If OpenCode emailed you about a linked provider key, revoke that key at OpenAI, Anthropic, Google or the relevant provider, create a replacement and check recent usage. If you used Console but are unsure which keys were linked, rotate those keys as a precaution. OpenCode says the Console breach affected 1.4% of its Console users, specifically a subset with external providers linked. If you only run the open-source OpenCode app on your own computer and added keys with /connect, OpenCode says those keys never reached its servers.
That difference matters because Console and the OpenCode coding agent share a name but work very differently. Console is the hosted dashboard where teams buy model access and plug in provider accounts. The local app is a separate way to connect to providers.
What OpenCode has confirmed about the breach
OpenCode said in a public statement that a security breach affected 1.4% of Console users. It has confirmed three things so far:
- Who was hit: a subset of Console users who had external providers linked. OpenCode says anyone who did not get an email was not affected.
- How people were told: OpenCode says it emailed affected users. If you linked a provider key in Console, check the email address associated with that workspace.
- Who is helping: OpenCode says it is working with Anthropic, OpenAI and Google, and that the incident is ongoing.
What OpenCode has not explained
OpenCode called this a “distillation attack”, but it has not explained how the attacker reached the system, how long access lasted or which credentials were exposed. Distillation describes using one model’s output to train another; it does not explain the security failure. A fuller incident report is still needed.
OpenCode Console vs the OpenCode app: who needs to act
Console’s own documentation describes the setup that was exposed. Workspace owners and admins can connect provider accounts they already pay for, such as Anthropic, OpenAI or AWS Bedrock. Console then “stores the credential and serves each provider through its gateway”, so team members can use the models without ever seeing the key. That is convenient for a team, but it also means one hosted system held keys for several providers at once.
The local app works differently. OpenCode’s current V2 documentation says keys added with /connect are saved by the local server in its SQLite database. Older versions used a local auth.json file. Neither is the hosted Console credential store. Dax Raad, who builds OpenCode, replied on X that this incident was “the OpenCode Console, not OpenCode itself, those keys never come to us”. If you have set up MCP servers with OAuth in the app, nothing in OpenCode’s notice points to those connections either.
| How you use OpenCode | Exposed in this breach? | What to do |
|---|---|---|
| Console workspace with your own OpenAI, Anthropic or Google key linked | Possibly, if you got OpenCode’s email | Revoke and replace the key at the provider, check usage, report charges |
| Console with only OpenCode’s paid models (Zen, Go) | Not named in OpenCode’s notice | Check for OpenCode’s email and review Console usage |
Local app with keys or provider sign-ins added through /connect | OpenCode says no | No Console-specific action indicated; check whether you also saved the same key in Console |
How to replace a leaked OpenAI, Claude or Gemini API key
Affected Console users should revoke and replace any linked provider keys, update everything that uses them and review recent usage. Go directly to each provider’s site rather than following a link in a breach email.
- List every key you ever pasted into Console. Check the Providers tab in each workspace you belong to. Remember older keys you may have removed from Console but never deleted at the provider.
- OpenAI: open the API keys page in the OpenAI platform, delete the old key and create a new one. Then check your project or organisation spend controls. An alert only notifies you; a configured hard spend limit can stop affected requests, though enforcement may not be instantaneous.
- Anthropic (Claude): delete the old key in the Claude Console and create a new one. Anthropic says it has already revoked the Claude keys it believes were affected, but deleting it yourself costs nothing. To cap future damage, open the Billing page and use “Adjust limit” under Spend limits to set your own monthly ceiling below your tier’s cap.
- Google (Gemini API): Google says it has blocked the exposed keys. Create a new key in Google AI Studio, delete the old one and review your usage.
- Update everything that used the old key. That includes Console itself (click the credential on the provider page to enter a new one), CI jobs, scripts,
.envfiles and any other coding agents. - Read your usage for the last few days. Look for models you never use, odd hours and sudden spikes, then report anything unfamiliar with the dates and amounts.
One detail is easy to miss. Console has its own budgets, which cap what a workspace spends through Console each month. Those budgets only see requests that pass through Console’s gateway. Someone holding a raw provider key can call OpenAI or Anthropic directly, so the limit that protects you is the one you set at the provider. The same goes for the session costs OpenCode shows you: OpenCode plugins that track tokens and usage only count your own sessions, not traffic from someone else using a copied key.
What Anthropic and Google have said
Lydia Hallie of Anthropic’s Claude Code team posted that Anthropic had been “working with OpenCode on yesterday’s breach” and had “revoked Claude API keys we believe were affected”. Her advice to anyone who saved a key in OpenCode was to create a new one.
Evan Otero, who works on Google AI Studio and the Gemini API, posted that Google had “blocked exposed API keys” and was working with affected customers and OpenCode. If you see charges you didn’t make, he said to contact Google Cloud Billing support from your account.
OpenAI is one of the three companies OpenCode named, but it has not posted similar public guidance. If you saved an OpenAI key, rotate it yourself rather than waiting.
Will you get a refund for unauthorised charges?
OpenCode has not published formal refund terms. If you see usage you did not make, keep a record of the charges and contact the provider’s billing support and OpenCode. Do not assume a reimbursement is automatic.
Limit the damage from a leaked key
An API key works for whoever holds it. Keep separate keys for separate tools so you can revoke one without breaking everything else.
Set provider-side spending controls where available and delete keys you no longer use. Console’s workspace budget alone cannot limit traffic sent directly to a provider with a copied key.
Should you stop using OpenCode?
Not because of this. The local agent was not part of the breach as OpenCode describes it, and the setup in our guide to OpenCode plugins and themes does not depend on Console. The hosted side is where I would be more careful. Putting a team’s provider keys in one gateway is convenient, and it also creates one place to steal them from. Until OpenCode explains how the breach happened and what has changed, I would keep personal keys local, give Console only tightly capped keys, and watch for the full incident report.
If you are weighing other agents after this, our Command Code vs OpenCode comparison covers how the two handle MCP, mods and plugins. Whichever agent you pick, the same key hygiene applies.
FAQ
Was the OpenCode app itself hacked?
OpenCode says no. OpenCode identified its hosted Console service as the affected product. Keys you add to the local app with /connect are stored on your own computer.
How do I know if my keys were exposed?
OpenCode says it emailed affected users and that anyone who did not receive the notice was not affected. If you linked a provider key in Console but are unsure whether it was affected, rotate it at the provider as a precaution.
Is deleting the key in OpenCode Console enough?
No. Removing a key from Console does not stop a copy of it from working. You need to delete or revoke it at OpenAI, Anthropic or Google, where it was issued.
What is a distillation attack?
Distillation means training an AI model on another model’s outputs. OpenCode used the term to describe the attack but has not explained how it connects to the stolen keys.
- SourceOpenAI: API spend limits
