it. In OpenCode, opencode auth list lists configured providers; use /connect to enter the replacement.

Keep dated provider usage and billing records, and reply to OpenCode's notification email for refund inquiries. OpenCode named Anthropic, OpenAI and Google as remediation partners, and Raad said refunds were underway, without specifying eligibility or a timetable. The email also promises follow-up updates.

Attack attempts continued on October 18

On October 18, Raad reported nonstop attempts to attack OpenCode's systems over the preceding 48 hours. He said the systems were being hardened and that the team needed agents operating around the clock because the attackers had them. The post supplies no technical evidence for that description of the attackers' tooling.

His update describes continued attempts a day after disclosure, without confirming further successful access or an expanded affected group.

In its October 17 disclosure, OpenCode said: "The incident is ongoing so we cannot share more details at this point." As of our October 19 checks, the company's public updates had not announced containment.

OpenCode called the breach related to a "large scale distillation attack." Its public explanation has yet to connect that description to access to the legacy system. The promised follow-up needs to identify the entry point, explain how saved keys were protected and when access ended, and set out what losses the refund process covers.