OpenCode Users Must Rotate Third-Party API Keys After Legacy System Breach
A legacy system breach may have exposed third-party API keys for 1.4% of OpenCode Console users. Affected accounts linked to Anthropic, OpenAI, or Google must rotate credentials.
Key points
- OpenCode disclosed a breach affecting 1.4% of Console users who linked external providers.
- Unauthorized access to a legacy system may have exposed third-party API keys stored in workspaces.
- The company linked the incident to a large-scale distillation attack and is working with major AI vendors.
OpenCode announced on October 17 that a security breach may have exposed third-party API keys for a subset of its Console users. The incident involves unauthorized access to a legacy system that the company was preparing to decommission. According to Cyber Security News, the exposure affects 1.4% of Console users, specifically those who had linked external service providers to their workspaces.
Root cause
The breach stemmed from unauthorized access to a legacy system within OpenCode’s infrastructure. This system was scheduled for shutdown but contained stored credentials for third-party providers. OpenCode stated that the incident is linked to a large-scale distillation attack, a technique where attackers train one AI model using outputs generated by another. The company is collaborating with Anthropic, OpenAI, and Google to address the fallout.
View the original post on X
Attack path
OpenCode has not disclosed the specific method attackers used to gain access to the legacy system. The public statement does not detail the duration of the intrusion or the technical evidence linking the breach to the reported distillation activity. It remains unclear whether the exposed credentials were actively used to generate model outputs or if the exposure was limited to potential access.
Affected versions
The impact is limited to OpenCode Console users who meet specific criteria. According to the disclosure, the 1.4% figure refers only to Console users, not the entire OpenCode user base. The affected group consists exclusively of users who had linked external providers, such as Anthropic, OpenAI, or Google, to their workspaces. Users who did not receive a notification email from OpenCode are not considered impacted.
Mitigation
OpenCode advises affected users to take immediate action through the dashboards of their respective providers. The company has emailed all impacted users with instructions. Those who did not receive an email are not affected. The primary mitigation step is to revoke and replace any third-party API keys that may have been exposed in the legacy system.
For customers and users
If you received a notification from OpenCode, assume your third-party API keys are compromised. Log in to the dashboards of linked providers like OpenAI or Anthropic. Revoke the existing keys and generate new ones immediately. Update any applications or scripts that rely on the old credentials to use the new keys. Monitor your account activity for unexpected usage or charges. Be wary of phishing emails claiming to offer help with this breach; legitimate support will not ask for passwords or new keys via email.
Background: Unauthorized access
Stop unauthorized access by enforcing strict identity verification, minimizing the data surface available to attackers, and continuously monitoring system integrity. This checklist covers identity controls, data protection, and network segmentation to reduce the risk of intrusions.
Read the full guide: Unauthorized Access Prevention Checklist for Systems
What to do and how to stay safe: OpenCode
- Check your inbox for the official notification from OpenCode regarding API key exposure.
- If notified, log in to your third-party provider dashboards to revoke and regenerate affected API keys.
- Review recent usage logs on linked accounts for any unauthorized or unexpected activity.
- Update any personal applications or scripts that depend on the compromised keys to use the new credentials.
Step-by-step guide: Credit Freezes for Small Business: Protecting Employee Identities
General security guidance from the DarkWeb Headlines newsroom. It is not confirmed advice from the organisations named in this story.
Frequently asked questions
How many users are affected by the OpenCode breach?
The breach affects 1.4% of OpenCode Console users who had linked external providers to their workspaces.
What type of attack caused the exposure of API keys?
OpenCode linked the incident to a large-scale distillation attack involving unauthorized access to a legacy system.
Do I need to change my password if I didn't receive an email?
No, OpenCode stated that users who did not receive an email notification were not impacted by this breach.
