OpenCode Breach: What Happened to Users' AI Keys and What to Do Now

On October 17, 2026, OpenCode said it had a security breach the night before. The OpenCode breach hit 1.4% of OpenCode Console users, who may have lost the keys they use to pay for AI. A few saw surprise charges before they knew why.

The worry is simple. A stolen AI key lets a stranger run up charges on your account until you switch it off, and OpenCode has not said how many keys were taken.

Here is what is known, what is still unclear, and what to do if your key was in OpenCode Console.

What Happened in the OpenCode Breach

The OpenCode breach reached the public on October 17, 2026, first through users and then through OpenCode's own post saying 1.4% of Console users were hit.

OpenCode is a popular open source coding agent (an AI helper that writes and runs code for you). In its post on X, the company wrote: "We had a security breach last night related to a large scale distillation attack that impacted 1.4% of OpenCode Console users."

The post added that it "was a subset of users who had external providers linked." An API key is the secret code that lets an app use your paid AI account, so these were the people who had saved such keys.

Users shared the email they got. It said OpenCode found "unauthorized access to a legacy system that we were in the process of decommissioning." It told them to replace their keys, update their apps, and check recent usage.

• OpenCode first posted at 17:56 UTC and posted a fuller version at 18:08 UTC, which had more than 2.8 million views by October 20.
• OpenCode said it was working with Anthropic, OpenAI and Google to fix the problem, and that "The incident is ongoing so we cannot share more details at this point."
• At 15:30 UTC, before OpenCode posted in public, security news writer Matt Johansen posted "Confirmed. OpenCode hacked. Keys stolen."
• Lydia Hallie of Anthropic wrote on October 17 that "We've been working with OpenCode on yesterday's breach and have revoked Claude API keys we believe were affected" (switched them off).
• On October 19, Thibault Sottiaux of OpenAI (his X bio says Codex and ChatGPT) wrote: "Our team worked with OpenCode to have their users who are also OpenAI API customers back in business and any credits refunded which would have been drawn in the attack."
• When we checked again on October 20, OpenCode still had no blog post, status page note or full report on the breach, and Google had made no public statement.

Who the OpenCode Breach Hit, and Who It Did Not

OpenCode says the breach hit only the 1.4% of Console users it emailed, and that anyone who got no email was not affected.

OpenCode Console is an optional web service from the same company. Its docs say teams can connect AI accounts they already pay for, such as Anthropic or OpenAI, by pasting in the key. The docs then say: "Console stores the credential and serves each provider through its gateway."

A gateway here is a middle server that passes requests on to the AI company. Console held users' keys on its side. The email says only that those keys "may have been exposed," so OpenCode has not confirmed that every key was taken.

Dax Raad, who builds OpenCode, wrote on X: "this is the OpenCode Console, not OpenCode itself, those keys never come to us."

• OpenCode has not said how many people the 1.4% is.
• Datadog Security Labs says the agent has 16 million monthly users, citing OpenCode's website, but no Console figure is public.
• OpenCode has not said how the access happened, how long the access lasted, or how the keys were stored.
• The email names OpenAI and Anthropic keys as examples, while some news reports also mention Google keys.
• Dax Raad wrote in a reply on October 18 that "refunds are already underway." An OpenAI team member says OpenAI worked with OpenCode to have any credits drawn in the attack refunded for OpenAI API customers, but no amounts have been shared. We found no public word from Anthropic or Google about refunds.

What the Distillation Attack Label Means

A distillation attack is when someone pulls huge numbers of answers from a strong AI model to train a copy, and Anthropic says three labs used about 24,000 fake accounts to do it.

Anthropic describes distillation as "training a less capable model on the outputs of a stronger one." In its February 2026 report, it said those three labs ran over 16 million exchanges (questions and answers) with Claude.

Stolen keys can feed this kind of copying. Anthropic's September 2026 threat report says distillation done without permission usually runs on fake accounts made with stolen credit cards, logins and API keys. Nobody has shown that this is what happened to the OpenCode keys.

OpenCode never explained the link. AI researcher Nathan Lambert wrote: "There's something very odd going on with 'distillation' if a cyber attack to steal api keys is looped under the same term." Security firm Cyera wrote that "No one has publicly attributed the OpenCode attack."

• Security researcher Dylan (@InsecureNature) replied that "Distillers need a ton of keys to generate a ton of data."
• The email that users shared never used the word "distillation."
• On Hacker News, some said the stolen keys could just as well be resold.
• On October 12, Anthropic said early evidence shows its new defenses cut the data taken by distillers by "around 90 to 99%."

What Users Said About the OpenCode Breach

Some of the earliest signs came from users watching their bills, with one user reporting $281 of OpenAI use and $168 of Anthropic use in a single night.

That user, Colin Parsons, wrote on X that both keys "are only used in opencode; none of my other openai / anthropic keys have been hit." Chris Sinco, who says in his X bio that he designs Android developer tools, wrote that his "Open AI, Anthropic, and Google AI spend alerts all fire off before going to bed."

Analyst Max Weinbach said he was hit too. He wrote: "My OpenAI and Anthropic balances got drained, Google account got limited and drained a bit and OpenCode did email me."

The anger on Hacker News was mostly about trust. One commenter said saving a key in Console was like "handing your password" to someone else. Another said the team "did a terrible job of communicating this," because Console and the coding agent share one name and the notice did not tell them apart.

• A Hacker News user said Anthropic emailed that their $20 of monthly API credits was used up.
• Dax Raad posted "my personal accounts are being attacked now too" and "whole new world with ai powered hacking." On October 18 he wrote that "they've been non stop trying to attack our systems for the past 48 hours." He added "we basically need agents going 24/7 because that's what they have." He did not say who "they" are.
• One Hacker News reader defended the team and said the word "distillation" may only describe what the attackers wanted.
• These are user reports. OpenCode has confirmed none of the amounts and shared no total.

Is OpenCode Safe to Use After the Breach

Dax Raad, who builds OpenCode, says the breach was in OpenCode Console, not in the coding agent on your computer, but the agent has had at least two serious public bugs of its own in 2026.

In January, a bug tracked as CVE-2026-22812 (a public ID for a known security bug) let any website or local program run commands on a user's computer. It scored 8.8 out of 10 for severity and was fixed in version 1.0.216.

In September, Datadog Security Labs published a second remote code bug (one that lets an outsider run commands on your machine if you run OpenCode's local web server, for example by visiting a bad web page). It was fixed in version 1.18.22 in August. Datadog counted more than 647,000 npm downloads of the affected versions from September 17 to 23, though that does not show how many people were exposed.

Both bugs are fixed in current versions, so updating matters. The October breach was in the hosted service, Console, not in the agent.

• OpenCode's own security notes say it does "not sandbox the agent" (it does not wall it off from the rest of your computer).
• Datadog says "Anomaly chose not to request a CVE" for the second bug; Anomaly is the company behind OpenCode.
• Datadog says it reported the second bug on August 11, and the fix shipped on August 24.
• Give the agent only the folders and keys a task needs, since it can run commands and change files on your computer.

What to Do If Your Key Was in OpenCode Console

If you ever pasted an AI key into OpenCode Console, switch that key off at the AI company today, make a new one, and set a hard spending limit.

Deleting the key inside OpenCode does not stop a copy that someone may already have. The key has to be switched off at the AI company that issued it. Anthropic's key safety guide warns that putting your key in a third party tool gives "the developer of that tool access to your Claude Console account."

Google's Gemini key guide gives a short leak checklist: make a new key, update your app, disable the old key, and check billing logs.

OpenAI's docs say to revoke a compromised key "promptly and replace it with a new key." Spending alerts alone will not stop the charges, and the same docs say plainly that "Spend alerts do not enforce a cap." At OpenAI and Anthropic, a hard limit makes requests fail once you reach it, so turn that on. Google's Gemini API has a monthly spend cap, but Google says it is experimental and can run over by around 10 minutes of spending.

• Anthropic: open the Claude Console, go to API keys, and choose Delete API Key on the old one.
• Google Cloud: open Credentials, pick the key and click Rotate key, then delete the old one.
• Check each provider's usage page for calls you did not make.
• OpenCode is not the first AI middle layer to put keys at risk. In March 2026, a backdoored version of the LiteLLM AI proxy stole keys from company build systems, as our LiteLLM supply chain breach report explains.

How Elephas Keeps Your Questions and Personal Details Safer

Elephas avoids the problem that hit OpenCode Console, because your own API key's requests go straight to your AI company, and it adds an extra layer on top by hiding personal details such as names, email addresses and phone numbers before a question goes to the cloud.

Image: elephas.app/security, captured October 18, 2026.

In OpenCode Console, users pasted their AI keys into a hosted service. That service kept the keys and sent requests to OpenAI or Anthropic for them. So when its old system was broken into, the saved keys may have been exposed.

Elephas is private AI for your documents on Mac. It answers questions from your own files, which stay stored on your computer, and every answer cites the files it came from. Here is how it handles your questions and your data.

Your own key goes straight to your AI company

When you add your own API key to Elephas, your questions go straight to the AI company you picked. They never pass through an Elephas server, so Elephas cannot see them, and your provider's terms decide what it keeps. There is no middle server holding your requests that someone could break into.

Personal details are hidden from the AI company

This is the extra layer. Whichever AI you choose, such as OpenAI (the company behind ChatGPT), Claude, Gemini, Mistral or DeepSeek, Elephas first finds names, email addresses and phone numbers on your Mac and swaps them out. Then it sends the question and puts the real details back in the answer.

So the AI company gets your question with those details hidden. This works by detection, so it can miss things and works best in English, which is why you can see what was hidden under every answer and add your own protected names.

Elephas AI, with no key needed

You do not need an API key at all. Elephas AI comes with the trial and every plan. It runs open source models in Elephas's own cloud, and your questions and answers are not stored, not used to train AI, and not shared with the model makers. Personal details are hidden on this route too.

A local model that sends nothing

For the most private work, download a local model once and Elephas answers on your own computer. There is no key to leak and nothing is sent anywhere.

Built for teams too

The new Elephas also works for teams. A team shares Team Brains (shared sets of documents), gives each person a role such as manager, contributor or reader, and syncs with end to end encryption. On the Team plan, cloud answers come through Elephas AI, and the owner decides whether members can use the on-computer model.

• Your own key works with OpenAI, Claude, Gemini, Groq, Mistral, xAI, DeepSeek, OpenRouter and others, on the trial, Personal and Professional plans.
• The local model is a one-time download of about 1.3 to 5.7 GB. Our guide to local and cloud AI compares the two.
• Plans start at $19 a month, Team costs $29 per person a month, and there is a 7-day free trial with no card.
• Elephas runs on Macs with Apple Silicon and macOS 14 or later, and Windows is coming soon. Try Elephas.

Conclusion

The OpenCode breach shows that an AI key is only as safe as the least careful place that holds it.

OpenCode still owes its users a full account: how many people were hit, how the attacker got in, and how the keys were kept. Until then, replace any key you saved in OpenCode Console and cap what it can spend.

• Before you paste a key into any hosted AI tool, look for where it says the key is stored.
• Compare other cases in our list of AI security incidents.
• With Elephas, your own key's requests skip any middle server, and Elephas hides personal details before a question leaves your computer.

Written by

Selvam Sivakumar

Founder, Elephas.app

Selvam Sivakumar is the founder of Elephas and an expert in AI, Mac apps, and productivity tools. He writes about practical ways professionals can use AI to work smarter while keeping their data private.

LinkedInFollow