Md Ismail Šojal 🕷️(@0x0SojalSec):Your OpenCode API keys may have been drained OpenCode confirmed a large-scale distillation attack hit 1.4% of Console users who linked external providers. a legacy system they were shutting down. Third-party API keys (OpenAI, Anthropic, Google, etc.) stored in Console/Workspace may have been exposed. via a legacy system. Affected users (1.4% of Console with linked providers) are reporting unauthorized charges from $10 to $400+ overnight. If you ever saved keys in OpenCode cloud: - Immediately revoke them on OpenAI, Anthropic, Google dashboards - Don’t wait for OpenCode - Check your billing and usage right now Local CLI-only users with keys only in local files are not affected.

2026.10.17 20:44

Your OpenCode API keys may have been drained OpenCode confirmed a large-scale distillation attack hit 1.4% of Console users who linked external providers. a legacy system they were shutting down. Third-party API keys (OpenAI, Anthropic, Google, etc.) stored in Console/Workspace may have been exposed. via a legacy system. Affected users (1.4% of Console with linked providers) are reporting unauthorized charges from $10 to $400+ overnight. If you ever saved keys in OpenCode cloud: - Immediately revoke them on OpenAI, Anthropic, Google dashboards - Don’t wait for OpenCode - Check your billing and usage right now Local CLI-only users with keys only in local files are not affected.

OpenCode@opencode

2026.10.17 18:08

We had a security breach last night related to a large scale distillation attack that impacted 1.4% of OpenCode Console users We have notified them all this morning via email. If you did not get an email you were not impacted, it was a subset of users who had external providers linked The incident is ongoing so we cannot share more details at this point but we are working with Anthropic, OpenAI, and Google to remediate