OpenCode Console breach exposed saved provider API keys
OpenCode said a breach of its hosted OpenCode Console affected 1.4% of Console users who had linked external providers. Their saved OpenAI and Anthropic keys may have been exposed, and Anthropic revoked Claude keys it believed were affected.
What it is
OpenCode, on X (17 October 2026): “We had a security breach last night related to a large scale distillation attack that impacted 1.4% of OpenCode Console users.” It says it emailed every affected user, that it “was a subset of users who had external providers linked”, and that it is working with Anthropic, OpenAI and Google to remediate.
The email to affected users, as posted on Hacker News, describes “unauthorized access to a legacy system that we were in the process of decommissioning” and says third-party provider keys (e.g. OpenAI, Anthropic) saved in the workspace may have been exposed. It asks users to revoke and replace those keys and review recent usage.
Lydia Hallie of Anthropic’s Claude Code team said Anthropic has “revoked Claude API keys we believe were affected”. On Hacker News, one user reported getting OpenCode’s email alongside one from Anthropic saying their $20 of monthly API credits had been used up.
The breach was in OpenCode Console, the hosted service where you can bring your own provider keys. Hacker News commenters point out it is separate from the open-source OpenCode CLI and desktop app; OpenCode hasn’t published technical details yet and calls the incident ongoing.
How to check
- Look for an email from OpenCode about a potential provider key breach. OpenCode says users who didn’t get one weren’t affected.
- If you ever saved an OpenAI, Anthropic or Google key in an OpenCode Console workspace, check each provider’s usage page for activity you don’t recognise.
- A Claude key that suddenly fails to authenticate may be one Anthropic revoked.
How to fix
- Revoke every provider key you saved in OpenCode Console and create new ones, even if usage looks normal. Update any apps that used the old keys.
- Use a separate key per tool or service, and set spend limits at each provider so one leaked key can’t drain your whole balance.
- Contact the provider’s support if you see charges you didn’t make.