OpenCode Security Review: API Key Exposure Following Distillation Attack

OpenCode security review of the October 2026 incident reveals that third-party API keys were exposed through a legacy Console system during a large-scale distillation attack. Approximately 1.4 percent of Console users who had linked external providers received notification emails on October 17. Users without an email were not impacted, according to the company.

The breach occurred on a hosted workspace that OpenCode was decommissioning. Keys stored locally in the open-source application or CLI remained unaffected. Exposure began around 00:30 UTC on October 17 and remained active at the time of disclosure.

Timeline and Scope of the Console Breach

OpenCode disclosed the event via its official X account on October 17, 2026. The company stated that the incident involved unauthorized access to saved provider credentials for OpenAI, Anthropic, and Google accounts. Co-founder Dax Raad confirmed the issue was confined to the hosted Console service and did not extend to self-hosted installations.

Earliest reports noted unauthorized charges between roughly $168 and $1,700 on some affected accounts, with occasional project suspensions. Absolute user numbers remain unknown because OpenCode has not published its total Console base. No encryption details, dwell time, or complete list of exposed keys have been released.

Provider responses varied. Anthropic revoked affected Claude keys. Google blocked exposed Gemini keys. OpenAI collaborated on restoration and issued refunds for credits consumed during the attack. OpenCode confirmed that refunds were underway at the time of reporting.

Recommended Actions for Console Users

Users who received the email titled “Action Required: Potential provider key breach” should follow the instructions sent by OpenCode. Immediate steps include revoking and replacing keys in each provider dashboard, updating any applications that used those keys, and reviewing billing logs for unexpected activity.

Additional precautions include setting spend limits on provider accounts and monitoring usage over the following weeks. Users who did not receive an email were instructed by OpenCode that their keys were not part of the exposed set.

The company continues to work with the affected providers on remediation. Further updates are expected through email or the @opencode X account. No full post-mortem has been published as of October 24, 2026.

Background on OpenCode and Distillation Attacks

OpenCode operates as an open-source AI coding agent with a hosted Console option for workspace and billing management. The Console allows users to connect their own provider keys rather than using OpenCode-managed credits. Distillation attacks harvest large volumes of model outputs, often through proxies, to train competing models; stolen paid keys help bypass fraud detection.

Earlier unrelated reports noted a critical remote code execution vulnerability patched silently in September 2026. That issue did not involve the Console key exposure described here. As of the latest available information, OpenCode has not issued a comprehensive security report covering root cause or long-term fixes.

Business users and developers relying on linked provider keys should treat any hosted workspace that stores credentials as a potential single point of failure. Regular key rotation and separate billing alerts remain standard practice when using third-party AI tooling.