opencode

OpenCode says it has been hacked and that user credentials were leaked. The startup confirmed the breach via its official account, and the news is drawing attention on developer forums, where users are asking what data was exposed and whether they need to change passwords. Details about the scale of the breach and how it happened have not yet been made clear.

OpenCode has disclosed a security breach in which a distillation attack affected Console users who had linked AI providers to their accounts. A security advisory is urging developers to check whether OpenCode is installed on their machines and follow response steps, amid concern over exposed API credentials and downstream misuse of connected AI services.

OpenCode disclosed a security breach affecting 1.4% of its console users. The company shared the disclosure on social media, and the news is drawing attention on developer forums as users discuss the scope of the incident and what data may have been exposed. Further details about the breach's cause and the company's response remain limited.

A security breach at OpenCode has exposed the third-party API keys of users of its console, raising concerns that attackers could abuse the leaked credentials to access paid services or sensitive accounts. The incident highlights the risks of platforms storing or handling external API credentials on behalf of their users.

A security breach involving the OpenCode console may have exposed API keys belonging to OpenAI, Anthropic, and Google, according to a report by The Hacker News. If confirmed, the leak could allow unauthorized access to the AI companies' services and customer accounts. Details about the scale of the breach and how the keys were compromised remain limited.

Security researchers warn that OpenCode patched a critical remote code execution vulnerability without public disclosure, leaving users unaware they needed to update and potentially exposed to exploitation. Critics say silent fixes undermine transparency in open-source security and deny defenders the information needed to assess risk and respond in time.

Security outlet SC Media reports that OpenCode has suffered a breach in which attackers used a distillation-style technique to expose users' API keys. The incident raises concerns about how AI development tools store and protect the credentials developers entrust to them. Exposure of API keys can allow attackers to run up charges on victims' accounts or access cloud services. Further details on the number of affected users and the response have not yet been reported.

Hackers compromised OpenCode, an AI-powered coding tool, and used it to run up unauthorized charges on users' connected AI accounts. The incident has raised concerns about the security of developer tools that link to paid AI services, with users reporting unexpected costs and calls growing for stronger safeguards and quicker incident response from such platforms.

A security breach at OpenCode has exposed users' stored API keys for OpenAI and Anthropic, prompting an urgent warning for affected customers to rotate their credentials immediately. The incident highlights the risks of developer tools that hold sensitive AI provider keys, as leaked keys can be used to run up unauthorized charges or access models.

A security flaw in OpenCode allows malicious MCP (Model Context Protocol) servers to execute code on a user's machine during the sign-in process, affecting Windows and WSL environments. The issue, reported by The Hacker News, highlights growing risks around the MCP ecosystem as AI coding tools increasingly connect to external servers, where a compromised or malicious server could gain code execution before users take any deliberate action.

A breach of the OpenCode Console reportedly exposed API keys belonging to OpenAI, Anthropic, and Google in what is described as a credential theft and distillation attack. The incident, dated October 2026, raises concerns about how security firms and developers store third-party AI credentials. Commentators are flagging the risks of leaked API keys being abused for model access or data distillation.

OpenCode has reportedly been hacked, and users are being urged to revoke their API keys as a precaution. The incident raises concerns that attackers may have gained access to credentials or sensitive data linked to the service. Details about the scope of the breach, how it occurred, and how many users are affected have not yet been confirmed, and users are advised to act quickly to secure their accounts.

AI startup OpenCode has reportedly suffered a security breach that may have exposed data connected to major AI platforms including Anthropic's Claude and OpenAI's ChatGPT, with Google potentially affected as well. The incident raises questions about how third-party AI tools store and protect user data and API credentials, and what the exposure could mean for users of these services.

A breach involving OpenCode was confirmed on October 17, according to Infosecurity Magazine. Reporting suggests the incident could have implications for major AI companies including OpenAI, Anthropic and Google, given their ties to widely used open-source development tools. Security commentators are sharing the story and flagging it as a data breach concern within the infosec community.

A security breach at OpenCode has exposed third-party API keys belonging to 1.4% of users of its Console service. Affected credentials could allow unauthorized access to connected external services, and users are being urged to rotate keys. The incident adds to ongoing concerns about how developer tools handle sensitive credentials.

The open source AI coding agent OpenCode has been compromised by hackers, who reportedly ran up charges on users' connected AI accounts. OpenCode has grown popular as a free alternative to paid tools like Claude Code and Cursor, so the breach raises concerns about supply-chain security for open source developer tools and unexpected costs for anyone who had linked their API accounts.

OpenCode disclosed that attackers accessed a legacy system behind its cloud-based Console, potentially exposing AI provider API keys belonging to roughly 1.4% of Console users. The company linked the intrusion to a distillation-style attack and is urging affected users to rotate their keys. Security communities are sharing the disclosure and debating the risks of storing third-party AI credentials in developer cloud tools.

OpenCode has confirmed it suffered a security breach linked to a large-scale AI distillation attack, with the company saying users have been affected. An AI distillation attack typically involves an adversary extracting proprietary model outputs to replicate or misuse an AI system, and the incident raises concerns over how widely user data or model behaviour may have been compromised. The extent of the impact and the number of affected users have not yet been detailed.

OpenCode has suffered a data breach in which API keys linked to third-party services were exposed, according to GBHackers News. The leak of such credentials could allow attackers to access or abuse connected external services. Users of the platform are being urged to rotate their keys and review access as details about the scale and cause of the incident remain limited.

Security firm Pillar Security has published research describing a remote code execution vulnerability in opencode, exploited through MCP OAuth. The disclosure, made alongside coverage from Infosecurity Magazine, is circulating among cybersecurity professionals, with some commenting on the seriousness of the flaw and its implications for developers using AI coding tools.

The open-source coding tool OpenCode has reportedly been hacked, putting users' API keys for OpenAI, Anthropic and Google at risk of exposure. The security incident could allow attackers to access developers' paid AI accounts and sensitive credentials. Details on the scale of the breach and which users are affected remain limited as the story develops.

Hackers compromised part of the online platform of OpenCode, an open-source AI coding agent popular as an alternative to Claude Code and Cursor, and stole some users' API keys. The stolen credentials were then used to run up charges on victims' connected AI accounts, raising fresh concerns about key security around fast-growing developer tools.

An intruder gained access to a legacy system at OpenCode on October 16, 2026, potentially exposing third-party AI provider keys stored in the OpenCode Console. Roughly 1.4% of Console users who had linked an outside provider such as OpenAI, Anthropic, or Google are affected. The disclosure is prompting discussion about how AI tooling companies secure API credentials.

OpenCode Console has suffered a data breach that exposed users' API keys for AI providers, according to initial reports circulating under the name OrcaRouter. Such keys can be used to run up large bills or access paid AI services in victims' names. Affected users are being urged to rotate their credentials and review usage.

An overnight breach of an older OpenCode system affected 1.4% of OpenCode Console users, leaving developers facing unauthorized API charges ranging from hundreds to over $1,000 via stored service keys. OpenCode confirmed that its standalone open-source app and command-line tool were unaffected, with the incident limited to the Console platform.