OpenCode hacked, user credentials leaked
The gist
OpenCode said a security breach hit 1.4% of OpenCode Console users and that it emailed them all.
Users are being told to check usage bills and revoke API keys.
How it unfolded
- Oct 17, 2026OpenCode posted that it had a security breach "last night" related to a large scale distillation attack that impacted 1.4% of OpenCode Console users, and that it had notified them all that morning via email.
- Oct 17, 2026OpenCode said the incident is ongoing and that it is working with Anthropic, OpenAI and Google to remediate.
- Oct 17, 2026A user replied that $138 was gone and asked whether users would be compensated; Matt Johansen posted advising users to check usage bills and revoke API keys.