Cafiyn Pulse
← Startup Signals
5 min readUpdated 2026-10-19Issue 7

OpenCode says a breach hit 1.4 percent of Console users who linked an AI provider. Rotate those keys before the root cause is published.

OpenCode has confirmed the breach and has not said how it happened or what was taken. Here is what the vendor said, who is exposed, the order to work in, and how to limit the damage next time.

ByKarthik KumarCafiyn Innovations
At a glance
Disclosed
18 October 2026, by OpenCode on X
Affected
1.4% of OpenCode Console users, those with external AI providers linked
Providers named
Anthropic, OpenAI and Google
Notification
OpenCode says every affected user was emailed on the morning of 18 October, and that no email means not affected
Root cause and data accessed
Not published. The incident is ongoing
Affected versions
Not published. The scope is Console accounts, not a CLI release
Where linked keys sit
~/.local/share/opencode/auth.json on macOS and Linux, per StepSecurity

What OpenCode has said

On 18 October OpenCode, the open source AI coding agent, posted on X: "We had a security breach last night related to a large scale distillation attack that impacted 1.4% of OpenCode Console users. We have notified them all this morning via email. The incident is ongoing so we cannot share more details at this point but we are working with Anthropic, OpenAI, and Google to remediate."

StepSecurity, which reproduced the statement and wrote up the response steps, draws three points from it. The impact is scoped to OpenCode Console users, not to everyone who has the OpenCode CLI installed. The affected subset had external providers linked, and OpenCode names Anthropic, OpenAI and Google. And OpenCode says it emailed every affected user, so no email means you were not impacted, according to the vendor.

What it has not said

As of StepSecurity's write up on 18 October, OpenCode has not published a root cause, what data was accessed, or a list of affected versions. We found no later public update from OpenCode. We do not know whether the linked credentials were copied, used or only exposed, and we are not going to guess.

StepSecurity's reading of why it matters is the useful one for planning: developers link provider accounts so the agent can call models for them, and if those linked credentials were exposed, an attacker can run inference against the victim's provider account. That shows up as unexpected spend and, depending on the provider, access to whatever the keys can reach. That is an assessment and not a confirmed outcome, but it is the failure to rule out.

Who is exposed

You are potentially affected if you have an OpenCode Console account and linked an Anthropic, OpenAI or Google provider to it. The version of the CLI on a machine does not tell you, because the breach is tied to Console accounts and not to a specific release.

StepSecurity says OpenCode keeps linked provider credentials on the developer's machine at ~/.local/share/opencode/auth.json on macOS and Linux, and at %USERPROFILE%\.local\share\opencode\auth.json on Windows. If that file exists and lists a provider, treat the developer as potentially affected until OpenCode's email says otherwise. We have not independently verified those paths.

Do this, in this order

Rotate first and investigate second. A key you replace today cannot be abused tomorrow, whatever the root cause turns out to be.

  • Search every team inbox, spam included, for the email OpenCode says it sent on the morning of 18 October.
  • Find who runs OpenCode. StepSecurity suggests checking each machine for the binary with which opencode, and for ~/.config/opencode and the auth.json file above. Ask people to report back and not to paste the file anywhere.
  • Open auth.json on each machine and note which providers it lists, without copying its contents. Every provider in that file is a credential worth rotating.
  • Create a new key for each linked Anthropic, OpenAI or Google account, switch your tools to it, then revoke the old key.
  • Open each provider's usage dashboard and look for requests nobody on the team made. Set a spend limit where the provider offers one.
  • While OpenCode says the incident is ongoing, treat relinking a provider as a decision and not a default.

Limit the damage from the next one

Most teams cannot answer which developers run which AI coding agents, which is the first question in a breach like this. Keep a simple inventory of agents and the provider keys each one holds. StepSecurity publishes an open source scanner, Dev Machine Guard, that detects AI coding agents, MCP servers and IDE extensions on a machine, and says it is free for community users. We have not tested it.

Beyond the inventory, three habits shrink the blast radius. Give each developer their own key per provider, so one revocation does not stop everyone. Use a separate key per tool, so you can revoke the agent without breaking your production code. And never put the shared team key into an agent's login. GitHub began blocking Anthropic API keys at push by default on 13 October, which helps with keys committed by mistake and does nothing for a key held in a tool's own login file.

What to do

  1. 1Search team inboxes, spam included, for the OpenCode email from the morning of 18 October.
  2. 2List every machine and person using OpenCode with a linked provider, using the checks above.
  3. 3Rotate each linked Anthropic, OpenAI and Google key now: create the new one, switch over, revoke the old one.
  4. 4Review each provider's usage dashboard for requests nobody on the team made, and set a spend limit.
  5. 5Move to one key per developer and one key per tool, so the next revocation is small.
  6. 6Reread OpenCode's statement for updates before you re link a provider.

Common questions

What happened in the OpenCode security breach?

OpenCode said on 18 October 2026 that a breach it ties to a large scale distillation attack affected 1.4% of OpenCode Console users. It says it emailed them all that morning and that the incident is ongoing. It has not published a root cause or what data was accessed.

Was my OpenCode account affected?

OpenCode says it notified every affected user by email on the morning of 18 October, and StepSecurity reports the vendor's position that anyone who did not receive an email was not impacted. Check spam as well as your inbox.

Which keys should I rotate after the OpenCode breach?

Any Anthropic, OpenAI or Google API key that was linked to OpenCode or the OpenCode Console. StepSecurity advises rotating them and then reviewing each provider's usage dashboard for requests you did not make.

Where does OpenCode store linked provider credentials?

StepSecurity says at ~/.local/share/opencode/auth.json on macOS and Linux, and %USERPROFILE%\.local\share\opencode\auth.json on Windows. Treat every provider listed in that file as a credential to rotate.

Is the OpenCode CLI itself compromised?

OpenCode has not said so. StepSecurity reads the vendor statement as tying the breach to Console accounts with linked providers and not to a specific CLI release, which is why the installed version does not tell you whether you were affected.

Has OpenCode said how the breach happened?

No. In the statement StepSecurity reproduced on 18 October it describes a large scale distillation attack, says the incident is ongoing, and says it cannot share more details yet. We found no later public update.

Sources

Read against the primary documentation rather than secondary coverage. Where a figure comes from a provider's own docs, it is quoted as published on 2026-10-19.

Related

Every security incident we track →Grade your secrets handling in 3 minutes →Pre launch checklist, secrets included →

More from Signals

OpenAI removes o1, o3-mini, o4-mini and GPT-4 Turbo on 23 October. The replacements it names run from 5.5 times the price to 97 percent less.
Eleven models and six fine tuned models go dark in four days. Here is OpenAI's own mapping, what each landing costs on a typical month of traffic, and the places where the named replacement is not the cheapest or cannot be used at all.
GitHub Actions workflow lockfiles are in public preview. Here is how to turn them on, check them in CI, and what they do not protect.
A tag can move after you reviewed it. A lockfile makes the runner use the commit you reviewed. Here is the setup, the CI check, the policy, and what a lockfile cannot tell you.
Next.js 16.4.1 and 15.5.28 fix two critical remote code execution flaws. For one of them there is no workaround.
Two of the three fixes were postponed from September. Here is what each flaw needs in order to be reachable, the one workaround that exists, and what the announcement leaves out.
A poisoned npm release that punishes you for revoking the stolen token. The order of your response is the whole defence.
Most incident guidance starts with revoking the leaked token. Here that is the trigger. What StepSecurity found, the order it recommends, and why a valid provenance attestation did not help.
Claude Haiku 5.5 costs a tenth of Haiku 4.5 per token. One token past 100,000 it costs half.
The rate card is a tenth of Haiku 4.5. The footnote is a threshold that moves the price fivefold and that a tokenizer change pushes you toward.
Gemini 4 Argon launched at $2 and $10 and goes to $4 and $20 on 1 December. Price your product on the second number.
Every tier on the pricing page doubles on the same date. What changes, what the number includes, and what to do if you are building on the launch rate.
Claude Haiku 5.5 is not a model id swap. Five things that worked on Haiku 4.5 now return a 400.
The model id is the easy part. The requests that now fail, the response parsing that changes, and the details that fail quietly.
Next.js shipped 16.3.7 and 16.3.8 a day apart. Only one of them is the security release.
Two patch releases a day apart, one of them a decoy if you are not reading carefully. And the 15.5 line does not get the high severity fix at all.
The EU AI output marking rule is not a December deadline. For most teams it started in August.
Almost every summary of this gives one date. There are two, and which one applies to you depends on when you shipped, not on how big you are.
Sonnet 5.5 cut the rate by a third and the token count went up by about 30 percent.
A third off the per-token rate is not a third off the bill when the same text now costs more tokens. Here is the arithmetic, and the five ways your code can break.
Your AI gateway holds every provider key you have. A 9.9 just landed in LiteLLM.
An AI gateway concentrates every upstream key into one process. That is the point of it, and it is why a privilege escalation there is worse than it looks.
The table your coding agent created does not have row level security on it.
Dashboard-created tables get row level security by default now. API-created tables do not, and API is how your coding agent works.
A 9.5 in next/og. Whether it reaches you depends on one line in your OG route.
The advisory rates it 9.5, but it only fires if your OG image route puts attacker-controlled text into SVG. Here is how to find out which side of that line you are on.
OpenAI and Anthropic both cut prices on 22 September. One of them costs you a refactor.
Two frontier price cuts in one day is a good week for anyone paying a token bill. The migration cost is not evenly distributed, and one of the two prices comes with an expiry hedge.
A package install reads your home directory. This week two of them did it on purpose.
The implant did nothing clever. It read the files your shell reads, in the place your credentials live, and sent them somewhere else. That is the whole attack, and it works.
GitHub is switching off SHA-1 SSH keys. Find out now whether yours is one of them.
The keys at risk are the old ones, on the machines nobody logs into, in the pipelines that have run untouched for three years. Those are also the ones that will fail loudest.
Every third-party script tag is a standing grant to run code on your visitors.
A marketing form, a chat widget, an analytics snippet. Each one is permission for someone else's server to execute whatever it sends, on every page it sits on, forever.
1.8 million Android apps were scanned for hardcoded keys. Here is how to check yours.
Finding secrets in shipped apps is now a cheap, automated pipeline. Anything compiled into an APK, an IPA or a JavaScript bundle should be treated as already published.
OpenAI's Agents API will hold your agent state. What breaks if you ever need to leave.
Two major providers moved into the agent state layer in the same week. A managed harness is a real shortcut, as long as you keep a copy of what it holds.
Meta's Muse agent can now check out at your store. What merchants should change.
Agent purchases are arriving through wallets and single-use cards, not through merchants adopting a new protocol. Many merchants will receive them without choosing to.
What Brevo's SSO incident teaches about multi-tenant SAML and hijacked sending accounts.
One incident, two lessons: why email authentication did not help, and the tenant-scoping mistake anyone shipping SSO can make.
Cloudflare now sorts bots into Search, Training and Agent. What it means for your site and your agent.
The same change lands on two audiences. Site owners can now accidentally block search; agent builders will find more doors closed.
OpenAI has announced ten dated deadlines between 23 October 2026 and 1 April 2027. Here is the calendar.
Ten dated deadlines in six months, every one announced in public. The failure mode is never the notice. Updated 19 October with the entries added since September.
Nvidia bought Hugging Face. Your open-weight fallback is now a vendor relationship.
The commitments say nothing breaks. The structural change is that "we can always self-host" is now a dependency on one vendor rather than on a neutral commons.
The Videos API goes away on 24 September and OpenAI names nothing to move to.
Every other deprecation on OpenAI's page offers a migration target. This one does not, which makes it a different kind of problem.
Whisper shuts down on 26 February. The risk is not the deadline.
Five months is a generous window. Whisper is also typically wired into a background job that fails into a queue rather than into a user's face.
The Assistants API is gone. Your app may not have told you yet.
It shut down on 26 August 2026. The replacement is not a drop-in, and the most common migration mistake changes your model's behaviour without throwing an error.
One Copilot code review costs 13 requests. Here is the rest of the maths.
Copilot now bills on usage rather than seats. The headline change is simple. The multipliers underneath it are where teams get surprised.
Row-level security is on by default now. That is not the same as being protected.
Lovable fixed the default. The gap that actually leaks data was never the default, it was the policy, and no platform can write that for you.
Your model comparison is measuring the wrong number.
Every price list is per token. Your bill is per finished piece of work. Those two numbers can rank models in opposite orders.
An agent with production log access is a new identity. Treat it like one.
Always-on agents that read production logs are arriving fast. The access-control question they raise is old and well understood, which is the good news.

Open the tool.

Ten production categories, three minutes, and a ranked list of what to fix first.

Check your own stack