Markdown edition

# OpenCode reports breach affecting 1.4% of Console users

> OpenCode says a breach affected 1.4% of Console users. Its founder separated hosted Console provider keys from local OpenCode credentials; affected owners should check their provider accounts.

By BIG CHANGE Editorial

Published: 2026-10-19T10:40:34.843Z
Updated: 2026-10-19T10:40:34.843Z
Canonical: https://bigchange.ai/blog/opencode-console-breach-provider-keys

![Charcoal illustration of several metal keys hanging in a wall-mounted key cabinet and one separate key on an orange loop resting on a ledge.](https://bigchange.ai/api/media/file/opencode-console-key-custody-concept-v1.png)
AI-generated conceptual illustration by BIG CHANGE; no actual OpenCode system, credential or breach is depicted.

OpenCode said on October 17 that a security breach the previous night affected 1.4% of OpenCode Console users. The company said it emailed those affected. Its public post identifies the group as a subset with external providers, but the accessible text ends mid-sentence; it gives no complete list of providers or keys. For a Console owner, the relevant distinction is where a provider credential was stored.

## The big change

- **What changed:** OpenCode disclosed a breach involving a subset of its hosted Console users. Console can hold credentials for external AI providers and send requests through its gateway, so a Console connection creates a different custody path from a provider account saved in the local OpenCode CLI.
- **Why it matters:** A provider key can authorize requests billed by the provider. An owner who connected one through Console has to check the issuing provider's usage and replace a key they determine was exposed; changing a Console setting alone does not revoke a provider-issued credential.
- **What to watch:** OpenCode's email notice is the most specific scope signal it has publicly described. The accessible statement does not identify individual affected providers or keys. The founder's October 18 security update gives no account of the incident's state on October 19.

## What OpenCode disclosed

In its [October 17 statement](https://x.com/opencode/status/2111519637049319818), OpenCode described a security breach the previous night as related to a “large scale distillation attack.” It reported that 1.4% of *Console users* were affected and that it had notified them by email that morning. The visible public embed says the group was a subset of users with external providers, then truncates. The figure is OpenCode's account of Console users, not a measured share of every OpenCode installation or local provider key.

OpenCode founder Dax [clarified later on October 17](https://x.com/thdxr/status/2111572618340188393) that he meant “the OpenCode Console, not OpenCode itself,” adding that locally held keys “never come to us.” In an [October 18 post](https://x.com/thdxr/status/2111790511409258796), he said attackers had been trying to attack the company's systems for the preceding 48 hours and that the company was hardening them. That dated account does not establish whether attempts continued on October 19. The public posts reviewed here do not identify an attacker, enumerate affected credentials or substantiate a loss amount.

## Which credentials have the Console custody path

OpenCode's [Console provider documentation](https://dev.opencode.ai/v2/docs/console/providers) says an owner or admin can enter a key for a provider account that the workspace already pays for. Console stores that credential and adds it to requests sent through its gateway; workspace members can use enabled models without seeing the provider key. The documentation names Anthropic, OpenAI and other services as *available connections*. That catalogue is not an incident-specific list of affected providers.

The [CLI provider documentation](https://dev.opencode.ai/v2/docs/cli/providers/) describes a separate route. A locally saved API key or OAuth account lives in the local server's SQLite database; an environment connection is read from the server process without being saved as an account. Those instructions describe credential storage and support the founder's distinction, but they are not a forensic audit of every installation. A developer can use both local and Console connections, so each credential should be identified by where it was entered.

## What an affected owner can check

An owner or admin who received OpenCode's notice should identify the external provider connections in the Console **Providers** tab and match each one to the issuing provider's account. Revoke a credential considered exposed at the issuing provider, generate a replacement there, then [enter the new credential on the Console provider page](https://dev.opencode.ai/v2/docs/console/providers). OpenCode's docs say clicking the credential there rotates the saved Console value. Disabling a model or removing a Console connection governs access through Console; the issuing provider controls the provider key itself.

The owner can also review the issuing provider's usage and billing records for requests they do not recognize. OpenCode's documentation says the provider bills for connected-provider tokens and Console records each request and its estimated cost. Those records can help reconcile activity; this article has no access to an affected account's logs or charges. Anyone uncertain about their notice or connection history can ask OpenCode directly.

## Sources & further reading

- [OpenCode's incident statement](https://x.com/opencode/status/2111519637049319818), October 17, 2026. The public embed reports a breach the previous night, the company's 1.4% Console-user figure and email notification; its last sentence is truncated in the accessible text.
- [Dax's Console and local-key clarification](https://x.com/thdxr/status/2111572618340188393), October 17, 2026. Distinguishes Console from local OpenCode use. It is a founder statement, not an independent technical audit.
- [Dax's security update](https://x.com/thdxr/status/2111790511409258796), October 18, 2026. Describes attacks over the preceding 48 hours and hardening as of that post; it does not establish later activity.
- [Console provider documentation](https://dev.opencode.ai/v2/docs/console/providers), OpenCode, undated, read October 19, 2026. Explains hosted credential custody, workspace administration, key replacement and provider billing. Its catalogue is not a breach inventory.
- [CLI provider documentation](https://dev.opencode.ai/v2/docs/cli/providers/), OpenCode, undated, read October 19, 2026. Describes local saved accounts and environment credentials. No installation was examined for this article.
- [OpenCode repository security policy](https://github.com/anomalyco/opencode/security), undated, read October 19, 2026. Provides the project's reporting route for a security issue; it is background policy, not an incident report.

## Sources

- [OpenCode incident statement](https://x.com/opencode/status/2111519637049319818) — Official public embed reports a breach the previous night, 1.4% of Console users and affected-user email notification. Its final sentence is truncated; no unseen scope detail is used.
- [Dax on Console and local keys](https://x.com/thdxr/status/2111572618340188393) — Founder's public clarification distinguishes Console from OpenCode itself and says local keys do not come to the company; it is not an independent forensic audit.
- [Dax security update](https://x.com/thdxr/status/2111790511409258796) — Founder reports attack attempts over the preceding 48 hours and hardening as of October 18. No inference about October 19 activity.
- [Console providers](https://dev.opencode.ai/v2/docs/console/providers) — Official hosted provider credential custody, admin controls, rotation entry point and provider billing. Catalogue is not an affected-provider list.
- [CLI providers](https://dev.opencode.ai/v2/docs/cli/providers/) — Official local saved-account and environment credential storage; describes configuration, not this incident's forensic scope.
- [OpenCode repository security policy](https://github.com/anomalyco/opencode/security) — Project security reporting route and threat-model background; no incident-specific finding.