OpenCode Says a Security Incident Hit About 1.4% of Console Users

OpenCode says a security incident has affected about 1.4% of OpenCode Console users. In a post on X at 02:08 Beijing time on October 18, the company said it had "a security breach last night related to a large scale distillation attack." Both "breach" and "large scale distillation attack" are OpenCode's own words, and the company hasn't explained what the attack involved.

Who is affected

According to OpenCode, the affected users were a subset of Console users who had external providers linked to their accounts. The company says it has already notified all of them by email, and that anyone who didn't get an email was not impacted. OpenCode added that sentence when it edited the post 12 minutes after first publishing it at 01:56 Beijing time. The company gave a percentage but not the number of users behind it.

The incident is still ongoing, and OpenCode says it can't share more details at this point. It adds that it is "working with Anthropic, OpenAI, and Google to remediate." OpenCode's public post on X doesn't say whether any keys were exposed. But according to Notebookcheck, OpenCode's email to affected users said someone had gained unauthorized access to a legacy system it was decommissioning, and that third-party provider keys stored in users' workspaces, including OpenAI and Anthropic keys, may have been exposed. It also reports that some Reddit users described unexplained charges on their provider accounts.

According to Notebookcheck, OpenCode's email also asks affected users to revoke and replace their provider keys, update any applications that use them, and review recent usage for unexpected activity.

What Anthropic and OpenCode staff have said

Staff at both companies have also posted on their personal accounts; these are not official company statements. At 05:04 Beijing time, Lydia Hallie, a member of Anthropic's Claude Code team according to her X bio, quoted OpenCode's post: "We've been working with OpenCode on yesterday's breach and have revoked Claude API keys we believe were affected." She added that anyone who saved a key in OpenCode and wants to be extra careful should create a new one.

At 05:38, Dax (@thdxr), whose bio says he builds OpenCode at Anomaly, replied to her: "note this is the OpenCode Console, not OpenCode itself, those keys never come to us." He didn't elaborate, but our reading is that he was separating the two products: keys typed into the local OpenCode tool don't pass through OpenCode's servers, unlike keys stored in OpenCode Console. In a later reply, he said OpenCode had already contacted everyone affected and refunds were already underway, and that he was still asking people to email only in case someone had missed OpenCode's email.

We'll update this article when OpenCode shares more details.