OpenCode breach exposes stored OpenAI and Anthropic keys — rotate now
A distillation attack hit ~1.4% of OpenCode Console users via a legacy system, draining provider balances. The incident is ongoing — here's what to do.
Copy markdown
~1.4% of Console users, provider keys exposed
OpenCode disclosed on Oct 17 that attackers reached a legacy system being decommissioned and may have accessed third-party provider keys — OpenAI, Anthropic and Google — saved in users' workspaces. It emailed every affected user individually; if no email reached you, you're not impacted.
Rotate every key you saved in OpenCode
Revoke and replace the exposed provider keys from each provider's dashboard, update any apps or scripts that use them, and scan recent usage for spend you didn't make. OpenCode says the incident is still ongoing, so don't wait for an all-clear.
A 'distillation attack' that ran up your bill
OpenCode calls it a large-scale distillation attack: stolen keys were aimed at high-end models to harvest their outputs, draining balances — some users reported bills in the hundreds of dollars. The goal was your model access, not passwords or card numbers.