OpenCode Console old system breached, third-party keys including OpenAI and Anthropic possibly exposed

In mid-October 2026, a story circulated claiming that OpenCode had been hacked and user credentials had leaked, and most people's first reaction was to check the local CLI they run every day. A DEV Community · AI piece published at 10:00 on 24 October 2026 clarified that the system exposed was not the local CLI but the optional hosted service OpenCode Console. Console lets a team connect provider accounts and share them, and it stores those provider credentials on its side; the local coding agent keeps keys on the user's own disk. The author noted that the two share a name, and that this cost them real time confirming item by item that they were not affected. The team said the unauthorized access had hit a legacy system that was being decommissioned.

A follow-up piece at 22:00 on 25 October 2026 added detail from the official notice. OpenCode emailed affected Console users on 17 October 2026 under the subject "Action Required: Potential provider key breach", stating that an attacker had gained unauthorized access to a legacy system it was in the process of decommissioning and that third-party keys stored in a workspace might have been exposed, with OpenAI and Anthropic keys named explicitly. The article then walked through the notification against information on the OpenCode product page and discussed what it actually costs to hand provider keys over to a third-party console. As of the latest report, the story remains at the email-notification and media-analysis stage; no public follow-up on remediation or outcomes had been published. The reports differ in one respect: the first piece frames the exposure in terms of the provider credentials held server-side, while the second lists the specific vendor keys, including OpenAI and Anthropic, that it says may have been exposed. Which of the two accurately characterizes the scope is left open. OpenCode has not publicly stated how many users or keys were affected.