Talk:OpenCode
Add topicLatest comment: 13 days ago by Peterwwillis in topic Company hacked, users affected
Company hacked, users affected
[edit]Hi there, I am not a normal user or contributor, and I don't really know the right way to contribute to this page. I've tried to contribute in the past and my edits I guess weren't accepted or something? So I'm opening this on Talk so hopefully someone who knows how to edit can get this into the page in the right way.
The OpenCode LLM-provider service was hacked recently, and leaked API keys resulted in users' AI credits (money) being used. Company confirmed it. Seems like it's worth adding to the page somewhere.
Summary:
- On October 16th, 2026, a large-scale distillation attack hit 1.4% of OpenCode's Console users, exposing third-party API keys from providers like OpenAI and Anthropic, via an OpenCode legacy system. OpenCode teamed up with OpenAI, Anthropic, and Google for fixes. Users were urged to rotate keys and check their AI bills immediately.
It's still a pretty new incident, so more official details are still pendding, but that much information came from OpenCode directly in both tweets and emails (see below) and other users have confirmed it.
Sources:
- https://x.com/opencode/status/2111519637049319818
- https://techcrunch.com/2026/10/19/hackers-hit-ai-coding-tool-opencode-running-up-charges-on-users-ai-accounts/
- https://www.notebookcheck.net/OpenCode-hacked-users-urged-to-revoke-their-API-keys.1426957.0.html
- https://www.reddit.com/r/opencode/comments/1x8bas3/they_fd_up_breach/ | https://www.reddit.com/r/opencode/comments/1x8gtvi/opencode_security_breach/
- https://www.youtube.com/watch?v=wjmzAiK_xis
- https://cybersecuritynews.com/opencode-security-breach/
