On October 17, OpenCode announced an intrusion involving a legacy system and affecting 1.4% of OpenCode Console users. Access keys for AI providers that some users had saved in their workspaces may have been exposed. OpenCode says it emailed users it identified as affected.
The incident concerns Console, its hosted service, not the open source app or command-line tool, according to OpenCode. The cause of the intrusion, exact number of keys and any unauthorized use have not been publicly established.
What OpenCode announced
OpenCode described the event as an intrusion into a legacy system and linked it to a “large scale distillation attack.” The company said 1.4% of Console users were affected and that it had emailed them. This figure alone does not identify the number of accounts or provider keys involved.
The keys at issue are those teams saved in Console workspaces to use third-party services. Keys kept locally and never saved in Console are not identified as exposed in the notices reviewed.
Why an API key needs a quick response
An API key lets software access a service on its owner’s behalf. Someone who obtains one may be able to make requests and incur charges, depending on its permissions and limits. Scope varies by provider and key; possible exposure does not prove that it was used.
TechCrunch reports that some users described unexpected charges. OpenCode said it could not confirm unauthorized use of the keys. Check activity and costs in the relevant provider dashboards instead of assuming every key was used.
Check and replace the keys
If your team received a notice or saved keys in OpenCode Console, revoke affected keys in the AI provider consoles and create replacements. Update any scripts, tools or environments that used them. Removing a value from Console does not ensure the provider has revoked it.
Review usage since October 16 for unusual spikes, unexpected models or regions, and calls outside normal hours. Set usage alerts and limits appropriate to each project. Preserve useful information before removing an integration during the investigation.
Distinguish Console from the local app
OpenCode says its app and command-line tool were not affected. The affected area was Console, where external provider keys could be saved in hosted workspaces. This distinction prevents the incident from being generalized to every installation or to keys that were never connected to Console.
If you do not know whether a key was saved in a workspace, check with the account administrator and provider. A targeted rotation resolves uncertainty about that key without changing passwords for unrelated services.
Soclyde’s connection
API keys and passwords are secrets that grant access to resources. Soclyde lets a team keep and share its own secrets in an encrypted vault on its devices. This can help control who knows a key and where it is used, but it cannot revoke a key with a provider or replace usage logs.
What to remember
OpenCode says the intrusion affected 1.4% of Console users and provider keys saved in affected workspaces may have been exposed. Revoke them in provider consoles, update dependent systems and review usage. To organise team access, read our guide to creating secure passwords.
