CERT24OpenCode reported a security incident in which users’ API keys may have been exposedLoading data…
CERT24Threat Observatory
Period

OpenCode reported a security incident in which users’ API keys may have been exposed

OpenCode said attackers accessed a legacy system being decommissioned and may have obtained third-party API keys saved there by some OpenCode Console users. The affected users had saved OpenAI, Anthropic or Google keys; OpenCode said the incident affected 1.4% of Console users. Users reported unexpected provider spending, and OpenCode described the incident as a large-scale distillation attack. The company said the incident was ongoing on October 17, 2026.

← Back to intelligence

OpenCode reported a security incident in which users’ API keys may have been exposed

OpenCode said attackers accessed a legacy system being decommissioned and may have obtained third-party API keys saved there by some OpenCode Console users. The affected users had saved OpenAI, Anthropic or Google keys; OpenCode said the incident affected 1.4% of Console users. Users reported unexpected provider spending, and OpenCode described the incident as a large-scale distillation attack. The company said the incident was ongoing on October 17, 2026.