On October 17, 2026, OpenCode said it had a security breach affecting 1.4% of OpenCode Console users: the ones who had saved their own OpenAI, Anthropic or Google keys in a Console workspace. The email those users got says attackers reached a legacy system OpenCode was decommissioning, and that the saved provider keys may have been exposed. If you ever saved a key in OpenCode Console, revoke it at the provider, replace it, and check your usage and bill. Nothing OpenCode has published names the open-source CLI as affected; Console is its hosted service. OpenCode calls it a “distillation attack” and says the incident is ongoing, so the details below may change. Fair warning, we build a local-first AI coding tool that competes with OpenCode, so we are not neutral.
The story moved fast. OpenCode's statement on October 17 was viewed more than 2.6 million times, and the Hacker News thread about it passed 900 points within a day. A lot of the coverage since blurs two different products. This post sticks to what OpenCode has actually said, separates what is verified from what is not, and gives you the checklist.
What did OpenCode say?
OpenCode confirmed a breach “related to a large scale distillation attack” that hit 1.4% of OpenCode Console users, all of whom had external providers linked. Its statement on X, posted on October 17 (an earlier, shorter version went up minutes before), says it emailed every affected user that morning, that anyone who did not get an email was not affected, and that it is working with Anthropic, OpenAI and Google to remediate. It also says the incident is ongoing, so it cannot share more yet.
The email itself was posted on Hacker News by a recipient. It says OpenCode identified unauthorized access to a legacy system it was in the process of decommissioning, that third-party provider keys saved in the workspace may have been exposed, and it asks users to revoke and replace those keys, update anything that uses them, and review recent usage for anything unexpected. On October 18, OpenCode's Dax Raad (@thdxr) wrote that attackers had been trying to get into OpenCode's systems non-stop for 48 hours.
Who is affected, and who is not?
The affected group is narrow: OpenCode Console users who saved their own provider keys in a Console workspace. Console is OpenCode's hosted web service, separate from the open-source coding agent you install and run in your terminal. OpenCode's statement says it was a subset of Console users who had external providers linked, and it has not given an absolute number.
- Saved an OpenAI, Anthropic or Google key in OpenCode Console: treat that key as stolen. Rotate it even if you did not get the email; it costs you five minutes.
- Only use the OpenCode CLI with keys in your own environment or config: nothing published says this incident touched you. OpenCode has not said so outright either, and several Hacker News commenters criticised it for not making the line clear.
- Got no email: OpenCode says you were not affected. If you ever pasted a key into Console, rotate it anyway.
What is a “distillation attack”?
A distillation attack is when someone sends a frontier model huge volumes of prompts and trains their own model on the answers. Anthropic described the pattern in February: networks of fraudulent accounts, often routed through commercial proxy services that resell access, spreading the traffic across thousands of accounts so it is harder to spot. Stolen API keys are useful for exactly that, because the bill lands on someone else.
That is the most likely reading of OpenCode's wording: attackers wanted working provider keys to run model traffic on other people's accounts. OpenCode has not confirmed it, and some commenters read the label as making the breach sound like someone else's problem. What matters for you is the same either way: a stolen key is spend on your account until you revoke it.
What is still unknown?
| Claim | Status |
|---|---|
| A breach affected 1.4% of OpenCode Console users with external providers linked | Verified (OpenCode statement) |
| Saved third-party provider keys may have been exposed | Verified (OpenCode email) |
| The entry point was a legacy system being decommissioned | Verified (OpenCode email) |
| OpenCode is working with Anthropic, OpenAI and Google | Verified (OpenCode statement) |
| How the attackers got in, and how the keys were stored | Not disclosed |
| The open-source CLI is unaffected | Not stated by OpenCode; nothing published says it was affected |
| Specific surprise bills from stolen keys | Unverified; no amounts confirmed |
| Larger figures for the number of affected accounts circulating on blogs | Unverified, single sources |
Expect a post-mortem. When it comes, the two answers worth reading are how the keys were stored (encrypted per user, or recoverable in bulk) and why a system being decommissioned still held live keys.
What should you do right now?
- Revoke every key you saved in OpenCode Console, in each provider's own dashboard: the OpenAI platform, the Anthropic Console, and Google AI Studio or Google Cloud for Gemini keys.
- Create a new key and update everything that used the old one: scripts, CI secrets, other tools.
- Read your usage logs and bill for the last few days. Look for models you do not use, traffic at odd hours, or spend spikes. If you see charges that are not yours, contact the provider's support with the dates.
- Set a spend limit on each provider account, so the next leaked key has a ceiling.
- Prefer one key per tool. If each app has its own key, you can revoke the one that leaked without breaking the rest, and the provider dashboard tells you which one was abused.
- CLI users: update anyway. A separate, earlier bug (below) affected OpenCode's local server, and 1.18.22 or later fixes it.
Is this the same as OpenCode's September vulnerability?
No. The September issue was a bug in the OpenCode software you run; October's breach hit OpenCode's hosted service. On September 24, OpenCode published GHSA-632h-h47v-g4x4, found by Datadog Security Labs. A malicious web page could send a cross-site request to the /global/upgrade endpoint of a running opencode serve or opencode web and make it install an attacker's package, which runs code on your machine. It affected versions 1.14.30 to 1.18.21 installed through npm, pnpm or Bun, when the server ran without password authentication or the browser had cached credentials, and was fixed in 1.18.22. Datadog published a proof of concept; it does not say the bug was exploited in the wild.
Why is a hosted key vault the weak point?
A service that stores many users' provider keys in one place turns one breach into thousands of stolen keys. That is not unique to OpenCode. Any hosted gateway, router or console that holds your OpenAI or Anthropic key on its servers is a single target worth attacking, because every key in it is spendable money. The convenience is real: one dashboard, one bill, keys that follow you between machines. The trade-off is that your key's safety depends on someone else's legacy systems.
Keeping keys on your own machine moves the risk, it does not remove it. Malware and poisoned packages go after local config folders too: on October 8, a compromised npm package went looking for the config and MCP files of Claude Code, Cursor, Windsurf and Zed. The difference is scale. An attacker who wants your local key has to get onto your machine; an attacker who breaches a hosted vault gets everyone's at once.
How does a local-first setup change this?
In Bodega One Code, the provider keys you add for cloud models are stored encrypted on your own machine. Since beta.46 a saved key is only sent over HTTPS, and Cloud fallback reuses a provider's key only when it calls that provider's own host. There is no hosted console holding your keys for you. If you run a local model through Ollama, llama.cpp or LM Studio, there is no provider key to steal at all, and air-gap mode blocks the agent's network tools on top of that. See BYOLLM for how bring-your-own-key works in the app.
That is a design difference, not a guarantee. A key on your laptop is still only as safe as your laptop, and we are a small team shipping a beta. The habits in the checklist above (one key per tool, spend limits, rotating on any doubt) apply whatever you use, including us.
Sources
- OpenCode statement on X, October 17, 2026: x.com/opencode
- Hacker News thread, including the text of the email to affected users: news.ycombinator.com/item?id=50133401
- Dax Raad on the ongoing attacks, October 18, 2026: x.com/thdxr
- Anthropic on distillation attacks, February 23, 2026: anthropic.com
- OpenCode advisory GHSA-632h-h47v-g4x4: github.com/anomalyco/opencode
- Datadog Security Labs write-up of the September bug: securitylabs.datadoghq.com
- The October 8 npm package compromise that targeted coding-agent configs: socket.dev
- Bodega One Code beta.46 release notes (saved API keys only sent over HTTPS): changelog
Common questions
- Was OpenCode hacked?
- Yes. On October 17, 2026, OpenCode said a security breach related to a large scale distillation attack affected 1.4% of OpenCode Console users, the ones who had linked external providers. Its email to them says attackers reached a legacy system being decommissioned and that saved third-party provider keys may have been exposed.
- Is the OpenCode CLI affected by the breach?
- Nothing OpenCode has published names the open-source CLI as affected. The breach involved OpenCode Console, its hosted service, and provider keys saved in Console workspaces. OpenCode has not explicitly said the CLI is unaffected, so if you ever pasted a key into Console, rotate it.
- What should I do if I used OpenCode Console?
- Revoke every OpenAI, Anthropic or Google key you saved in OpenCode Console from the provider's own dashboard, create new keys, update anything that used the old ones, review your usage and bill for the last few days, and set a spend limit on each provider account.
- What is a distillation attack?
- A distillation attack is when someone sends a frontier model huge volumes of prompts and trains their own model on the answers, usually through fraudulent accounts or proxy resellers so the traffic is hard to spot. Stolen API keys are useful for it because someone else pays the bill.
- Is this the same as the OpenCode vulnerability from September?
- No. GHSA-632h-h47v-g4x4, published September 24, 2026, was a bug in the OpenCode software: a malicious web page could make opencode serve or opencode web install an attacker's package. It affected 1.14.30 to 1.18.21 installed via npm, pnpm or Bun and was fixed in 1.18.22. The October breach hit OpenCode's hosted Console.
Written by the Bodega One team. We build Bodega One Code, the local-first AI IDE, and we write here about local models, AI costs, and what we learn shipping it. More about the team and why we build local-first on the about page.
Related posts
Keep learning
Free, vendor-neutral courses and guides in the Bodega One AI Academy, from what a model is to shipping an app.
Stay in the loop
Build-in-public updates, model picks, and Copilot/Cursor news as it breaks.
Follow @BodegaOneAI on X →Ready to own your tools?
Free to use, and the beta is open to everyone. Download free.