OpenCode disclosed a security breach on October 17 that it said affected 1.4% of its Console users. It described the affected group as a subset who had linked external AI providers, said it had emailed them, and named Anthropic, OpenAI and Google as remediation partners.
The distinction matters for developers who use OpenCode locally. Dax Raad, who works on OpenCode, said the breach involved the hosted Console rather than the OpenCode app itself, whose provider keys do not reach the company.
Anthropic's Lydia Hallie said it had revoked Claude API keys it believed were affected. She advised users who had saved a key in OpenCode to create a new one as an extra precaution. This does not confirm that every affected key at every provider has been revoked.
Raad subsequently said refunds were underway and everyone affected had already been contacted. That is not confirmation that each refund has arrived.
OpenCode linked the breach to a large-scale distillation attack but did not explain the connection in its statement. The statements do not establish a total financial loss or the technical entry point.