OpenCode Console: stored provider keys may have been exposed

01What happened

OpenCode confirmed a security breach on October 17, 2026 that reached third-party API keys stored in its hosted Console. The company described the incident as a large scale distillation attack affecting 1.4% of OpenCode Console users, and says it emailed every affected user. Cyera researchers Adam Ochayon and Yuval Yogev published an analysis and a key rotation guide the same day.

02How it works

A Console account can hold a user's own provider keys so that the hosted agent calls OpenAI, Anthropic or Google on that user's behalf, which puts long-lived credentials in one place. OpenCode attributes the intrusion to a legacy Console system it was in the process of decommissioning, which held those stored credentials. Cyera notes that OpenCode has not said how the attackers reached that system or how the keys were stored.

03Who is affected

Accounts at risk are OpenCode Console users who had external AI providers linked to them. OpenCode's notice covers the hosted Console and the provider credentials kept in it, and the company says users who received no email were not affected.

04What to do

Revoke and reissue every provider key that was stored in OpenCode Console, in each provider's own dashboard rather than through OpenCode or a link in an email. Reset the OpenCode account password, regenerate Console API keys, update any application or scheduled job that used an old credential, and confirm the retired key now fails. Read provider billing and usage from October 16, 2026 onward for charges nobody authorized, and set hard spend limits.

Questions people ask

Am I affected by the OpenCode Console breach?

OpenCode says it emailed every affected user, and that anyone who did not receive an email was not affected. Affected accounts are OpenCode Console users who had external AI providers linked, about 1.4% of Console users by the company's own count. Developers who stored an OpenAI, Anthropic or Google key in Console should check the inbox tied to that account.

How do I rotate API keys exposed in the OpenCode breach?

Revoke each affected key in the provider's own dashboard, at OpenAI, Anthropic or Google, rather than swapping the value inside OpenCode Console, Cyera advises. Reach those dashboards directly instead of through a link in an email. Afterwards reset the OpenCode account password, regenerate Console API keys, update any job that used the old credential, and confirm the retired key fails.

Were the exposed OpenCode keys actually used by attackers?

Whether any exposed key was used is unconfirmed. Some OpenCode users reported charges they did not authorize, according to Cyera, but OpenCode has published no count of misused keys and no list of indicators. Anyone who stored a provider key in Console should read provider billing from October 16, 2026 onward and set hard spend limits per key.

Does the OpenCode breach affect the local OpenCode agent?

OpenCode's notice covers the hosted Console and the provider credentials kept there, and the 1.4% figure counts Console users rather than everyone who runs OpenCode. Cyera's guidance is Console-centric: locate Console accounts, check which providers are linked to each Console workspace, and regenerate Console API keys. Developers who never linked a provider account to Console have no key to rotate here.

What does OpenCode say caused the Console breach?

OpenCode attributed the intrusion to a legacy Console system it was in the process of decommissioning, in its email to affected users, and called the incident a large scale distillation attack affecting 1.4% of Console users. How attackers reached that system, and how the keys were stored, the company has not said. Cyera reports the investigation was open at publication.

Sources 2 links, all fetched

1. 1cyera.comCyera Analysis
2. 2github.comUser Report