OPENCODE , the open-source AI agent framework provider, confirmed a security breach that impacted its Console service—the component that stores and authenticates access to API credentials for teams using OpenAI, Anthropic and Google AI models. The incident occurred the night prior to 17 October 2026 and affected about 1.4% of OpenCode Console users.
OpenCode stated the breach involved unauthorized access to a legacy system that was undergoing decommissioning, and that third-party provider keys saved in users’ workspaces may have been exposed. The company noted that the breach involved only the OpenCode Console, not the OpenCode platform itself, and that Anthropic, OpenAI and Google were notified to remediate the issue. The information circulating publicly was partly derived from posts by a major OpenCode contributor and from the company’s social updates.
A security adviser, Safeguard, issued an incident response guide outlining recommended mitigations for affected users. Key steps include identifying whether a user was impacted by searching for the email subject “Action Required: Potential provider key breach,” compiling all potentially exposed keys across OpenAI, Anthropic and Google Gemini, and reviewing usage and billing from 16 October onwards.
The guidance also recommends generating replacement keys, revoking old ones, updating all systems and secrets, testing that revoked keys no longer function, and applying stricter controls such as project-specific keys, spending limits and restricted access. OpenCode and Anomaly have been contacted for comment, and the article notes that many details are based on the company’s disclosures and third-party security guidance rather than independent verification.