OpenCode Console Breach May Have Exposed API Keys for External AI Services
According to an announcement, a security incident in the hosted OpenCode Console service affected 1.4% of its users. Those affected were advised to revoke and replace keys for external AI providers.
The OpenCode Console breach may have affected the API keys of users who connected external AI model providers to the hosted service. OpenCode linked the incident to a large-scale model distillation attempt and said it affected 1.4% of Console users.
According to an announcement cited by TechCrunch, the company contacted affected users by email. It advised them to revoke existing keys directly with the relevant providers and create new ones. Simply removing a key from the Console environment is not sufficient for this purpose.
The OpenCode Console breach does not affect the local client
According to the available information, the incident concerns users of the hosted OpenCode Console with connected external providers. It does not affect the local open-source OpenCode client itself.
The service documentation confirms that Console supports connecting providers and manages workspace configuration. In such an environment, users can work with their own access keys for AI services.
For API keys linked to paid accounts, their possible exposure represents not only a risk of unauthorized access to models but also the potential for costs from someone else’s use of the interfaces. However, individual reports of unauthorized charges alone do not yet confirm the total financial damage.
What affected users should do
OpenCode Console users who had keys for external AI providers stored in the service should check email notifications from OpenCode and take action directly in the accounts for those services:
- revoke the original API keys with the relevant provider,
- create and deploy new keys if they still need them,
- check usage and charges in their AI service accounts.
According to the cited announcement, OpenCode notified affected users by email. However, the published facts do not state whether all potentially exposed keys were automatically blocked or revoked.
Technical details are still missing
OpenCode has not publicly described the attacker’s entry point, how the keys were stored, or the number of potentially affected keys. The full extent of any possible misuse also remains unknown.
The company attributes the incident to a large-scale model distillation attempt. Independent technical evidence confirming that stolen keys were used for a specific distillation effort has not yet been published.
On October 20, the OpenCode status page continued to report degraded Console and inference services. However, it did not provide a separate technical or forensic analysis of the breach.
What to watch next
For further assessment of the incident, a technical explanation from OpenCode, including the cause and a more precise scope, will be important. Possible statements from AI service providers such as OpenAI, Anthropic, and Google regarding key blocking, misuse, and refunds are also expected. No confirmed figures are currently available for the number of affected accounts or the total financial damage.
Sources
- TechCrunch – Cites OpenCode’s announcement about the incident, the scope of 1.4% of Console users, email notifications, and the need to revoke external keys.
- OpenCode Console Providers documentation – Confirms that OpenCode Console works with connected providers in workspace configuration.
- OpenCode Status – Shows the current operational status of Console and inference services; it does not provide the cause or forensic details of the breach.
Verified and updated: October 20, 2026, 06:26
