The company links the incident to a “large scale distillation attack” on a legacy system and has told affected users to revoke and replace their keys with each provider.
OpenCode said on Saturday that a breach the night before may have exposed AI provider keys saved in workspaces on its Console product, affecting 1.4% of Console users. The company linked the breach to what it called “a large scale distillation attack” and described the incident as ongoing. According to the email it sent affected users, as reported by The Latent, the attacker gained unauthorized access to “a legacy system that we were in the process of decommissioning”. OpenCode says users who did not receive an email were not affected; it has not named users of its command-line tool who keep keys only on their own machines as affected. It has not said how the attacker got in, how long they had access, or how many users the 1.4% represents. OpenCode says it is working with Anthropic, OpenAI and Google. For affected users, removing a key inside OpenCode does not stop anyone who already copied it: the key has to be revoked and replaced in each provider’s own dashboard, and usage and spending caps checked there, since Console’s limits cover only Console credits.
Sources: OpenCode on X · The Latent · Notebookcheck