OpenCode Console breach: who was affected, which provider keys to rotate, and what is still unknown

If you connected your own OpenAI, Anthropic or other provider account to OpenCode Console, check your email and your provider dashboards today. On October 17, 2026, OpenCode posted that it “had a security breach last night related to a large scale distillation attack that impacted 1.4% of OpenCode Console users.”

Key facts from OpenCode’s statement:

• Scope: 1.4% of OpenCode Console users, described as “a subset of users who had external providers linked.”
• Notification: OpenCode says it emailed every affected user that morning: “If you did not get an email you were not impacted.”
• Status: the incident is “ongoing,” and OpenCode says it cannot share more details yet. It is “working with Anthropic, OpenAI, and Google to remediate.”

What “external providers linked” means

This is about OpenCode Console, the hosted workspace product, not the open-source CLI on its own. Console’s Providers feature lets owners and admins connect provider accounts they already pay for, such as Anthropic, OpenAI or AWS Bedrock. Console stores that credential and serves the models through its gateway, so workspace members never see the raw key. The Providers API docs describe the same gateway: Console adds the stored provider credential before forwarding each request.

So the exposed asset is the provider key a workspace saved in Console. Keys you only added locally with /connect are stored on your machine in ~/.local/share/opencode/auth.json, according to the OpenCode providers docs. OpenCode’s statement only mentions Console users.

What the notice email says

A screenshot of the notice was posted to r/opencode and shared by security researcher Matt Johansen. We could not verify the email independently. It is titled “Action Required: Potential provider key breach” and says OpenCode “identified unauthorized access to a legacy system that we were in the process of decommissioning,” and that “third party provider keys (eg OpenAI, Anthropic) saved in your workspace may have been exposed.” Johansen also wrote that people had told him their API keys were “running up charges.” That is a secondhand report, not an OpenCode figure.

Cleanup checklist

The email asks affected users to do three things:

1. Revoke and replace every provider key saved in the Console workspace, using each provider’s own dashboard. Disabling the provider in Console is not enough, because the old key keeps working at the provider until you revoke it.
2. Update any application that used those keys, including the new key in Console if you keep using the Providers feature.
3. Review recent usage at each provider for unexpected activity, and keep in mind that the provider bills you for the tokens.

If you are not sure whether you got the email, rotating Console-linked keys anyway is cheap insurance. Put spend limits on the new keys where your provider supports them. Our Claude API credits guide explains how Anthropic workspaces and per-workspace spend limits keep one leaked key from draining a shared balance.

Why “distillation” matters here

OpenCode has not said how stolen keys were used. Distillation attacks are campaigns to extract a model’s capabilities by sending large volumes of requests. Anthropic’s October 12 post on distillation defenses describes proxy networks controlling “hundreds of thousands of fraudulent accounts,” and says Anthropic bans accounts it catches doing this. That is one more reason to revoke an exposed key quickly, before abuse is tied to your account.

A separate issue: the unrelated OpenCode RCE fixed in 1.18.22 affected local opencode serve and opencode web instances. Nobody has linked it to this breach. If you are still on 1.x, our OpenCode 2.0 upgrade guide covers the move.