OpenCode Console Security Breach: API Keys Leaked in 'Distillation Attack' (October 2026)

OpenCode disclosed a security breach on October 17, 2026 that exposed third-party provider API keys — including OpenAI and Anthropic credentials — stored in OpenCode Console workspaces belonging to 1.4% of its users. The company attributed the incident to a "large scale distillation attack" and said it is working with Anthropic, OpenAI, and Google to remediate. The affected product is OpenCode Console, a hosted API-key gateway, not the open-source OpenCode coding agent that most people mean when they say "OpenCode."

What OpenCode actually announced

The company posted the following statement on X (formerly Twitter) at 5:56 PM on October 17, 2026:

We had a security breach last night related to a large scale distillation attack that impacted 1.4% of OpenCode Console users

We have notified them all this morning via email

The incident is ongoing so we cannot share more details at this point but we are working with Anthropic, OpenAI, and Google to remediate

The post had roughly 17.6K views at the time it was scraped. A note on the post indicates a newer version of the statement exists at a separate URL, but the content of that revised post is not included in the source material.

OpenCode also sent affected users an email. The text of that notice, as shared by the person who submitted the story to Hacker News, reads:

From OpenCode Team --- Hi, We identified unauthorized access to a legacy system that we were in the process of decommissioning. Third party provider keys (eg OpenAI, Anthropic) saved in your workspace may have been exposed. Please revoke and replace those keys through the relevant provider's dashboard, update any applications using them, and review recent usage for unexpected activity. We're sorry this happened and will follow up with any updates.

The two statements together establish the core facts: unauthorized access to a legacy system, exposure of third-party provider keys stored in user workspaces, and an ongoing investigation.

The affected product is OpenCode Console, not the OpenCode coding agent

The single most important clarification about this incident is that it concerns OpenCode Console, a hosted service, and not the OpenCode CLI or TUI coding agent. The naming overlap caused widespread confusion in the Hacker News discussion.

One commenter, redsymbol, laid out the distinction in detail:

To clarify something that the OpenCode team has done a bad job of clarifying: The leak was for something called 'OpenCode Console', which is distinct and separate from the OpenCode coding agent. If you're just using the coding agent, you're not affected. 'OpenCode Console' is a service that is similar to OpenRouter, but is much less widely used. The name 'OpenCode Console' is super confusing, because one might think it means the CLI coding agent. It does not. 'OpenCode Console' has nothing to do with the CLI/TUI coding agent, nor the desktop app version. The situation is made worse by the fact that 'OpenCode Console' barely has any documentation online, and the official leak announcement does not make the distinction clear at all. The OpenCode team did a terrible job of communicating this, and that's on them. Today is a bad day for people using 'OpenCode Console'. But most people, probably the vast majority of OpenCode users who are reading this, are not using 'OpenCode Console'.

Another commenter, rozenmd, made the same point more briefly, arguing the Hacker News submission title should be changed to "OpenCode Console hacked: User credentials leaked" because "The opencode CLI has no impact."

The practical takeaway: if you installed the OpenCode coding agent and configured it with your own API keys locally, this breach does not apply to you. If you created an OpenCode Console account and uploaded provider keys to it, you may be affected.

What OpenCode Console is, and why keys were stored server-side

OpenCode Console functions similarly to OpenRouter: users can bring their own API keys (BYOK) for providers such as Anthropic, OpenAI, and Google, or use provider keys supplied by the service and be billed at token rates. Commenter djchen summarized this understanding as the scope of the breach — "some OpenCode Zen users who stored their (BYOK) API keys from Anthropic/Google/OpenAI."

Because the service stores user-supplied keys on its backend, the breach exposed credentials that grant direct access to users' provider accounts. Commenter latchkey described the user experience that leads to this exposure:

the ux is kind of crazy. you login to their website, and you are presented with a list of providers where you can click and add your provider api key. how the key is stored on the backend isn't clear, but it is akin to handing your password or if you know crypto, your private key, to someone and letting them store it for you. from what i can tell, there are no links within the console to a ToS, Privacy policy or anything else. there are no warnings or documentation about how they store your keys.

That comment links to a GitHub issue in the anomalyco/opencode repository (issue #10416) as further context.

Why the phrase "distillation attack" confused observers

The wording of the announcement drew immediate skepticism, because a distillation attack and a credential leak are not obviously the same thing. Commenter fleshers asked whether the statement meant "the credentials were hacked and then used to perform a mass distillation campaign." Commenter searealist put the confusion plainly:

> security breach > related to a large scale distillation attack I'm not sure how this adds up. I could understand if this impacted their uptime, but not security. Are they actually saying a bunch of credentials were stolen and are being used for distillation?

Commenter tonymet offered a lay interpretation of the sequence:

Hackers breached an Open Code legacy system containing customer keys for openai etc, and ran up large bills against the customer's openai accounts . The tokens were used to train the hacker's ai models (the distillation). My guess is a more primitive arbitrage / resale attack . Like reselling EBT cards or "free" vpn traffic.

This interpretation is a commenter's guess, not an official explanation. OpenCode has not published a detailed technical breakdown of the attack mechanism. The original submitter of the Hacker News story also noted this gap: "Awaiting for detailed breakdown of the incident. I am more interested in knowing, how can a distillation attack leak / expose credentials."

Warning signs were reportedly raised before the breach

Several commenters argued the incident followed earlier red flags. Commenter TZubiri pointed to two prior Hacker News threads, posted roughly four days before the breach disclosure, and drew a defensive lesson:

what's interesting is that all those efforts that go into sandboxing through virtualization wouldn't have helped here. But the solutions that proxy the api keys and hide them from agents might have worked as a defense in depth.

Commenter oldfuture referenced an earlier Hacker News item about VirusTotal flagging OpenCode, writing: "that's why virustotal was flagging it then."

Commenter preommr questioned the moderation of the discussion itself, noting that comments pointing out early warning signs appeared to be getting downvoted or flagged, and asking whether that reflected genuine support for OpenCode or something else. The original poster also claimed the submission had been flagged and asked readers to upvote it.

What users should do if they are affected

The official guidance from OpenCode's email to affected users is specific and actionable:

1. Revoke and replace any third-party provider keys (for example, OpenAI or Anthropic keys) that were saved in your OpenCode Console workspace, using the relevant provider's dashboard.
2. Update any applications that were using those keys.
3. Review recent usage on those provider accounts for unexpected activity.

Commenter Ciantic proposed a systemic improvement rather than a user-level fix: "I think every API key system should have endpoint 'invalidate_api_key' this way whitehat hackers or the party who stored them could invalidate all keys in the case they leak. Now it is race against the time, and everybody got email, and everyone must act themselves."

Reported impact and community reaction

At least one user reported a direct financial loss in reply to the announcement. A reply from the account @lol_gogy94668 stated "138$ gone. Will we be compensated?" This is an unverified user report and not a figure confirmed by OpenCode.

Other commenters focused on the economics behind the attack. Commenter MisterMunchkin observed: "It's fascinating that tokens are so valuable that people are spending so much time and effort hacking to obtain API keys." Commenter verbo_villain asked whether users would "wake up and see their Anthropic, openAI, etc accounts drained."

Some commenters were sharply critical of the company. Commenter hypfer wrote: "They have shown so so so many times that their culture is not aligned with trustworthy software. Yet people keep using it." Commenter zephiel7 criticized the model of storing API tokens on a server while marketing the product as open and free.

Others were simply confused about scope. Commenter computerex asked: "Why are my API keys in the workspace exposed? Does OpenCode send my API keys to their backend servers??? Was this a supply chain attack that infected the opencode program itself? What is going on?" Commenter vinni2 asked: "But isn't OpenCode open source why does it need credentials." These questions reflect the same underlying communication failure: the announcement did not clearly separate the open-source coding agent from the hosted Console service.

Open questions that remain unanswered

The source material leaves several things unresolved:

• The exact technical mechanism by which the breach occurred. OpenCode described "unauthorized access to a legacy system that we were in the process of decommissioning" but has not published a post-mortem.
• The absolute number of affected users. OpenCode stated 1.4% of OpenCode Console users, but did not give a total user count.
• The relationship between the "distillation attack" framing and the credential exposure. No official explanation connects the two.
• The contents of the revised statement posted at the newer URL referenced on the original post.

Commenter rvz and others stated they are waiting for a full post-mortem. Until OpenCode publishes one, the confirmed facts are limited to what the company said publicly: a breach affecting 1.4% of OpenCode Console users, exposure of third-party provider keys, email notification to affected users, and active remediation with Anthropic, OpenAI, and Google.