The OpenCode hack requires immediately revoking every API key stored in the Hosted Console, then replacing it with OpenAI, Anthropic, Google or the relevant provider. OpenCode acknowledged on October 17, 2026, that 1.4 % of Console users had been affected. Disconnecting the integration is not enough: a copied key remains usable until it is revoked.
What exactly do we know about the OpenCode breach?
The OpenCode breach reached an old hosted Console system that was being decommissioned. According to the communication published by OpenCode on October 17, 2026, the incident affected 1.4% of Console users, specifically those who had connected external artificial intelligence providers.
OpenCode Console is a hosted service that stores external provider credentials and forwards requests through its gateway. API keys stored in certain workspaces may therefore have been exposed. An API key is an information secret that authorizes an application to consume a service and, often, incur charges.
OpenCode said it had notified all identified users by email and was working with Anthropic, OpenAI, and Google on corrective measures. As of October 21, 2026, however, no reliable public total makes it possible to determine the number of exposed keys, the number of keys used, or the overall amount of losses.
The figure of 1.4% cannot be converted into a number of accounts without knowing the total number of Console users. As of October 21, 2026, the precise intrusion mechanism, the method used to extract the credentials, and the actual use of each potentially accessible key also remain undetermined. Any more precise estimate would be speculative.
What should you do after the OpenCode breach?
After the OpenCode breach, the priority is to delete or revoke the potentially compromised key from the account of the provider that issued it. You should then create a new credential, replace the old one in every affected application, and review usage recorded around October 17, 2026.
The order of operations matters. Removing OpenCode from your tools or disconnecting a Console connection may prevent future exchanges with the service, but it does not invalidate a key that has already been copied. Revocation must be performed in the administration console of OpenAI, Anthropic, Google Cloud, or the provider used.
Follow these steps for each credential that may have passed through OpenCode Console:
- Inventory the providers and workspaces connected to OpenCode Console before or during October 17, 2026.
- Revoke each affected key with its provider, even if no abnormal usage appears.
- Create a replacement key limited to the relevant project, application, and environment.
- Update the servers, automations, internal tools, and deployment pipelines that used the old secret.
- Test each integration, then verify that the old key fails when a request is attempted.
- Review usage and billing logs, then retain useful evidence in case of a dispute.
For an agency, the first step is to map dependencies before replacing a secret. A rushed rotation can interrupt a website, conversational agent, or business process if a secondary integration was overlooked. Nevertheless, it is better to accept a brief, controlled outage than to leave a potentially compromised key active.
How can you check whether an AI API key was used?
Verification involves reviewing the provider’s usage dashboards for a period covering at least October 17, 2026, and the following days. OpenAI allows activity to be filtered by project and period; Anthropic offers filters by API key, model, workspace, and hour or minute.
Look for an unusual increase in tokens consumed, calls made at inconsistent times, models never used by your team, or usage originating from an inactive project. Compare this data with your application, hosting provider, and monitoring tool logs. The absence of an anomaly does not prove that the key was not copied.
Users reported unauthorized usage after the incident. A testimonial published on October 17, 2026, mentions approximately $158 in usage accumulated overnight, while another account dated October 20, 2026, estimates the charges at approximately $1,700. These amounts are individual, unaudited claims, not a measure of overall losses.
OpenAI supports project-level budgets and usage alerts in 2026. Anthropic offers spending limits and workspace notifications in 2026. These safeguards do not replace revocation, but they reduce the time between abnormal usage and its detection.
Hosted Console or local client: what is the difference in risk?
OpenCode hosted Console and the local client do not store credentials in the same place. In 2026, the Console stores access credentials for external providers to forward requests, while the local client places credentials entered with /connect in ~/.local/share/opencode/auth.json.
| Usage mode | Documented location | Action after the incident | Main risk |
|---|---|---|---|
| OpenCode hosted Console | Credentials stored by the hosted service | Revoke and replace the associated keys | Copy of a secret from the compromised remote system |
Local OpenCode client with /connect |
~/.local/share/opencode/auth.json |
Check whether the key was also entered in the Console | Access to the workstation, backup, or poorly protected local file |
| Application with a secrets manager | Encrypted vault or secret injected during deployment | Rotate the key if the same key was linked to the Console | Overly broad permissions or a secret shared across multiple projects |
A maintainer stated on October 17, 2026, that keys entered only in the local client did not reach OpenCode’s hosted systems. The official documentation confirms local storage, but no public forensic analysis report had yet validated all of the incident’s technical limits as of October 21, 2026.
“Local” does not, incidentally, mean “risk-free.” The authentication file can be retrieved by malware, an overly exposed backup, or a compromised user account. For a small or midsize business, the right question is therefore which systems can read the secret, rather than relying solely on where it appears to be stored.
This logic also applies to access management with any digital subcontractor. The lessons from a data breach at a service provider help define responsibilities, notification requirements, and the evidence to retain. A cloud recovery plan complements this approach when revocation or an outage disrupts a business service.
How can you secure AI API keys over the long term?
An artificial intelligence API key should be limited to a project and environment, stored in an encrypted secrets manager, monitored, and replaced periodically. In 2026, OpenAI, Anthropic, and Google recommend separating credentials by application, project, environment, or use case to contain a compromise.
Avoid using a shared key for the public website, developers tests and internal processes. If that secret leaks, you will have to interrupt several services at once and will have difficulty attributing the expenses. Honestly, the slight additional management efforort is justified as soon as an API is involved in a business process or usage-based billing.
Secrets must never be written directly into code or sent to a Git repository. Use an encrypted secrets manager or environment variables injected lors during deployment. Google also recommends in 2026 restricting keys by API and application lors when the service allows it, deleting unused keys, monitoring their usage, and organizing their rotation.
In the projects we handle, we often see a more subtle risk: the test key becomes the production key because the integration worked on the first try. A few months later, no one knows which tools are using it. A simple register associating the owner, provider, project, environment, and rotation date prevents this roadblock.
Maximum spending limits and alerts should finally be configured at the most granular level available. A limit does not prevent a secret from being stolen, but it limits its financial impact. To extend control to workstations, accounts, and backups, these free cybersecurity tools for businesses provide complementary starting points.
Establishing a secrets-management process before the next incident prevents improvised rotations and unnecessary interruptions. An outside perspective can help inventory dependencies, define more granular permissions, and test the procedure without waiting for a key to be exposed.
FAQ about the OpenCode hack and API keys
Is disconnecting OpenCode enough to protect an API key?
Disconnecting OpenCode does not revoke an API key that may have already been copied. The key must be deleted or revoked directly in the OpenAI, Anthropic, Google, or other provider’s console.
Should a key be changed if no animal expense appears?
A potentially exposed key should be revoked even if its usage appears normal. A third party may retain it and use it later, while low activity may fall below the alert threshold.
Are keys used only in the local client affected?
Credentials entered only in the local OpenCode client are documented as being stored in ~/.local/share/opencode/auth.json. As of October 21, 2026, no public forensic report had yet established all the limits of the incident; above all, check whether the same key was also recorded in the hosted Console.
Can API charges incurred after a breach be disputed?
A dispute depends on the provider’s rules and the available evidence. Revoke the key, exporort the hordated logs, retain the incident notification, and promptly report the disputed calls to the relevant supporort.