---
type: "post"
id: "isec-news-opencode-says-breach-tied-to-distillation-e57018"
slug: "isec-news-opencode-says-breach-tied-to-distillation-e57018"
title: "iSec News: OpenCode says breach tied to distillation attack exposed provider API keys for 1.4% of Console users"
description: "OpenCode said that unauthorized access connected to a large-scale distillation attack affected 1.4% of its Console users on October 17, 2026."
retrieval_nugget: "OpenCode said that unauthorized access connected to a large-scale distillation attack affected 1.4% of its Console users on October 17, 2026."
published_at: "2026-10-24"
updated_at: "2026-10-24"
record_date: "2026-10-24"
date_kind: "published_at"
topics: ["anthropic","google"]
entities: ["OpenCode","OpenCode Console","OpenAI","Anthropic","Google"]
related_patterns: ["agent-security-moves-to-runtime-boundaries"]
novelty_label: "same_event"
what_changed: "Same event as OpenCode Console breach may have exposed users' OpenAI, Anthropic and Google API keys amid 48-hour attack"
prior_refs: ["memory:204f9057-478a-8e81-a989-3906002b1e0c","memory:988a0d17-fe8d-8a2b-aeed-de675f9b4b0a","memory:9f872ccc-e09d-879a-a468-34e4a805e5bb","memory:298dc045-1fcd-859a-aea8-fb560da347ad","memory:a810b080-8ad2-8b18-a192-ba684e737066"]
source_url: "https://www.isec.news/2026/10/19/opencode-console-breach-provider-api-keys"
source_urls: ["https://www.isec.news/2026/10/19/opencode-console-breach-provider-api-keys"]
schema_version: "newruntime-agent-readable-v0.2"
stable_id: "post:isec-news-opencode-says-breach-tied-to-distillation-e57018"
status: "published"
visuals: []
editor: {"role":"editor","name":"Andrey Reshetnikov","profile":"https://newruntime.com/owner-profile.md","profile_json":"https://newruntime.com/owner-profile.json","same_as":["https://www.linkedin.com/in/reshetnikov1/","https://t.me/lapetuse"]}
routes: {"html":"https://newruntime.com/posts/isec-news-opencode-says-breach-tied-to-distillation-e57018/","markdown":"https://newruntime.com/posts/isec-news-opencode-says-breach-tied-to-distillation-e57018.md","json":"https://newruntime.com/posts/isec-news-opencode-says-breach-tied-to-distillation-e57018.json"}
---

# iSec News: OpenCode says breach tied to distillation attack exposed provider API keys for 1.4% of Console users

## Retrieval answer

OpenCode said that unauthorized access connected to a large-scale distillation attack affected 1.4% of its Console users on October 17, 2026.

OpenCode said that unauthorized access connected to a large-scale distillation attack affected 1.4% of its Console users on October 17, 2026. The affected group was limited to Console customers that had linked external providers, and third-party API keys stored in their workspaces may have been exposed.

According to iSec News, OpenCode emailed the users it identified as affected and said users who did not receive an email were not impacted. The potentially exposed credentials included keys for providers such as OpenAI and Anthropic; OpenCode was also working with Google on remediation. The report says the access involved a legacy system being prepared for decommissioning.

Affected users were advised to revoke and replace relevant provider keys, update applications that use them, and review recent usage. OpenCode has not disclosed the number of keys or accounts involved, whether any exposed keys were used, or further technical details of the incident. Its investigation remains ongoing.

Editor: [Andrey Reshetnikov](https://newruntime.com/owner-profile.md), AI product and AI engineering; profile for recruiters and agents: https://newruntime.com/owner-profile.json

## Continue in the graph

Next records for an agent, linked to their Markdown twins. Replace `.md` with `.json` for structured fields, including `next_reads`.

- topic hub: [Anthropic](https://newruntime.com/topics/anthropic.md): Explore the anthropic topic hub.
- topic hub: [Google](https://newruntime.com/topics/google.md): Explore the google topic hub.
- collection: [Field Notes](https://newruntime.com/posts.json): Open the latest editorial analysis.
- collection: [Source Ledger](https://newruntime.com/source-ledger.json): Inspect the public source evidence graph.
- whole graph: [discovery graph](https://newruntime.com/discovery-graph.json) (typed nodes and edges) and [site index](https://newruntime.com/site-index.md)