In this article
  1. Update, Oct 18, 2026, 7:11 a.m. Manila time
  2. What happened
  3. Why it matters
  4. What to do

TL;DR: OpenCode says it had a security breach that affected 1.4% of OpenCode Console users, a subset of users who had external providers linked. It has emailed everyone affected. If you use OpenCode Console with your own provider keys, check your email, rotate those keys and review your provider usage and billing.

Update, Oct 18, 2026, 7:11 a.m. Manila time

Two people at the AI providers OpenCode named have since posted about the breach on X. These are posts by individual staff, not official company statements.

  • Lydia Hallie, whose X bio lists Claude Code at Anthropic, wrote: “We’ve been working with OpenCode on yesterday’s breach and have revoked Claude API keys we believe were affected. If you saved a key in OpenCode and want to be extra careful, please create a new one!”
  • Evan Otero, whose X bio lists the technical staff at Google DeepMind, Google AI Studio and the Gemini API (with the note “my views”), wrote: “We’ve blocked exposed API keys” and “If you used an API key with OpenCode: create a new key in AI Studio, delete the old one, and review your usage. If you see charges you didn’t make, contact Google Cloud Billing support from your account.”

The steps below still apply.

What happened

On Oct 17, 2026, at 18:08 UTC (Oct 18, 2:08 a.m. Manila time), OpenCode posted this on its official X account:

“We had a security breach last night related to a large scale distillation attack that impacted 1.4% of OpenCode Console users

We have notified them all this morning via email. If you did not get an email you were not impacted, it was a subset of users who had external providers linked

The incident is ongoing so we cannot share more details at this point but we are working with Anthropic, OpenAI, and Google to remediate”

OpenCode hasn’t said publicly what data was involved, and we won’t guess. We’ll update this story when OpenCode shares more.

Why it matters

OpenCode Console lets you link external AI providers, so it can hold access to paid accounts. OpenCode says the affected users were “a subset of users who had external providers linked.” If one of your provider accounts was linked, it makes sense to treat its keys as at risk until you’ve replaced them, even while the details are unclear.

What to do

  1. Check your email. Search your inbox, and your spam folder, for a message from OpenCode sent on Oct 17–18. OpenCode says: “If you did not get an email you were not impacted.”
  2. Rotate provider API keys connected to OpenCode Console. In each provider’s dashboard (for example Anthropic, OpenAI or Google), create a new key, update the apps and scripts that use it, then revoke the old key. Do this for every key you linked, even if you didn’t get an email. It costs nothing.
  3. Review provider usage and billing. Look at recent usage and charges on each provider account for activity you don’t recognize. If your provider supports spending limits or alerts, turn them on. Contact the provider’s support about any charges you didn’t make.
  4. Watch for updates. OpenCode says the incident is ongoing. Follow its official channels for details, and be careful with messages that ask you to “verify” keys or log in through a link.

For more on how coding-agent plans and limits work, see our Claude and Codex usage limits guide.

Sources & method

Sources

Method. Last checked October 18, 2026. We quoted OpenCode’s statement and the staff posts word for word from their X accounts, and checked OpenCode’s status page. We did not use unconfirmed reports about what was exposed. No affiliate links on this page. How we work.

Spotted an error? See our corrections policy and tell us.