OpenCode discloses breach; provider keys may have been exposed in distillation attack

OpenCode disclosed on October 17, 2026 that it had identified unauthorized access to a legacy system that was in the process of being decommissioned, and that third party provider keys saved in user workspaces may have been exposed. The company describes the incident as a large scale distillation attack that impacted about 1.4 percent of OpenCode Console users, a subset who had linked external providers. The keys named as examples include OpenAI and Anthropic keys, and the company says it is working with Anthropic, OpenAI, and Google on remediation.

Affected users were notified individually by email, and OpenCode says users who did not receive that email were not impacted. Affected users have been asked to revoke and replace their keys through the provider dashboard, update applications using them, and review recent usage for unexpected activity. OpenCode says the incident is ongoing and it cannot share more details at this point. No confirmed extraction count, duration, or financial loss has been independently established, and the 1.4 percent figure alone does not measure exposure or loss.

Sources: OfficeChai; RuntimeWire