OpenCode breach tied to mass distillation attack exposes API keys of ~1.4% users

OpenCode disclosed on October 18 that a security breach tied to a "large-scale model distillation attack" had occurred the previous night, affecting roughly 1.4% of OpenCode Console users, who were individually notified by email that morning. According to accounts relayed by @thedealdirector and others, the affected users were a subset of those who had linked external provider accounts; OpenCode is working with Anthropic and other parties involved, and the incident remains under investigation.

Confirmed

• The attackers gained unauthorized access to a legacy system being decommissioned, and third-party API keys (e.g., OpenAI, Anthropic) stored in user workspaces may have been leaked (official notice relayed by @jedisct1).
• Some users have already reported their API keys being stolen and used for actual charges (@jedisct1).
• The company confirmed the incident and asked users to revoke their keys; the leak occurred at the step of adding an API key or provider for LLM authentication (@pjausovec).
• Reddit user chemistslime posted "Opencode breached," urging the community to rotate API keys immediately, corroborating the leak thread on r/opencode (@chemistslime).
• @pjausovec noted a mitigation: authenticating via an AI Gateway or similar can reduce the risk of direct key exposure.

Not Yet Confirmed

• The specific techniques of the "large-scale distillation attack," the entry point details, and the attackers' identity have not been disclosed; the incident is still being handled and details are being released progressively.

Why It Matters

• Leaked API keys can cause direct financial damage, and there are already cases of actual fraudulent usage; anyone who has stored third-party keys in OpenCode should revoke and rotate them immediately.
• The incident exposes the security risks of AI coding tools centrally storing user LLM credentials, renewing attention to indirect authentication methods such as gateways.

2026-10-18 ~ 2026-10-18 · 7 related posts

• OpenCode confirms breach, stolen customer API keys already incurring charges — jedisct1 · 2026-10-18
• OpenCode hacked: API keys stolen, users told to revoke; gateway egress control as defense — pjausovec · 2026-10-18
• OpenCode discloses breach from large-scale distillation attack hitting 1.4% of users — TheZachMueller · 2026-10-18
• OpenCode breach warning: rotate your keys now, details still emerging — chemist_slime · 2026-10-18
• [source] OpenCode breach exposes provider API keys of at least 1.4% of Console users — kimmonismus · 2026-10-18

2 near-duplicate retellings: thedealdirector · kimmonismus