Executive Summary
On October 17, 2026, OpenCode confirmed a security breach impacting approximately 1.4% of its OpenCode Console users. The incident was attributed to a vulnerability in a legacy console system that was scheduled for retirement. The primary risk involves the exposure of linked third-party AI provider API keys, including those for OpenAI, Anthropic, and Google, which developers integrated into their workspaces.
Technically, the incident is described as a "large-scale distillation attack." While OpenCode has not confirmed specific misuse, some users have reported unauthorized usage charges. This breach highlights a growing trend of targeting AI credentials to facilitate unauthorized model training and resource consumption.
The business impact includes potential financial loss through unauthorized billing spikes and the risk of data exposure, as compromised keys may grant access to files, prompts, and fine-tuned models stored within the provider dashboards. Organizations using OpenCode should immediately verify if their developers received notification and begin rotating all linked credentials.
Key Details
Threat Name
—
Affects
—
Adversary
—
MITRE Techniques
—
Malware/Tools
None identified