OpenCode Console
An optional hosted service from OpenCode that supports workspace storage of BYOK (bring your own key) and invokes AI providers through a gateway, so team members do not need direct access to keys.
Core Facts
Older versions of the OpenCode Console may have leaked keys from providers such as OpenAI, Anthropic, and Google.
OpenCode experienced a security incident related to a large-scale distillation attack, affecting 1.4% of OpenCode Console users, mainly some accounts connected to external model providers.
Timeline (last 90 days)
The attack occurred at night, and intruders used API keys stored in Console to call the APIs of major AI providers, incurring unauthorized charges, with some developers' bills ranging from hundreds to thousands of dollars.
OpenCode disclosed on October 17, 2026 that an intruder accessed a legacy system on the evening of October 16, and that provider API keys stored in OpenCode Console may have been leaked.
About 1.4% of OpenCode Console users were affected, and all affected users had linked an external provider.
Console is OpenCode's optional hosted service that allows a workspace to store its own OpenAI, Anthropic, or Google keys and call providers through Console, so team members do not need to handle the keys directly (BYOK mode).
According to The Hacker News, removing a key from the Console does not revoke it, and Console budgets cannot limit usage outside the Console's own gateway.
Open-source AI coding tool OpenCode disclosed a security incident: a legacy system being decommissioned was accessed without authorization, about 1.4% of OpenCode Console users were affected, and third-party AI service API keys may have leaked.
OpenCode framed the scope of impact as "1.4% of OpenCode Console users," specifically the subset that had linked external providers.
OpenCode experienced a security incident related to a large-scale distillation attack, affecting 1.4% of OpenCode Console users, mainly some accounts connected to external model providers.
Older versions of the OpenCode Console may have leaked keys from providers such as OpenAI, Anthropic, and Google.
All Facts (9)
Older versions of the OpenCode Console may have leaked keys from providers such as OpenAI, Anthropic, and Google.
65%Partially VerifiedOpenCode experienced a security incident related to a large-scale distillation attack, affecting 1.4% of OpenCode Console users, mainly some accounts connected to external model providers.
65%UnverifiedConsole is OpenCode's optional hosted service that allows a workspace to store its own OpenAI, Anthropic, or Google keys and call providers through Console, so team members do not need to handle the keys directly (BYOK mode).
50%UnverifiedAccording to The Hacker News, removing a key from the Console does not revoke it, and Console budgets cannot limit usage outside the Console's own gateway.
50%UnverifiedAbout 1.4% of OpenCode Console users were affected, and all affected users had linked an external provider.
50%UnverifiedOpenCode framed the scope of impact as "1.4% of OpenCode Console users," specifically the subset that had linked external providers.
50%UnverifiedThe attack occurred at night, and intruders used API keys stored in Console to call the APIs of major AI providers, incurring unauthorized charges, with some developers' bills ranging from hundreds to thousands of dollars.
50%UnverifiedOpenCode disclosed on October 17, 2026 that an intruder accessed a legacy system on the evening of October 16, and that provider API keys stored in OpenCode Console may have been leaked.
50%UnverifiedOpen-source AI coding tool OpenCode disclosed a security incident: a legacy system being decommissioned was accessed without authorization, about 1.4% of OpenCode Console users were affected, and third-party AI service API keys may have leaked.
50%