OpenCode Discloses Security Breach, Says Attackers May Have Accessed Users’ OpenAI, Anthropic And Google API Keys

OpenCode, the open-source AI coding agent that lets developers plug their own API keys from OpenAI, Anthropic, Google and dozens of other providers into a single terminal-based tool, has disclosed a security breach that it says exposed a subset of its users’ provider credentials. In a statement posted to its community and in emails sent to affected customers on the morning of October 18, OpenCode said it had “identified unauthorized access to a legacy system” that was in the process of being decommissioned, and that “third party provider keys (eg OpenAI, Anthropic) saved in your workspace may have been exposed.” The company is describing the incident as a “large scale distillation attack” that impacted roughly 1.4% of OpenCode Console users, and says it has notified everyone affected individually by email.