On the night of October 16, OpenCode experienced a security breach involving its legacy systems, potentially exposing API keys from major AI providers like OpenAI, Anthropic, and Google. These keys were stored in the OpenCode Console, a hosted service that allows users to save their own API keys to facilitate seamless model access without revealing the keys to team members. The breach affected 1.4% of Console users who had linked their accounts with these external providers. Affected users were promptly notified via email on October 17, advising them to revoke and replace their API keys with the respective providers. Users who did not receive this communication were not impacted.

This breach specifically targeted keys stored in the Console, not those held within OpenCode's command-line or desktop applications. These applications store keys locally on the user's machine, ensuring they never reach OpenCode's servers. Co-founder Dax Raad clarified on X that the breach involved only the Console, not the broader OpenCode infrastructure.

API keys function as bearer credentials, allowing anyone with access to make billable requests against the key owner's account until the key is revoked. Simply deleting a key from the Console does not revoke it, and the Console's budget features cannot limit usage since it only records requests passing through its gateway.

Some users have reported unauthorized charges due to the breach, with expenses ranging from a few hundred dollars to over a thousand. Despite these reports, OpenCode has not confirmed any specific keys being copied or used. The company described the breach as ongoing and linked to a "large-scale distillation attack," a method by which attackers pull model outputs in significant numbers to train rival models. This attack type often involves networks of fake accounts created with stolen credentials, including API keys.

As of October 18, OpenCode reported ongoing attempts to penetrate its systems. However, these attacks have inadvertently led to increased security measures, hardening their defenses.