OpenCode, the open source AI coding agent, has told users that a security breach affected 1.4% of OpenCode Console users, specifically those who had linked external AI providers such as Anthropic, OpenAI and Google. If anyone in your organization uses the Console with a linked provider, treat those provider API keys as exposed and rotate them now.
What happened
According to StepSecurity's write-up, OpenCode notified affected users by email on October 18, 2026, describing the incident as a large-scale distillation attack. StepSecurity quotes OpenCode's notice:
"We had a security breach last night related to a large scale distillation attack that impacted 1.4% of OpenCode Console users." (OpenCode, as quoted by StepSecurity)
StepSecurity stresses that the impact is limited to OpenCode Console users with linked external providers, not every user of the OpenCode CLI. At the time of its post the incident was described as ongoing. OpenCode had not published a root cause, affected versions, or a precise list of what data was exposed. We could not locate a public OpenCode advisory beyond the notification email that StepSecurity references.
StepSecurity's concern is the linked credentials themselves: an attacker holding a victim's provider key can run inference against that provider account, running up charges and potentially reaching any data that key can access.
Why it matters
AI provider API keys are non-human credentials, and they tend to be long-lived, personally issued and invisible to central IAM. A developer creates a key in a provider console, pastes it into a coding tool, and that tool (or its hosted service) becomes another place the secret lives. When a third-party service in that chain is breached, the owner of the key often has no inventory telling them where else it was used.
The "distillation" framing also matters. Bulk inference on someone else's account is a direct way to monetize stolen keys, so the first signal is likely to be a usage or billing spike rather than an alert from your security tooling. That puts provider usage dashboards, which security teams rarely watch, on the incident response path. Agent and coding tooling keeps accumulating standing secrets that nobody formally owns, and this incident is a reminder to inventory them before the next one.
What to check in your environment
- Find OpenCode installs. StepSecurity suggests checking developer machines for the binary on
PATH(which opencode, oropencode.exeon Windows),~/.opencode/bin/opencode, the~/.config/opencodedirectory, and~/.local/share/opencode/auth.json. Endpoint inventory or software asset tooling can do this at scale. - Locate stored provider credentials. StepSecurity gives the auth file location as
~/.local/share/opencode/auth.jsonon macOS and Linux and%USERPROFILE%\.local\share\opencode\auth.jsonon Windows. Have developers review which providers are linked there; the file contains secrets, so don't copy it into tickets or chat. - Confirm who got the notice. Ask OpenCode Console users whether they received OpenCode's October 18 notification email, and record which providers each one linked.
- Rotate linked keys. Rotate any Anthropic, OpenAI or Google API keys that were linked to OpenCode Console, then update the tools and pipelines that legitimately use them.
- Review provider usage. Check each provider's usage and billing dashboards for activity that doesn't match the key owner's normal pattern, and set spend limits or alerts where the provider supports them.
- Move keys under organizational control. Where possible, issue AI provider keys from organization-owned accounts with named owners, rather than personal accounts, so rotation and revocation don't depend on finding individual developers.
- Watch for updates. The incident is ongoing; revisit scope once OpenCode publishes a root cause or affected-data details.