OpenCode Console breach: what BYOK users should do now

Published 2026-10-20 · Based on OpenCode's statements and provider docs as of Oct 20, 2026 · 7 min read · Not affiliated with any vendor

TL;DR

On the night of October 16, 2026, an intruder reached a legacy OpenCode system. Provider keys saved in the hosted OpenCode Console may have been exposed. OpenCode says this affected 1.4% of Console users who had OpenAI, Anthropic or Google keys linked.^[1]^[2]
OpenCode emailed affected users on October 17. No email means you weren't affected, per OpenCode.^[1]
Keys you only added to the OpenCode CLI or desktop app stay on your machine and weren't part of this, according to co-founder Dax Raad.^[2]
If you were affected: revoke the key at the provider (deleting it from Console doesn't revoke it), replace it everywhere, review billing back to Oct 16, and set a hard spend cap.

What OpenCode has confirmed

OpenCode posted on October 17 that it “had a security breach last night related to a large scale distillation attack that impacted 1.4% of OpenCode Console users,” that it had notified them all by email, and that the incident was ongoing. It also said it was working with Anthropic, OpenAI and Google to remediate.^[1] Console is OpenCode's optional hosted gateway. A workspace can save its own provider key there so team members can use models without seeing the key.^[2]

BleepingComputer reports that OpenCode's notice gives the earliest possible exposure as October 17, 2026, 00:30 UTC and mentions possible reimbursement.^[3] The Hacker News advises reviewing usage back to at least October 16, since OpenCode hasn't said when unauthorized access began.^[2]

What isn't known

OpenCode's wording is that keys “may have been exposed.” It hasn't said how many keys were copied, what the legacy system was, or how the distillation attack connects to the breach.^[2] Some users have publicly reported unauthorized charges, ranging from a few hundred dollars to about $1,700, and some Google Cloud projects were suspended for abusive activity.^[2]^[3] Those are individual reports, not figures from OpenCode.

Why a leaked key is expensive

A provider API key is a bearer credential. Whoever holds a copy can run billable requests on your account until the provider revokes it. A Console budget can't cap that, because Console only sees requests that pass through its own gateway.^[2] The only cap that holds is the one at the provider.

What to do now, by provider

Do this for every key you ever saved in OpenCode Console. It's worth doing for any key you've pasted into a third-party tool too.

OpenAI

Open API keys in the OpenAI Platform, delete (revoke) the key you stored in Console, and create a new one, ideally inside a dedicated project for that tool.
Check usage for the affected projects from October 16 onward.
Set a monthly spend limit under Project settings → Limits → Spend (or Organization limits) and turn on Enforce a hard limit. Requests then fail with a 429 when the limit is reached. OpenAI notes enforcement isn't instant, so spend can slightly overshoot. Alerts alone don't stop traffic.^[4]

Anthropic (Claude API)

In the Claude Console, go to API keys, disable or delete the exposed key, and create a new one scoped to a separate workspace for that tool.
Review usage and cost for the period since October 16.
Set a workspace spend limit: Workspaces → select workspace → Spend limits, with alerts at thresholds. Workspace caps can't exceed the organization cap.^[5] You can also lower the organization-wide monthly limit on the Billing settings.^[6]

Google (Gemini API)

In Google AI Studio or the Cloud console, delete the exposed key and create a new one. Google's API key docs cover creation and restrictions.
Gemini keys have no billing settings of their own: they inherit their project's billing account, tier and caps.^[7] So check the whole project's billing report, grouped by SKU, for the Gemini API.
Set a project spend cap in AI Studio (Spend → Monthly spend cap → Edit spend cap). Google marks it experimental, with roughly 10 minutes of billing latency.^[7] Or create a Cloud Billing spend cap budget for the Gemini API service, which pauses usage at 100% and emails at 50/80/100%.^[8]

Then, for all providers

Update every app and script that used the old key, or it will start failing.
One key per tool, one project or workspace per key. A leaked key then hits a small cap and is easy to trace.
Keep alerts below your hard cap, for example an alert at 50% and a hard limit at 100% of what you normally spend.
Keep records of any usage you didn't make, for a refund request to OpenCode or your provider.

Which plans avoid BYOK risk

“Bring your own key” means your exposure is your provider's spend cap. If you'd rather not hold pay-per-token keys at all, these sign in with an account and bill a flat or prepaid amount:

Claude Code on Claude Pro ($20) or Max ($100/$200): flat price, 5-hour and weekly limits. Limits
Codex on ChatGPT Plus ($20) or Pro ($100+). Limits
GitHub Copilot Pro/Pro+/Max: AI credits in dollars, with a budget you set. Credits
Cursor: prepaid top-ups with a monthly additional-usage cap. Limits
OpenCode itself can log in with GitHub Copilot or ChatGPT Plus/Pro instead of an API key. OpenCode Go ($10/$40) has fixed per-model monthly limits, and only falls back to your pay-as-you-go balance if you turn on “Use balance”.^[9] Console pay-as-you-go supports workspace and per-member monthly limits, but auto-reload can charge past them.^[10] See OpenCode pricing.

Subscriptions don't remove account risk, but a stolen login session isn't an uncapped API bill. To compare what these plans cost against paying API rates, use the calculator or our usage limits comparison.

FAQ

Was I affected by the OpenCode Console breach?

OpenCode says it emailed every affected user on October 17, 2026 (subject: "Action Required: Potential provider key breach") and that anyone who did not get the email was not affected. Affected users were 1.4% of OpenCode Console users who had an external OpenAI, Anthropic or Google key linked.

Are keys used by the OpenCode CLI or desktop app exposed?

According to OpenCode co-founder Dax Raad, as reported by The Hacker News, no: the CLI and desktop app store provider keys locally on your machine, and those keys never reach OpenCode. The breach involved keys saved in the hosted OpenCode Console.

Is deleting the key from OpenCode Console enough?

No. A provider key keeps working until the provider revokes it. Revoke it in the OpenAI, Anthropic or Google dashboard, create a new one, and update everything that used the old key.

Will I be refunded for unauthorized usage?

BleepingComputer reports that OpenCode’s notice mentions the possibility of reimbursement. Nothing has been confirmed publicly, so keep billing records for the period from October 16 onward and contact OpenCode and your provider.

Which AI coding plans avoid BYOK key risk?

Flat subscriptions where you sign in with your account instead of pasting a pay-per-token API key: Claude Pro/Max for Claude Code, ChatGPT Plus/Pro for Codex, GitHub Copilot, Cursor. Those still carry ordinary account risk, but a leaked login token is not an open-ended API bill.

Sources

We'll update this page if OpenCode publishes a fuller incident report. This is general guidance, not security advice for your specific setup.

OpenCode pricing & plans → · Calculator · All guides

Get pricing-change alerts

Email me when Cursor, Claude, Codex or Copilot change prices or limits. No spam, roughly 1–4 emails a month.

We only use your email for these alerts — never sold or shared. Stored on Cloudflare. See our privacy note.