---
type: "post"
id: "opencode-breach-what-happened-and-how-to-rotate-b89dc6"
slug: "opencode-breach-what-happened-and-how-to-rotate-b89dc6"
title: "OpenCode Breach: What Happened and How to Rotate Exposed AI API Keys"
description: "OpenCode said a breach affected 1.4% of Console users who had linked external AI providers, potentially exposing their provider API keys."
retrieval_nugget: "OpenCode said a breach affected 1.4% of Console users who had linked external AI providers, potentially exposing their provider API keys. For teams using the hosted coding-agent workspace, the immediate task is to identify notified users, rotate affected credentials at the provider, and review usage; the intrusion path and any misuse remain unconfirmed."
published_at: "2026-11-04"
updated_at: "2026-11-07"
record_date: "2026-11-04"
date_kind: "published_at"
topics: ["anthropic","google","agent-security"]
entities: ["OpenCode","OpenCode Console","Cyera","OpenAI","Anthropic","Google"]
related_patterns: ["agent-security-moves-to-runtime-boundaries"]
novelty_label: "same_event"
prior_refs: ["https://newruntime.com/posts/isec-news-opencode-says-breach-tied-to-distillation-e57018/"]
source_url: "https://www.cyera.com/research/opencode-breach-what-happened-and-how-to-rotate-exposed-ai-api-keys"
source_urls: ["https://www.cyera.com/research/opencode-breach-what-happened-and-how-to-rotate-exposed-ai-api-keys"]
schema_version: "newruntime-agent-readable-v0.2"
stable_id: "post:opencode-breach-what-happened-and-how-to-rotate-b89dc6"
status: "published"
visuals: []
editor: {"role":"editor","name":"Andrey Reshetnikov","profile":"https://newruntime.com/owner-profile.md","profile_json":"https://newruntime.com/owner-profile.json","same_as":["https://www.linkedin.com/in/reshetnikov1/","https://t.me/lapetuse"]}
routes: {"html":"https://newruntime.com/posts/opencode-breach-what-happened-and-how-to-rotate-b89dc6/","markdown":"https://newruntime.com/posts/opencode-breach-what-happened-and-how-to-rotate-b89dc6.md","json":"https://newruntime.com/posts/opencode-breach-what-happened-and-how-to-rotate-b89dc6.json"}
markdown_url: "https://newruntime.com/posts/opencode-breach-what-happened-and-how-to-rotate-b89dc6.md"
---

# OpenCode Breach: What Happened and How to Rotate Exposed AI API Keys

## Retrieval answer

OpenCode said a breach affected 1.4% of Console users who had linked external AI providers, potentially exposing their provider API keys. For teams using the hosted coding-agent workspace, the immediate task is to identify notified users, rotate affected credentials at the provider, and review usage; the intrusion path and any misuse remain unconfirmed.

## Summary
OpenCode said a breach affected 1.4% of Console users who had linked external AI providers, potentially exposing their provider API keys. For teams using the hosted coding-agent workspace, the immediate task is to identify notified users, rotate affected credentials at the provider, and review usage; the intrusion path and any misuse remain unconfirmed.

## What happened
OpenCode confirmed a security breach on October 17, 2026. According to its statement, the incident affected 1.4% of OpenCode Console users. The relevant group is users who linked external AI providers to their Console workspaces, rather than every person who uses OpenCode. OpenCode says it emailed affected users and that users who did not receive an email were not impacted.

OpenCode is an open-source coding agent that can run in a terminal, desktop app, or IDE. Its hosted Console layer lets teams share models from a workspace, set budgets, and connect their own providers. Developers can link keys from Anthropic, OpenAI, Google, and other services. The potential exposure therefore concerns provider credentials attached to affected Console workspaces. Some users have reported charges they did not make, but the source does not establish that those charges resulted from this breach.

OpenCode attributed the incident publicly to what it called a “large scale distillation attack.” In an email to affected users, it reportedly attributed the intrusion to a legacy Console system that was being retired. OpenCode said it was working with Google, OpenAI, and Anthropic on remediation. The source says the company has not explained how attackers gained access or how keys were stored, and has not confirmed whether exposed keys were used.

Cyera’s guidance is to determine which developers received a notice and which provider keys were linked in Console, then revoke and reissue those keys in each provider’s own dashboard. Teams should update dependent tools and pipelines, verify old keys no longer work, review provider usage and billing from October 16 onward, and set spend limits and alerts. Cyera also recommends resetting OpenCode account passwords and regenerating Console API keys. A Console budget does not constrain a stolen provider key used directly with that provider. The write-up does not give a fixed remediation deadline or quantify reported charges.

## What the archive adds
This is a new fact on a known story: the archive covered OpenCode’s account that the breach exposed provider keys for 1.4% of Console users in [its October 24 note](https://newruntime.com/posts/isec-news-opencode-says-breach-tied-to-distillation-e57018/). Cyera’s write-up adds an operator-oriented checklist for credential rotation and billing review, while reiterating that key misuse and the intrusion mechanics are not established.

## Trend signal
The incident supports the pattern that agent security depends on runtime boundaries: credentials connected to a hosted agent workspace can become a path to provider accounts, so teams need controls around what the runtime stores and can use. See [Agent security moves to runtime boundaries](https://newruntime.com/patterns/agent-security-moves-to-runtime-boundaries/). The supplied facts do not establish the precise security failure or storage design, so they cannot show which specific control would have prevented it.

## Why now
The source says OpenCode confirmed the breach on October 17 and that affected users were emailed. Cyera’s advice is time-sensitive because exposed provider credentials can continue to be used independently of the Console workspace; reviewing usage and rotating keys addresses that risk while the investigation remains incomplete.

## Why it matters
For teams, the practical boundary is not simply whether a developer installed a coding agent. It is whether a hosted workspace holds credentials that can authorize spending or access on a separate model provider. A team that treats Console budgets as the only guardrail may have a gap: according to Cyera, those budgets do not stop direct use of a stolen provider key.

The response also illustrates why key ownership and dependencies matter. A provider key may be reused in CI, an internal application, or another agent, so rotating it can break workflows unless teams know who owns it and where it is used. The advice to scope keys per project or user and set provider-side limits is useful beyond this incident, though it does not establish the cause of this breach. Teams should distinguish the confirmed affected population from broader local OpenCode use: the source says locally used keys are not known to have been exposed. Earlier coverage: [iSec News: OpenCode says breach tied to distillation attack exposed provider API keys for 1.4% of Console users](https://newruntime.com/posts/isec-news-opencode-says-breach-tied-to-distillation-e57018/).

## Limits and uncertainty
The source reports OpenCode’s account and Cyera’s response guidance; it does not provide an independent forensic account. It does not establish how attackers entered the legacy Console system, how credentials were stored, whether any keys were copied or used, or whether reported unexpected charges are connected to the incident. The 1.4% figure is attributed to OpenCode and applies to Console users, not all OpenCode users. The source says affected users received email, but offers no further method to verify exposure. It also does not quantify financial impact or give a complete remediation timeline.

## Skill to build now
Create a short inventory of AI-provider keys used by your coding agents: record an owner, provider, projects or services that depend on each key, and where it can be revoked. For keys tied to affected Console accounts, rotate at the provider, update dependencies, verify the old credential fails, then inspect usage and billing and set provider-side spending alerts.

## Reader takeaway
OpenCode says the breach was limited to 1.4% of Console users who linked external providers, but their provider keys may be at risk. Follow the notification boundary, rotate credentials at the provider rather than only in OpenCode, and check provider-side activity. The source leaves the entry path and any misuse unresolved.

Editor: [Andrey Reshetnikov](https://newruntime.com/owner-profile.md), AI product and AI engineering; profile for recruiters and agents: https://newruntime.com/owner-profile.json

## Continue in the graph

Next records for an agent, linked to their Markdown twins. Replace `.md` with `.json` for structured fields, including `next_reads`.

- topic hub: [Anthropic](https://newruntime.com/topics/anthropic.md): Explore the anthropic topic hub.
- topic hub: [Google](https://newruntime.com/topics/google.md): Explore the google topic hub.
- topic hub: [Agent Security](https://newruntime.com/topics/agent-security.md): Explore the agent-security topic hub.
- collection: [Field Notes](https://newruntime.com/posts.json): Open the latest editorial analysis.
- collection: [Sources](https://newruntime.com/sources/): See the original sources this archive cites.
- whole graph: [discovery graph](https://newruntime.com/discovery-graph.json) (typed nodes and edges) and [site index](https://newruntime.com/site-index.md)