OpenCode Breach: API Keys Exposed in 'Distillation Attack'
If you saved your OpenAI, Anthropic or Google API keys in OpenCode's Console, check your billing — right now. On the morning of Saturday 17 October 2026, the company behind the open-source coding agent confirmed that attackers had broken into a legacy backend system and potentially exposed the provider keys stored in users' workspaces. The company called it a "large scale distillation attack." Roughly 1.4% of OpenCode Console users were affected, according to the company, and every one of them was notified by email Saturday morning with an urgent instruction: revoke and replace your keys immediately. What Actually Happened Here is the timeline, assembled from OpenCode's public statements and reporting by security outlets including Infosecurity Magazine and DevOps.com: Night of 16–17 October: An unauthorized party gained access to a legacy OpenCode Console system that was, in the company's words, "in the process of being decommissioned." The syst...