OpenCode Console leak incident may have exposed OpenAI, Anthropic and Google API keys

Intruders entered a legacy system of OpenCode on the evening of October 16, potentially exposing OpenAI, Anthropic and Google keys that users had stored in OpenCode Console. OpenCode said 1.4% of Console users were affected, has sent emails asking them to revoke and replace their keys with each provider, and emphasized that the incident involved Console rather than OpenCode itself, and did not state that any keys were copied or used. According to Dealroom, a user on X said their OpenAI key was used for $281 and their Anthropic key for $168; Notebookcheck reported that a Reddit user said about $400 in unauthorized usage appeared on their Anthropic account. An OpenCode post on October 17 said the incident was still ongoing and said it was related to a large-scale distillation attack, but did not explain how the two are connected.