OpenCode console breach may have exposed users' API keys
The OpenCode console was breached on October 17, 2026, affecting about 1.4% of console users who had connected external AI providers. AI API keys stored in workspaces may have been exposed, and the attacker incurred charges on users' AI accounts. The open-source app and command-line tools were unaffected.
Key facts
- Affected organization
- OpenCode
- Incident type
- Data breach
- Occurred / detected
- 2026-10-17
- Scale of damage
- About 1.4% of console users affected and charges incurred on AI accounts
- Cause / method
- Possible exposure of AI API keys through a console breach
- Location
- Other countries
If your data was exposed
- Don’t tap links in texts, calls or emails that mention this incident and offer compensation, refunds or breach checks. Check directly on the organization’s official website or app.
Timeline
- The OpenCode console was breached.
- The possible exposure of AI API keys and charges incurred on users' AI accounts became known.
- An explanation was released stating that about 1.4% of console users were affected and that the open-source app and command-line tools were unaffected.
7 related reports
- OpenCode Console Breach May Have Exposed OpenAI, Anthropic, and Google API Keys
- Hackers hit AI coding tool OpenCode, running up charges on users’ AI accounts
- OpenCode Console Breach (October 2026, 1.4% of Console Users): AI Provider API Keys Possibly Exposed, and What to Do
- Ransomware Claims Hit 1,127 in October, Up 25.8% [2026]
- October 30th, 2026 Data Security Incident
- Update on October 2026 security incident
- 「AIでサイバー攻撃を防ぐ」ってこういうことなんだ
The summary and key facts are written by AI from related reports and may contain errors. Check the original articles and the organization’s official statements for accurate details.