OpenCode Was Breached: How to Rotate Your OpenAI, Anthropic, and Google API Keys

OpenCode disclosed a security breach on October 17, 2026, and told users to assume their stored API keys for OpenAI, Anthropic, and Google were exposed. If you ever linked a provider key inside OpenCode Console, the fix is simple and non-negotiable: go rotate that key in the provider's own dashboard today, not inside OpenCode, and check your usage logs for charges you didn't make.

What actually happened in the OpenCode breach?

OpenCode posted on X that it had "a security breach last night related to a large scale distillation attack that impacted 1.4% of OpenCode Console users." The company said it notified affected users by email that morning and that if you didn't get an email, you weren't part of the 1.4%.

The entry point, according to OpenCode, was a legacy system inside Console that was already in the process of being decommissioned. That system stored third-party provider keys that users had saved so OpenCode could call OpenAI, Anthropic, and Google models on their behalf. Attackers got into that legacy piece, and from there had access to whatever keys were sitting in it.

OpenCode has not said exactly how the attackers got in, how long they had access, or how many accounts 1.4% actually represents. That's a real gap. "We're working with the providers" is not the same as "here's the root cause," and as of this writing OpenCode hasn't published the second part.

Is this the OpenCode you run in your terminal?

Mostly no, and this is the part a lot of the breaking-news headlines blurred. OpenCode the open-source coding agent, the CLI tool with 70,000-plus GitHub stars that people run locally, is not what got hacked. The breach hit OpenCode Console, a separate hosted service that works a bit like OpenRouter: you log in, paste in your OpenAI or Anthropic key, and Console manages routing and billing for you.

If you only ever ran the OpenCode CLI with keys in your own .env file or shell environment, and never touched Console, you weren't exposed by this specific incident. If you used Console's "add your provider key" flow at any point, even once, assume you were in scope and rotate anyway. Better safe than $400 poorer.

How bad was the actual damage?

Bad enough that people noticed before OpenCode said anything. Developer Max Weinbach posted that his OpenAI account had logged around 35 million tokens across nearly 9,000 requests in a single day, enough to drain his prepaid balance into the negative. Other users reported roughly $400 in unauthorized Anthropic charges, and at least one person said their Google bill jumped by about €200.

Security researcher Soups Ranjan, who posted a widely shared breakdown of the incident, said the exposed keys were "apparently being stored in cleartext." OpenCode itself hasn't confirmed that detail publicly, so treat it as a credible claim from someone in the space rather than a confirmed fact, but it lines up with how fast and how large the token usage spikes were. Cleartext storage plus a compromised legacy system is about the worst combination you can have for a key vault.

What is a "distillation attack," and why target API keys for it?

A distillation attack is when someone uses access to a strong model to generate a large volume of input/output pairs, then trains a cheaper model to imitate the expensive one. It's a legitimate research technique when you own the access. It's theft when you're running it on someone else's paid API key.

That's the framing OpenCode chose, and it explains the token volume: 35 million tokens in a day isn't a human developer coding, it's a script hammering an endpoint to harvest outputs at scale. Whoever did this wasn't trying to read your code. They wanted cheap, high-volume access to frontier models, and your stored key was the ticket.

How do you rotate your OpenAI, Anthropic, and Google API keys?

Do these in order, and do them even if you're not sure you were affected:

1. Revoke the key at the provider, not in OpenCode. Deleting a key from OpenCode's dashboard doesn't stop someone who already copied it. Go to platform.openai.com, console.anthropic.com, and Google's AI Studio or Cloud console directly, and revoke any key you ever pasted into OpenCode Console.
2. Type the URL yourself. Don't click the link in OpenCode's breach email. It's probably legitimate, but breach notifications are exactly the kind of email phishing campaigns love to clone. Navigate to the provider site from memory or a bookmark.
3. Check usage logs for the last 7-10 days. Look for request volumes, token counts, or regions that don't match your own activity. OpenAI, Anthropic, and Google all show this under usage or billing.
4. Set a hard spend cap on the new key. A cap doesn't prevent theft, but it limits how much a second leak can cost you while you're cleaning up.
5. Grep your own machine. Search your shell history, .env files, and any committed config for the old key. A key you rotated at the provider but left sitting in a repo is still a live problem for that repo.

Has OpenCode had security trouble before this?

Yes, and that's worth knowing before you decide how much trust to extend here. In January 2026, researchers disclosed CVE-2026-22812: versions of OpenCode before 1.0.216 started an unauthenticated local HTTP server on port 4096 that let any website or local process execute shell commands on your machine with zero authentication, no click required. OpenCode added CORS restrictions in 1.0.216 and disabled the server by default in 1.1.10, but it's still unauthenticated if you turn it back on.

Separately, OpenCode spent most of the first quarter of 2026 in a legal fight with Anthropic over OAuth spoofing. OpenCode had been sending headers that made Anthropic's servers think requests were coming from the official Claude Code client, so users could burn their Claude Pro or Max subscription quota inside OpenCode instead of paying for API access. Anthropic blocked it server-side in January, tightened its terms in February, and OpenCode pulled the integration by March after what its own commit log called "anthropic legal requests."

None of that caused this breach directly. But it's the same pattern twice: a fast-moving open-source tool shipping convenience features (an always-on local server, a way to reuse someone else's subscription, a hosted key vault) ahead of the security review those features deserve. If you've been treating OpenCode Console like a password manager for your AI keys, this is the year to stop.

How do you keep API keys safe in AI coding tools going forward?

A few habits that would have made this breach a non-event for you personally:

• Don't paste raw provider keys into any third-party console if you can avoid it. Keep keys in your own environment variables or a secrets manager you control, and point tools at them locally instead of uploading them to someone else's server.
• Use scoped, low-limit keys per project. Most providers let you create a key with a spend cap and limited model access. A leaked $20-cap key is an annoying Tuesday. A leaked unlimited key is a $400 problem.
• Rotate keys on a schedule, not just after headlines. Every 60-90 days is a reasonable default for anything connected to a coding agent.
• Watch for the HN crowd's workaround: run your own gateway. Tools like LiteLLM let you proxy requests to OpenAI, Anthropic, and others from infrastructure you control, so no third party ever holds your raw key at rest.
• Read what a tool actually does with your key before you trust it with billing access. "Add your API key here" is a convenience feature, and convenience features are exactly where breaches like this one happen.

If you're choosing between AI coding tools and security practices matter to you, it's worth comparing how each one handles keys before you commit, the same way you'd check how Claude Code's pricing and usage limits work before relying on it daily. And if OpenCode Console was your reason for routing spend through a middleman instead of paying providers directly, now's a fair time to revisit whether that tradeoff still makes sense given what it just cost some users.

For a broader view of where OpenCode sits next to the rest of the field, our roundup of the top AI coding tools is a decent starting point if you're shopping for an alternative.

FAQ

Official announcements