A 1.4 per cent exposure rate is not the reassuring number OpenCode probably hopes it is. It is a warning about a habit almost every AI toolkit encourages, and that most of us, me included, have stopped questioning. The real failure here is not that an attacker got in. It is that the keys were sitting there to be taken in the first place.
I review AI developer tools for a living, and convenience is the feature I praise most often. One place to paste your OpenAI, Anthropic and Google keys, one dashboard to route every request. This week is a good moment to look at the cost of that convenience.
What actually happened
On October 17, 2026, OpenCode disclosed a breach that may have exposed third-party AI provider API keys belonging to approximately 1.4 per cent of OpenCode Console users. According to the company, an unauthorized party accessed a legacy Console system overnight from 16 to 17 October. That system was already in the process of being decommissioned.
The compromised system reportedly held API keys that users had saved inside their workspaces. Those keys are what let OpenCode Console, the hosted version of the coding agent platform, connect to external model providers. Reporting from CellCog says the exposed keys included OpenAI, Anthropic and Google credentials, and that strangers then spent them on those users’ bills.
OpenCode contacted affected users on the morning of 17 October, telling them that provider credentials saved in their workspaces might have been exposed. The company says the event is connected to a large-scale distillation attack and remains under investigation.
The decommissioning problem
The detail that bothers me most is the word “legacy.” The attacker did not breach OpenCode’s current production stack, at least according to what has been disclosed so far. They got into a system that was on its way out.
Anyone who has worked on infrastructure knows this pattern. A system gets marked for retirement, attention moves to its replacement, and the old box keeps running with real data on it. Patching slows down. Monitoring gets thinner. Nobody wants to own it. Yet it still holds live credentials, and live credentials do not care what the internal roadmap says.
If you are building a toolkit that stores secrets on behalf of users, the decommissioning plan should start with the secrets. Migrate them, revoke them, or delete them first. The server can wait.
Why a distillation link matters
OpenCode has not explained in detail what it means by a distillation attack in this case. Broadly, model distillation involves using a large volume of outputs from one model to train or improve another. If that is the motive here, stolen provider keys make sense as a target. Someone wanting to run huge numbers of queries against frontier models has every reason to want other people paying the bill.
That reframes the risk for developers. Your API key is not just a login. It is a prepaid card attached to some of the most in-demand compute on the market. Treat it with the care you would give a corporate credit card number.
This is not OpenCode’s first security headline
Credit card thinking also applies to the local tool. Earlier this year, OpenCode was the subject of CVE-2026-22812, a critical remote code execution issue. According to the GitHub Advisory Database, OpenCode automatically started an unauthenticated HTTP server that allowed any local process, or any website via permissive CORS settings, to execute arbitrary shell commands with the user’s privileges. Datadog Security Labs published research on discovering and exploiting the flaw.
That vulnerability and this breach are separate incidents, one in the local client and one in a hosted system. But together they point to a theme I keep seeing across agent tooling: speed of shipping has outrun basic defaults like authentication and secret hygiene. Coding agents run commands and hold keys. That combination deserves more caution than a typical SaaS dashboard.
What to do right now
If you have ever saved provider keys in OpenCode Console, do not wait to find out whether you are in the 1.4 per cent.
- Rotate every OpenAI, Anthropic and Google key you stored in an OpenCode workspace, even if you did not receive an email.
- Check usage dashboards with each provider for unfamiliar spikes in the 16 to 17 October window and after.
- Set hard spending limits and alerts where your provider supports them.
- Use separate, scoped keys for each tool instead of one master key everywhere.
- Update your local OpenCode install and confirm you are not running a version affected by CVE-2026-22812.
My verdict
I am not telling you to abandon OpenCode. The company notified affected users quickly, within hours of the overnight intrusion, and that counts for something. Plenty of vendors sit on breach news for weeks.
But I am changing how I score hosted agent platforms. Going forward, how a tool stores, scopes and retires your provider credentials will carry as much weight in my reviews as how well it writes code. A clever agent is not much use if it leaves your keys behind in a building scheduled for demolition.
The investigation is still open, and I will update this review as OpenCode shares more. Until then, rotate your keys.
🕒 Published: