OpenCode Breach Exposed API Keys for 1.4% of Users — Rotate Yours Now

AI News 📅 Oct 18, 2026 ✍️ Aamir Raza

OpenCode Breach Hits AI API Keys

Anomaly Innovations confirmed a breach that exposed stored OpenAI, Anthropic and Google keys. If you linked a provider, rotate it now. LexxWire

Roughly 1.4% of OpenCode Console users were hit — those who linked external providers like OpenAI, Anthropic or Google to their accounts. LexxWire

The company blames a large-scale distillation attack on a legacy system it was decommissioning. Details of the method are still unclear. LexxWire

Some developers saw unauthorized charges on OpenAI and Anthropic bills before the email arrived. Google suspended at least one project. LexxWire

Create new keys, deploy them, delete the old ones — then watch usage for 48 hours. Set a spend cap on every provider that offers one. LexxWire