OpenCode Console breach: provider API keys of 1.4% of users may be exposed
What is it?
OpenCode says someone got into a legacy Console system it was in the middle of shutting down on the night of October 17. About 1.4% of Console users, those who had linked external providers such as OpenAI, Anthropic or Google to a workspace, were affected and have been notified by email. The company ties the incident to a large-scale distillation attack (harvesting another model's outputs in bulk to train on) and says it is still ongoing.
Why does it matter?
When provider keys handed to a coding agent leak in bulk, surprise bills and key abuse follow fast. OpenCode says users who got no email were not affected, but if you stored keys in Console, it's safer to issue new ones in each provider's dashboard and check recent usage. If your team hands keys to agent tools, you should recheck key scopes and spending limits.
Maturity
GAOpenCode confirmed the incident on its official account. It hasn't said how the attackers got in or whether the keys were misused.
How to track it
- Incident report: watch OpenCode's X account and blog for a full write-up on the cause and scope.
- Provider response: check whether Anthropic, OpenAI and Google announce key revocations or refunds for affected users.
- Your accounts: look for unfamiliar calls in each provider's usage and billing pages.