OpenCode hacked: if you saved an OpenAI, Anthropic or Google API key in the OpenCode Console, treat that key as stolen and replace it today. OpenCode says about 1.4% of Console users were affected. I went through the official post, the user reports and the coverage so far, and this page sorts what is confirmed from what is still a claim.
Quick answer
- What happened: hackers got into an old system OpenCode was shutting down and may have taken API keys that users saved in the hosted Console.
- Who is affected: only Console users with linked OpenAI, Anthropic or Google keys. OpenCode says no email from them means you were not affected.
- Local app users: OpenCode says keys used in the app on your own computer stay on your machine.
- What to do: delete the key at the provider, make a new one, check your usage and switch on a spending limit.
Watch the 50-second summary
I made a short video that covers the whole story in under a minute. Watch it here, then read the details below:
The video skips some detail on purpose. The sections below add the timeline, the money figures and the full steps.
What is the OpenCode Console, and what did the breach hit?
OpenCode is an open-source AI coding agent that runs in your terminal. It has two parts, and only one of them was breached:
| Part | Where it runs | Where your key lives |
|---|---|---|
| OpenCode app (CLI) | Your computer | A file on your machine |
| OpenCode Console | OpenCode’s servers | Saved on OpenCode’s servers (you bring your own key) |
The breach hit the Console. Co-founder Dax Raad said keys used in the local app never reach OpenCode’s servers. Whoever breaks into a service that stores your key can spend on your account, and the bill goes to you.
What happened in the OpenCode breach?
OpenCode emailed affected users with the subject “Action Required: Potential provider key breach”. The email said someone gained unauthorized access to a legacy system the company was shutting down, and that third-party keys saved in workspaces “may have been exposed.” I could only see this email through users’ own screenshots, so I am describing it second-hand.
OpenCode then posted on X that it had a security breach last night related to a “large scale distillation attack” that impacted 1.4% of OpenCode Console users, and that the incident is ongoing. The post was edited soon after to add that people who did not get an email were not impacted. You can read the original in OpenCode’s post on X.
Timeline (October 17 to 18, 2026)
| When | What happened |
|---|---|
| Oct 17, early hours | Earliest possible exposure, per the OpenCode follow-up email |
| Oct 17, morning | Developer Colin Parsons reports $281 on OpenAI and $168 on Anthropic |
| Oct 17, afternoon | A copy of the breach email appears on the r/opencode subreddit, and security researcher Matt Johansen shares it |
| Oct 17, evening | OpenCode’s official post on X, edited minutes later to add the no-email line |
| Oct 17 to 18 | Anthropic’s Lydia Hallie is reported to say Anthropic revoked the affected Claude keys (I only found this through reposts) |
| Oct 18 | Dax Raad says refunds are underway and affected users were contacted (his statement, not confirmed by the providers) |
Several users noticed odd charges hours before the official post. That gap is one of the reasons people are asking for a proper write-up.
How much money was lost?
OpenCode has not published a total. Every number below is self-reported by users and not verified:
- $281 on OpenAI plus $168 on Anthropic (one developer)
- $150 in a few minutes (another user)
- $1,700 on a key the owner had forgotten about
- Larger claims of about $3,000 and nearly $5,000 from two other developers
Some people also lost access: Google suspended several users’ cloud projects after the sudden spike, and at least one OpenAI account was suspended.
Is it really a “distillation attack”?
Distillation means training a smaller AI on the answers of a bigger one. Labs ban it in their terms of service. OpenCode used that word for this attack, but it has not shown what the stolen keys were used for. Critics question the label, and researcher Nathan Lambert asked whether the tokens were really used for training or for something else. Some people think the keys were simply resold. No group has been named, so I would treat “distillation” as OpenCode’s description and not as a proven fact.
Who is affected, and who is not?
| You use… | Affected? |
|---|---|
| The Console with a linked OpenAI, Anthropic or Google key | Possibly. Check your email for the OpenCode message |
| The Console but never linked a provider key | OpenCode says no (it limited the impact to linked-key users) |
| Only the OpenCode app on your own computer | OpenCode says no. Keys stay in a local file on your machine |
| Not sure | Replace the key anyway. It takes about two minutes |
What should you do right now?
- Search your email for “Potential provider key breach”. No email means you were not affected, according to OpenCode.
- Delete the key at the provider first. Open your OpenAI, Anthropic or Google dashboard yourself (do not click links in emails) and remove the old key there. Deleting it only inside OpenCode does not stop a copy someone already has.
- Create a new key and update every app, script and CI job that used the old one.
- Check your usage since October 16. Look for models you never used, huge token counts and odd hours. Report charges to the provider with the dates.
- Turn on a spending limit and usage alerts. Then confirm the limit is really switched on.
- Use one key per app. If one leaks you see it in one place and can kill it without breaking everything else.
- Delete keys you no longer use. One $1,700 loss came from a forgotten key.
The bigger lesson about stored API keys
An AI API key now works a bit like a card number: it buys the best models on someone else’s account. This breach came from a system that was already being shut down, and one victim lost money on a key he had forgotten. Both were things nobody was watching. Before you paste a key into any hosted tool, ask where it is stored, who can read it and how you revoke it.
OpenCode breach FAQ
Is the OpenCode app itself unsafe to use?
OpenCode says the breach affected the Console, not the open-source app. A separate code-execution bug was fixed in version 1.18.22 earlier, so keep the app updated.
Will I get a refund?
Dax Raad said refunds are underway for affected users. No provider has publicly confirmed a refund policy that I could find, so contact your provider’s billing support with the dates of the charges.
Who did it?
Unknown. No group has been named.
Were my password or card stolen?
OpenCode says it has found no evidence that other data leaked so far.
Last updated October 18, 2026. OpenCode has not published a postmortem yet, and I will update this page when it does.
