The Pulse
OpenCode Says Breach Affected 1.4% of Console Users
OpenCode said a security breach affected 1.4% of Console users, a subset who had linked external providers, and that it had notified those users by email. Its public statement did not say provider API keys were exposed or explain the incide
AI.info Team · Written with AI ·
OpenCode said on October 17, 2026, that a security breach affected 1.4% of OpenCode Console users. The company described the affected users as a subset who had linked external providers and said it had notified them by email. Its announcement did not say that provider API keys were exposed, identify what information or systems were accessed, or give a total number of affected users.
OpenCode characterized the incident as related to a “large scale distillation attack.” The company did not explain in its public post what that phrase meant in this incident or how the attack related to the breach. It also did not describe how access was obtained, when the incident began beyond saying it happened “last night,” or whether any particular provider’s systems or data were involved.
OpenCode’s post said:
“The incident is ongoing so we cannot share more details at this point but we are working with Anthropic, OpenAI, and Google to remediate.”
OpenCode, in a statement from its official X account
The company also said that users who did not receive an email were not affected. That describes the company’s stated notification process; the public post does not give the number of emails sent or provide a breakdown of the affected group. The 1.4% figure applies to Console users, according to OpenCode, not to all people who use its coding agent.
OpenCode’s documentation describes Console as an optional service. Users can sign in, add credits, obtain an API key and use Console models with OpenCode or another coding agent. The documentation explains how the product works, but it does not identify what was involved in the breach or say whether any Console API keys, external-provider keys, or other credentials were accessed.
The distinction matters because the public statement gives a proportion and a broad description of the affected group, not an inventory of exposed data. OpenCode said the affected users had external providers linked, but did not specify whether that connection meant their keys or other information had been accessed. Nor does the 1.4% figure establish how many people were affected: OpenCode did not publish the total number of Console users alongside it.
As of the announcement, the incident was ongoing and OpenCode said it could not share more details. The company named Anthropic, OpenAI and Google as organizations it was working with to remediate, but did not say that any of them were responsible for the breach or identify one as its target. The post did not include technical findings, an incident timeline beyond “last night,” or a further description of the response.
OpenCode’s disclosure therefore establishes the reported scope only as the company stated it: 1.4% of Console users were affected, and the affected group was a subset with external providers linked. It does not establish whether credentials were exposed, whether they were used, or what other data or systems may have been involved. Those questions remain unanswered in the public announcement.