opencode

OpenCode says it has been hacked and that user credentials were leaked. The startup confirmed the breach via its official account, and the news is drawing attention on developer forums, where users are asking what data was exposed and whether they need to change passwords. Details about the scale of the breach and how it happened have not yet been made clear.

A security breach affecting OpenCode has been reported, with a distillation attack said to have hit Console users who had linked AI providers to their accounts. Security guidance is circulating on how to locate OpenCode installations on developer machines and what response steps to take. Developers are being urged to check their systems and review connected AI provider credentials.

OpenCode has disclosed a security breach that impacted 1.4% of its console users. The company announced the incident via an official statement, confirming the limited scope of the compromise. Discussion is focused on how the breach occurred, what data was affected, and whether the response was adequate.

A security breach at OpenCode has exposed the third-party API keys of users of its console, raising concerns that attackers could abuse the leaked credentials to access paid services or sensitive accounts. The incident highlights the risks of platforms storing or handling external API credentials on behalf of their users.

A security breach involving the OpenCode console may have exposed API keys belonging to OpenAI, Anthropic, and Google, according to a report by The Hacker News. If confirmed, the leak could allow unauthorized access to the AI companies' services and customer accounts. Details about the scale of the breach and how the keys were compromised remain limited.

Security researchers warn that OpenCode, an AI coding tool, quietly fixed a critical remote code execution vulnerability without publicly disclosing the flaw or informing users. The undisclosed patch means people running older versions may remain exposed to attacks that allow arbitrary code execution, and researchers argue the company's lack of transparency leaves the open-source community unable to assess their risk.

Security outlet SC Media reports that OpenCode has suffered a breach in which attackers used a distillation-style technique to expose users' API keys. The incident raises concerns about how AI development tools store and protect the credentials developers entrust to them. Exposure of API keys can allow attackers to run up charges on victims' accounts or access cloud services. Further details on the number of affected users and the response have not yet been reported.

Hackers compromised OpenCode, an AI-powered coding tool, and used it to run up unauthorized charges on users' connected AI accounts. The incident has raised concerns about the security of developer tools that link to paid AI services, with users reporting unexpected costs and calls growing for stronger safeguards and quicker incident response from such platforms.

A breach of the OpenCode Console reportedly exposed API keys belonging to OpenAI, Anthropic, and Google in what is described as a credential theft and distillation attack. The incident, dated October 2026, raises concerns about how security firms and developers store third-party AI credentials. Commentators are flagging the risks of leaked API keys being abused for model access or data distillation.

A security breach at OpenCode has exposed users' stored API keys for OpenAI and Anthropic, prompting an urgent warning for affected customers to rotate their credentials immediately. The incident highlights the risks of developer tools that hold sensitive AI provider keys, as leaked keys can be used to run up unauthorized charges or access models.

OpenCode disclosed that attackers accessed a legacy system behind its cloud-based Console, potentially exposing AI provider API keys belonging to roughly 1.4% of Console users. The company linked the intrusion to a distillation-style attack and is urging affected users to rotate their keys. Security communities are sharing the disclosure and debating the risks of storing third-party AI credentials in developer cloud tools.

The open source AI coding agent OpenCode has been compromised by hackers, who reportedly ran up charges on users' connected AI accounts. OpenCode has grown popular as a free alternative to paid tools like Claude Code and Cursor, so the breach raises concerns about supply-chain security for open source developer tools and unexpected costs for anyone who had linked their API accounts.

A breach involving OpenCode was confirmed on October 17, according to Infosecurity Magazine. Reporting suggests the incident could have implications for major AI companies including OpenAI, Anthropic and Google, given their ties to widely used open-source development tools. Security commentators are sharing the story and flagging it as a data breach concern within the infosec community.

OpenCode has confirmed it suffered a security breach linked to a large-scale AI distillation attack, with the company saying users have been affected. An AI distillation attack typically involves an adversary extracting proprietary model outputs to replicate or misuse an AI system, and the incident raises concerns over how widely user data or model behaviour may have been compromised. The extent of the impact and the number of affected users have not yet been detailed.

AI startup OpenCode has reportedly suffered a security breach that may have exposed data connected to major AI platforms including Anthropic's Claude and OpenAI's ChatGPT, with Google potentially affected as well. The incident raises questions about how third-party AI tools store and protect user data and API credentials, and what the exposure could mean for users of these services.

Security firm Pillar Security has published research describing a remote code execution vulnerability in opencode, exploited through MCP OAuth. The disclosure, made alongside coverage from Infosecurity Magazine, is circulating among cybersecurity professionals, with some commenting on the seriousness of the flaw and its implications for developers using AI coding tools.

OpenCode has suffered a data breach in which API keys linked to third-party services were exposed, according to GBHackers News. The leak of such credentials could allow attackers to access or abuse connected external services. Users of the platform are being urged to rotate their keys and review access as details about the scale and cause of the incident remain limited.

A security breach at OpenCode has exposed third-party API keys belonging to 1.4% of users of its Console service. Affected credentials could allow unauthorized access to connected external services, and users are being urged to rotate keys. The incident adds to ongoing concerns about how developer tools handle sensitive credentials.

OpenCode has reportedly been hacked, and users are being urged to revoke their API keys as a precaution. The incident raises concerns that attackers may have gained access to credentials or sensitive data linked to the service. Details about the scope of the breach, how it occurred, and how many users are affected have not yet been confirmed, and users are advised to act quickly to secure their accounts.

Hackers compromised part of the online platform of OpenCode, an open-source AI coding agent popular as an alternative to Claude Code and Cursor, and stole some users' API keys. The stolen credentials were then used to run up charges on victims' connected AI accounts, raising fresh concerns about key security around fast-growing developer tools.

The open-source coding tool OpenCode has reportedly been hacked, putting users' API keys for OpenAI, Anthropic and Google at risk of exposure. The security incident could allow attackers to access developers' paid AI accounts and sensitive credentials. Details on the scale of the breach and which users are affected remain limited as the story develops.

An intruder gained access to a legacy system at OpenCode on October 16, 2026, potentially exposing third-party AI provider keys stored in the OpenCode Console. Roughly 1.4% of Console users who had linked an outside provider such as OpenAI, Anthropic, or Google are affected. The disclosure is prompting discussion about how AI tooling companies secure API credentials.

An overnight breach of an older OpenCode system affected 1.4% of OpenCode Console users, leaving developers facing unauthorized API charges ranging from hundreds to over $1,000 via stored service keys. OpenCode confirmed that its standalone open-source app and command-line tool were unaffected, with the incident limited to the Console platform.

OpenCode Console has suffered a data breach that exposed users' API keys for AI providers, according to initial reports circulating under the name OrcaRouter. Such keys can be used to run up large bills or access paid AI services in victims' names. Affected users are being urged to rotate their credentials and review usage.

OpenCode has suffered a security breach that exposed users' stored API keys, prompting an urgent push for affected users to rotate their credentials. The incident raises concerns about how development tools store and protect sensitive authentication data, and security teams are being advised to review and replace any keys that may have been compromised as a precaution.